b8f64cabf9cd76735d77fd405a1635a0591eb7cbbd18830c47625b5c8936d20e

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Size

1013KB
MD5

16943270f05c11e266860bcd56bb20bb
SHA1

2a0cfe0c8c06938c00043858fa2aa81b6ddf3c98
SHA256

b8f64cabf9cd76735d77fd405a1635a0591eb7cbbd18830c47625b5c8936d20e
SHA512

2de21d417748ecc86ee8690ef0a6d63295961d013dc3e5f73b601a4041d730f1ad2d410d1f4b67322ac98ced3d77eb971793fdc3ffe99f386bd7f75e52d89def
SSDEEP

24576:ix+OSa0eVkMakTXBghG0dyMJqLDMMMMMMy6LD/dtfhS:ihp0eVbjqh9dYMMMMMMy6LD/drS

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1636	tazebama.dl_

Loads dropped DLL 1 IoCs

pid	Process
3436	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	tazebama.dl_

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	1636	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tazebama.dl_

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	tazebama.dl_
1636	tazebama.dl_

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1636	3436	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	82
PID 3436 wrote to memory of 1636	3436	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	82
PID 3436 wrote to memory of 1636	3436	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 724
    3⤵
    - Program crash
    PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1636 -ip 1636
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\tazebama.dl_

Filesize
151KB

MD5
0e141dae671d401855632dedfd7045ea

SHA1
c033c687495f1789485b8c2b6fb1e4509b94d03d

SHA256
a17f31fa26805f36024c4cd49827ae1ccaa8dc3443d4e186cc6e224e33bc63ac

SHA512
4697f437703eda0c564ef592a513574829b24e227dedd04653546b37ffb41c6d8f82fb9e355beb4466458804a472b567368c6e974a3cd1b51190c8b38e3a5d17

Download Submit
C:\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
151KB

MD5
bc278687c2ad14921203643d1c2a377c

SHA1
b6f878c6a4e6e29b8eab417c3a6d73ebe0f29efe

SHA256
5ce9bf4f781c0f9f1cf0841b10c5c0dbd6ac5cd291faf827347c745ebf2f7ca6

SHA512
f27a1c6560b40ced12ccf11ec200987f68403bd08a64915bfab48091dac66b57d650da2a70f095e85a302facefcdc4613eeb09d76253e2de004c9e61ac91aeb6

Download Submit
F:\zPharaoh.exe

Filesize
151KB

MD5
dffd30ebbd3537e6c276203bea484ae4

SHA1
430bcb92bb0736158c5765c7ac8be47aa79e8044

SHA256
d457a7cfdc5fe3d72351ef627f02d38215447dc3ff8632d2a92eb8039cbf61a2

SHA512
f151b116560a7e9a7bc8bd90c90c4aae6140666b68b208c941d25ae0372b0dc9db7fd91eeb594806d195a32f9e75db391c600eb0fe307ed32627cda1ce38ea3f

Download Submit
memory/1636-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1636-39-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3436-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/3436-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3436-47-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/3436-48-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download