ctblocker | aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe
Size 994KB
Sample241002-3pb2mstanp
SHA256 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
MD5 0cefce0dbbbedc5eb1febe4d85b23c71
SHA1 6aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA512 1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
SSDEEP 12288:lnhtIy1hwrU6iArDokTOm4Ndc427rSWb3pM+Y9Mu506gK8uaBmuY:Nh+ykBxV4Ndc42PSWdq1JgUaB3Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ctblocker defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\ProgramData\esufwfj.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://onja764ig6vah2jo.onion.cab or http://onja764ig6vah2jo.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://onja764ig6vah2jo.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://onja764ig6vah2jo.onion.cab
http://onja764ig6vah2jo.tor2web.org
http://onja764ig6vah2jo.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\International\Geo\Nation	xjlvlhd.exe

Executes dropped EXE 4 IoCs

pid	Process
2896	xjlvlhd.exe
772	xjlvlhd.exe
2676	xjlvlhd.exe
2756	xjlvlhd.exe

Loads dropped DLL 1 IoCs

pid	Process
2896	xjlvlhd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	xjlvlhd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-xpaleza.bmp"	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2896 set thread context of 772	2896	xjlvlhd.exe	31
PID 2676 set thread context of 2756	2676	xjlvlhd.exe	38

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-xpaleza.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-xpaleza.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjlvlhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjlvlhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjlvlhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjlvlhd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1696	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	xjlvlhd.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	xjlvlhd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	xjlvlhd.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00300034006300330066003200610034002d0033006100380033002d0031003100650066002d0062003000320063002d003800300036006500360066003600650036003900360033007d00000030002c007b00610039003000650030003000380031002d0033006100340062002d0031003100650066002d0062003400660062002d006500610038003200390062003700610031006300320061007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{04c3f2a4-3a83-11ef-b02c-806e6f6e6963}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{04c3f2a4-3a83-11ef-b02c-806e6f6e6963}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a90e0081-3a4b-11ef-b4fb-ea829b7a1c2a}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{04c3f2a4-3a83-11ef-b02c-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a90e0081-3a4b-11ef-b4fb-ea829b7a1c2a}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a90e0081-3a4b-11ef-b4fb-ea829b7a1c2a}\NukeOnDelete = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1320	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe
772	xjlvlhd.exe
772	xjlvlhd.exe
772	xjlvlhd.exe
772	xjlvlhd.exe
2756	xjlvlhd.exe
2756	xjlvlhd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	xjlvlhd.exe
Token: SeDebugPrivilege	772	xjlvlhd.exe
Token: SeShutdownPrivilege	1184	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	xjlvlhd.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2756	xjlvlhd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	xjlvlhd.exe
2756	xjlvlhd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1184	Explorer.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1320	2240	0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe	28
PID 2360 wrote to memory of 2896	2360	taskeng.exe	30
PID 2360 wrote to memory of 2896	2360	taskeng.exe	30
PID 2360 wrote to memory of 2896	2360	taskeng.exe	30
PID 2360 wrote to memory of 2896	2360	taskeng.exe	30
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 2896 wrote to memory of 772	2896	xjlvlhd.exe	31
PID 772 wrote to memory of 600	772	xjlvlhd.exe	9
PID 600 wrote to memory of 1232	600	svchost.exe	32
PID 600 wrote to memory of 1232	600	svchost.exe	32
PID 600 wrote to memory of 1232	600	svchost.exe	32
PID 600 wrote to memory of 1624	600	svchost.exe	34
PID 600 wrote to memory of 1624	600	svchost.exe	34
PID 600 wrote to memory of 1624	600	svchost.exe	34
PID 772 wrote to memory of 1184	772	xjlvlhd.exe	21
PID 772 wrote to memory of 1696	772	xjlvlhd.exe	35
PID 772 wrote to memory of 1696	772	xjlvlhd.exe	35
PID 772 wrote to memory of 1696	772	xjlvlhd.exe	35
PID 772 wrote to memory of 1696	772	xjlvlhd.exe	35
PID 772 wrote to memory of 2676	772	xjlvlhd.exe	37
PID 772 wrote to memory of 2676	772	xjlvlhd.exe	37
PID 772 wrote to memory of 2676	772	xjlvlhd.exe	37
PID 772 wrote to memory of 2676	772	xjlvlhd.exe	37
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38
PID 2676 wrote to memory of 2756	2676	xjlvlhd.exe	38

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1232
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -Embedding
  2⤵
  PID:1624

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1184
- C:\Users\Admin\AppData\Local\Temp\0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0cefce0dbbbedc5eb1febe4d85b23c71_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1320

C:\Windows\system32\taskeng.exe
taskeng.exe {B1CA3C9F-AD57-4FDF-AAFE-F681F6D43714} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
  C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
    C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows all
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
      "C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe" -u
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe" -u
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

mbyrakb

Path C:\ProgramData\Package Cache\mbyrakb
Size 654B
SHA256 5dd184b3982119b894b39a12dea1bc9dc6d5003a2a3ae04619c4e76d4e944783
MD5 5c674deb7ef8e33e57ffd57343ce3ae5
SHA1 395c3296718765d8188df6ea1c750e8e3722d0e1
SHA512 02583d608e68a3b5feb822cf41817c84bc7f4c4fbcfb283c14eae4953dea7a6299f4d05374a1d843d9d9f1e3fdf5e0ffde951026c7e040b327a06d645aa3dade
MD5 SHA1 SHA512

Submit Download

mbyrakb

Path C:\ProgramData\Package Cache\mbyrakb
Size 654B
SHA256 c236d608557f5b54ae1b05ebeaf50f28dbe2a63d09aa4cb63b462a3d0d514af6
MD5 f8913d17cd782eff9280ce62822d66db
SHA1 236e2448585a50d640598cdc697989fadca9a04a
SHA512 e942f8aab232edc0602037992a731f64b807e8dde0499f9cb4417cd1ec1501fc3b51d46971781f1c2f18e4ad1578924f117e0228bbd220276d9d196b7778c648
MD5 SHA1 SHA512

Submit Download

mbyrakb

Path C:\ProgramData\Package Cache\mbyrakb
Size 654B
SHA256 a27cc11649dc9f82375aa42ce864efc0054b17920acfa1e29855d787c5802fbd
MD5 43aff46ffa974ceb26ac9f3aa1b4bc9e
SHA1 95b8135977ab6a6072ef49db1c5f7f6fc56bd7ac
SHA512 e30fc1cdeb56eddb4f0137b011e9b955f39ad05f155f1d02c4a191abf8f7e6e842d4496bd2094a9b987964de999351225b8c32d3ad9b9beb54fc7c8b6faa55ff
MD5 SHA1 SHA512

Submit Download

esufwfj.html

Path C:\ProgramData\esufwfj.html
Size 62KB
SHA256 37e23081273533c42e10120c88e2192dc0d2510f55d83d1dacf0eacf7dc3d527
MD5 604c89c5ec9a78ff5c2953eca03959b5
SHA1 51bcb31382c3f9b4a6a8d05f8e8278ea99be7b5a
SHA512 66ae5714e8ef0ac2c896ad764713669f041367ddfd9689c7df7b79b51ec125eae6fd7d63aaa91b99520544fb5559027458bb433f530bb1f7c06f05cda167bac4
SSDEEP 1536:f5mSGNVRECjM3IqRGTMXKz21qMQUWYZ5xs/5/:oNVRECjM3IqRGTMXKz21qMQUWYZ5xs/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

xjlvlhd.exe

Path C:\Users\Admin\AppData\Local\Temp\xjlvlhd.exe
Size 994KB
SHA256 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
MD5 0cefce0dbbbedc5eb1febe4d85b23c71
SHA1 6aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA512 1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
SSDEEP 12288:lnhtIy1hwrU6iArDokTOm4Ndc427rSWb3pM+Y9Mu506gK8uaBmuY:Nh+ykBxV4Ndc42PSWdq1JgUaB3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

memory/600-43-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-55-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-49-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-51-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-47-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-54-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-44-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-41-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-40-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/600-1251-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/772-1257-0x0000000000960000-0x0000000000BAB000-memory.dmp

Download

memory/772-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/772-37-0x0000000000960000-0x0000000000BAB000-memory.dmp

Download

memory/772-1273-0x0000000000960000-0x0000000000BAB000-memory.dmp

Download

memory/1320-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1320-14-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/1320-15-0x0000000000850000-0x0000000000A6A000-memory.dmp

Download

memory/1320-3-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/1320-16-0x0000000000CB0000-0x0000000000EFB000-memory.dmp

Download

memory/1320-5-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/1320-13-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/2240-2-0x0000000074EC0000-0x000000007546B000-memory.dmp

Download

memory/2240-1-0x0000000074EC0000-0x000000007546B000-memory.dmp

Download

memory/2240-0-0x0000000074EC1000-0x0000000074EC2000-memory.dmp

Download

memory/2240-11-0x0000000074EC0000-0x000000007546B000-memory.dmp

Download

memory/2240-12-0x0000000074EC0000-0x000000007546B000-memory.dmp

Download

memory/2756-1287-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2756-1279-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2756-1284-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2756-1285-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2756-1288-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2756-1290-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2756-1294-0x0000000000DB0000-0x0000000000FFB000-memory.dmp

Download

memory/2896-22-0x0000000074DD0000-0x000000007537B000-memory.dmp

Download

memory/2896-21-0x0000000074DD0000-0x000000007537B000-memory.dmp

Download

memory/2896-20-0x0000000074DD1000-0x0000000074DD2000-memory.dmp

Download

memory/2896-24-0x0000000074DD0000-0x000000007537B000-memory.dmp

Download

memory/2896-33-0x0000000074DD0000-0x000000007537B000-memory.dmp

Download