blackshades | 22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Size

233KB
MD5

31c0d45df9c966ad7e11ab233078607e
SHA1

ead2ce24fbf87bebad55500604557bf9ac4d2ddf
SHA256

22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157
SHA512

bd99241deae5815117fd8725b105006238a6980d65a3f1115d1d107ff66fa5abf6ef122db3fc65910e47087b4b0c21b51fc9bcf35c5a8de12fbc1cfb3b0f0df8
SSDEEP

6144:OTu5OUFQPwNcHEOHA6ekznVuf5e9LoZgYuyY:EuzmO2hA6pncOoZgv

Score

10^/10

blackshades hawkeye defense_evasion discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral2/memory/228-23-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral2/memory/228-24-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe = "C:\\Users\\Admin\\AppData\\Roaming\\U5P8P5076W.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	nvxdsinc.exe

Deletes itself 1 IoCs

pid	Process
912	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe"	nvxdsinc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 228	912	explorer.exe	83
PID 3684 set thread context of 2824	3684	nwtray.exe	98

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/228-20-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/228-22-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/228-23-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/228-24-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nwtray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvxdsinc.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1852	reg.exe
2560	reg.exe
1584	reg.exe
3000	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe
2052	nvxdsinc.exe
3684	nwtray.exe
912	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Token: SeDebugPrivilege	912	explorer.exe
Token: 1	228	AppLaunch.exe
Token: SeCreateTokenPrivilege	228	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	228	AppLaunch.exe
Token: SeLockMemoryPrivilege	228	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	228	AppLaunch.exe
Token: SeMachineAccountPrivilege	228	AppLaunch.exe
Token: SeTcbPrivilege	228	AppLaunch.exe
Token: SeSecurityPrivilege	228	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	228	AppLaunch.exe
Token: SeLoadDriverPrivilege	228	AppLaunch.exe
Token: SeSystemProfilePrivilege	228	AppLaunch.exe
Token: SeSystemtimePrivilege	228	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	228	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	228	AppLaunch.exe
Token: SeCreatePagefilePrivilege	228	AppLaunch.exe
Token: SeCreatePermanentPrivilege	228	AppLaunch.exe
Token: SeBackupPrivilege	228	AppLaunch.exe
Token: SeRestorePrivilege	228	AppLaunch.exe
Token: SeShutdownPrivilege	228	AppLaunch.exe
Token: SeDebugPrivilege	228	AppLaunch.exe
Token: SeAuditPrivilege	228	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	228	AppLaunch.exe
Token: SeChangeNotifyPrivilege	228	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	228	AppLaunch.exe
Token: SeUndockPrivilege	228	AppLaunch.exe
Token: SeSyncAgentPrivilege	228	AppLaunch.exe
Token: SeEnableDelegationPrivilege	228	AppLaunch.exe
Token: SeManageVolumePrivilege	228	AppLaunch.exe
Token: SeImpersonatePrivilege	228	AppLaunch.exe
Token: SeCreateGlobalPrivilege	228	AppLaunch.exe
Token: 31	228	AppLaunch.exe
Token: 32	228	AppLaunch.exe
Token: 33	228	AppLaunch.exe
Token: 34	228	AppLaunch.exe
Token: 35	228	AppLaunch.exe
Token: SeDebugPrivilege	2052	nvxdsinc.exe
Token: SeDebugPrivilege	3684	nwtray.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
228	AppLaunch.exe
228	AppLaunch.exe
228	AppLaunch.exe
2824	AppLaunch.exe
2824	AppLaunch.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 912	4932	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	82
PID 4932 wrote to memory of 912	4932	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	82
PID 4932 wrote to memory of 912	4932	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	82
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 912 wrote to memory of 228	912	explorer.exe	83
PID 228 wrote to memory of 1612	228	AppLaunch.exe	84
PID 228 wrote to memory of 1612	228	AppLaunch.exe	84
PID 228 wrote to memory of 1612	228	AppLaunch.exe	84
PID 228 wrote to memory of 5112	228	AppLaunch.exe	85
PID 228 wrote to memory of 5112	228	AppLaunch.exe	85
PID 228 wrote to memory of 5112	228	AppLaunch.exe	85
PID 228 wrote to memory of 1036	228	AppLaunch.exe	86
PID 228 wrote to memory of 1036	228	AppLaunch.exe	86
PID 228 wrote to memory of 1036	228	AppLaunch.exe	86
PID 228 wrote to memory of 4352	228	AppLaunch.exe	87
PID 228 wrote to memory of 4352	228	AppLaunch.exe	87
PID 228 wrote to memory of 4352	228	AppLaunch.exe	87
PID 1036 wrote to memory of 1852	1036	cmd.exe	92
PID 1036 wrote to memory of 1852	1036	cmd.exe	92
PID 1036 wrote to memory of 1852	1036	cmd.exe	92
PID 5112 wrote to memory of 1584	5112	cmd.exe	94
PID 5112 wrote to memory of 1584	5112	cmd.exe	94
PID 5112 wrote to memory of 1584	5112	cmd.exe	94
PID 4352 wrote to memory of 2560	4352	cmd.exe	93
PID 4352 wrote to memory of 2560	4352	cmd.exe	93
PID 4352 wrote to memory of 2560	4352	cmd.exe	93
PID 1612 wrote to memory of 3000	1612	cmd.exe	95
PID 1612 wrote to memory of 3000	1612	cmd.exe	95
PID 1612 wrote to memory of 3000	1612	cmd.exe	95
PID 912 wrote to memory of 2052	912	explorer.exe	96
PID 912 wrote to memory of 2052	912	explorer.exe	96
PID 912 wrote to memory of 2052	912	explorer.exe	96
PID 2052 wrote to memory of 3684	2052	nvxdsinc.exe	97
PID 2052 wrote to memory of 3684	2052	nvxdsinc.exe	97
PID 2052 wrote to memory of 3684	2052	nvxdsinc.exe	97
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98
PID 3684 wrote to memory of 2824	3684	nwtray.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3000
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1584
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2560
- - C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
    "C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
      "C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
e9d43484dd9b784bfec3ac8c969db42d

SHA1
91f5794b278468ea0c8f3c7fe11479d475f65885

SHA256
720f381f48449cbc9252be7992f7574d201801ea8d559eb30525357a2850f7d6

SHA512
521376a633c764eac1ffcdf10b5746ac75f72d6ae0305842681be73917852197c2640bcda32f619a9d0a0a706b3d3dbf06513fff4bc49306a801eee09bae2f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

Filesize
39KB

MD5
38abcaec6ee62213f90b1717d830a1bb

SHA1
d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9

SHA256
6fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768

SHA512
77eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
233KB

MD5
31c0d45df9c966ad7e11ab233078607e

SHA1
ead2ce24fbf87bebad55500604557bf9ac4d2ddf

SHA256
22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157

SHA512
bd99241deae5815117fd8725b105006238a6980d65a3f1115d1d107ff66fa5abf6ef122db3fc65910e47087b4b0c21b51fc9bcf35c5a8de12fbc1cfb3b0f0df8

Download Submit
memory/228-20-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/228-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/228-23-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/228-24-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/912-13-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/912-51-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/4932-0-0x00000000746C2000-0x00000000746C3000-memory.dmp

Filesize
4KB

Download
memory/4932-14-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/4932-2-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/4932-1-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download