blackshades | 8e4c03b7af470a66a3c34868881075e4dcb2da8d76110ebf4f0068b1cfbde130

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
Size

404KB
MD5

368b9153a60f2a2090f5e9ba6c6e2896
SHA1

023abcf8a180e68d55b1b74ff643168aac5d0cd1
SHA256

8e4c03b7af470a66a3c34868881075e4dcb2da8d76110ebf4f0068b1cfbde130
SHA512

e80ce774df365fdab251cf1a7f6a2482be4c128fd3b724f00144f7f19d64159d73289f5a4bdc26036d9d3c36e1add9fbaf4586cc13469964a8e5d6f4f57c544f
SSDEEP

12288:6Gl+8djqlV45BhPxgJxhpzs3CVHxzDrd0q+GZb6jYcuI6:6o+4jwqRxgJxhJHFDrwYx

Score

10^/10

blackshades defense_evasion discovery rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 9 IoCs

resource	yara_rule
behavioral1/memory/1848-39-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-37-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-48-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-50-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-52-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-53-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-55-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-58-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/1848-61-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ctfmon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ctfmon.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\XQQWR1XJBZ.exe = "C:\\Users\\Admin\\AppData\\Roaming\\XQQWR1XJBZ.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe

Executes dropped EXE 1 IoCs

pid	Process
1848	ctfmon.exe

Loads dropped DLL 2 IoCs

pid	Process
2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-27-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-39-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-37-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-36-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-32-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-29-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-48-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-50-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-52-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-53-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-55-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-58-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1848-61-0x0000000000400000-0x0000000000473000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2560	reg.exe
1956	reg.exe
2332	reg.exe
2008	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
Token: 1	1848	ctfmon.exe
Token: SeCreateTokenPrivilege	1848	ctfmon.exe
Token: SeAssignPrimaryTokenPrivilege	1848	ctfmon.exe
Token: SeLockMemoryPrivilege	1848	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	1848	ctfmon.exe
Token: SeMachineAccountPrivilege	1848	ctfmon.exe
Token: SeTcbPrivilege	1848	ctfmon.exe
Token: SeSecurityPrivilege	1848	ctfmon.exe
Token: SeTakeOwnershipPrivilege	1848	ctfmon.exe
Token: SeLoadDriverPrivilege	1848	ctfmon.exe
Token: SeSystemProfilePrivilege	1848	ctfmon.exe
Token: SeSystemtimePrivilege	1848	ctfmon.exe
Token: SeProfSingleProcessPrivilege	1848	ctfmon.exe
Token: SeIncBasePriorityPrivilege	1848	ctfmon.exe
Token: SeCreatePagefilePrivilege	1848	ctfmon.exe
Token: SeCreatePermanentPrivilege	1848	ctfmon.exe
Token: SeBackupPrivilege	1848	ctfmon.exe
Token: SeRestorePrivilege	1848	ctfmon.exe
Token: SeShutdownPrivilege	1848	ctfmon.exe
Token: SeDebugPrivilege	1848	ctfmon.exe
Token: SeAuditPrivilege	1848	ctfmon.exe
Token: SeSystemEnvironmentPrivilege	1848	ctfmon.exe
Token: SeChangeNotifyPrivilege	1848	ctfmon.exe
Token: SeRemoteShutdownPrivilege	1848	ctfmon.exe
Token: SeUndockPrivilege	1848	ctfmon.exe
Token: SeSyncAgentPrivilege	1848	ctfmon.exe
Token: SeEnableDelegationPrivilege	1848	ctfmon.exe
Token: SeManageVolumePrivilege	1848	ctfmon.exe
Token: SeImpersonatePrivilege	1848	ctfmon.exe
Token: SeCreateGlobalPrivilege	1848	ctfmon.exe
Token: 31	1848	ctfmon.exe
Token: 32	1848	ctfmon.exe
Token: 33	1848	ctfmon.exe
Token: 34	1848	ctfmon.exe
Token: 35	1848	ctfmon.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1848	ctfmon.exe
1848	ctfmon.exe
1848	ctfmon.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	30
PID 2892 wrote to memory of 2808	2892	csc.exe	32
PID 2892 wrote to memory of 2808	2892	csc.exe	32
PID 2892 wrote to memory of 2808	2892	csc.exe	32
PID 2892 wrote to memory of 2808	2892	csc.exe	32
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 2744 wrote to memory of 1848	2744	JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe	33
PID 1848 wrote to memory of 2716	1848	ctfmon.exe	34
PID 1848 wrote to memory of 2716	1848	ctfmon.exe	34
PID 1848 wrote to memory of 2716	1848	ctfmon.exe	34
PID 1848 wrote to memory of 2716	1848	ctfmon.exe	34
PID 1848 wrote to memory of 2728	1848	ctfmon.exe	35
PID 1848 wrote to memory of 2728	1848	ctfmon.exe	35
PID 1848 wrote to memory of 2728	1848	ctfmon.exe	35
PID 1848 wrote to memory of 2728	1848	ctfmon.exe	35
PID 1848 wrote to memory of 2488	1848	ctfmon.exe	37
PID 1848 wrote to memory of 2488	1848	ctfmon.exe	37
PID 1848 wrote to memory of 2488	1848	ctfmon.exe	37
PID 1848 wrote to memory of 2488	1848	ctfmon.exe	37
PID 1848 wrote to memory of 2504	1848	ctfmon.exe	38
PID 1848 wrote to memory of 2504	1848	ctfmon.exe	38
PID 1848 wrote to memory of 2504	1848	ctfmon.exe	38
PID 1848 wrote to memory of 2504	1848	ctfmon.exe	38
PID 2728 wrote to memory of 2008	2728	cmd.exe	43
PID 2728 wrote to memory of 2008	2728	cmd.exe	43
PID 2728 wrote to memory of 2008	2728	cmd.exe	43
PID 2728 wrote to memory of 2008	2728	cmd.exe	43
PID 2488 wrote to memory of 1956	2488	cmd.exe	44
PID 2488 wrote to memory of 1956	2488	cmd.exe	44
PID 2488 wrote to memory of 1956	2488	cmd.exe	44
PID 2488 wrote to memory of 1956	2488	cmd.exe	44
PID 2716 wrote to memory of 2560	2716	cmd.exe	42
PID 2716 wrote to memory of 2560	2716	cmd.exe	42
PID 2716 wrote to memory of 2560	2716	cmd.exe	42
PID 2716 wrote to memory of 2560	2716	cmd.exe	42
PID 2504 wrote to memory of 2332	2504	cmd.exe	45
PID 2504 wrote to memory of 2332	2504	cmd.exe	45
PID 2504 wrote to memory of 2332	2504	cmd.exe	45
PID 2504 wrote to memory of 2332	2504	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_368b9153a60f2a2090f5e9ba6c6e2896.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvnlboim.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21F3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21F2.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- C:\Users\Admin\AppData\Roaming\ctfmon.exe
  C:\Users\Admin\AppData\Roaming\ctfmon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\XQQWR1XJBZ.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\XQQWR1XJBZ.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\XQQWR1XJBZ.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\XQQWR1XJBZ.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES21F3.tmp

Filesize
1KB

MD5
175b7b3828f61b6ae17a24ca45089a40

SHA1
bf884a205a602246b127a9a2b2d99d10cc850d27

SHA256
d58b29fbf96da0cac7aad2ef7de7cae2330e4a88be52742004ef6c3a8d50552d

SHA512
0d7b597f8b357b4e7322e585f126575bb086c294dec9205bfbb9352b7d4ab36134b884d9d93b5ce29a8b59b9bffc2078d62045cf035f1ced5f178e3cf9fc70e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\qvnlboim.dll

Filesize
5KB

MD5
ab878016359d555d302e1fb50f4aa7f3

SHA1
cacad345ffad52dd1a109c7b2cb362b1a55f1495

SHA256
9e5d355ea57b65b109fc904ebd063da0f93713418d3e98da9b123eb0a0b12e57

SHA512
f12d568b679344baf0858b68cbe72170589c05046c5140c52966d5bd1f6f1eaa5069bc0185be64909b27e87e3309285ea537d33e76b170f632b25c4f67a7fbe2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC21F2.tmp

Filesize
652B

MD5
a6c78fee433c097a10b6b9b5151ff1c6

SHA1
e5ca01e5f2ec0bfb40ee7d3d3cc8e67b2800c1e2

SHA256
a8480ec7f797d2a0474c0781c84088a2b055c6fe0d57857e3cb23b4001e06c05

SHA512
5742931a503dcb3e2c0654eb7870196eb28b3ed0b783897f33cec3169b2e9127c43ef820f0abbbbd048e44bec376e89f4d850a8a76ce9d8dc988bd15bb08cfd7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qvnlboim.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qvnlboim.cmdline

Filesize
206B

MD5
62776c3bd34cc47ab28562182b777095

SHA1
f75f3de69a7da459ba94dca3ba6fb023a3f74896

SHA256
a21bf3f243d14560ae88058f74820ebe36f894b4e147eb9a25dff8c0e4b4dd71

SHA512
9c1d802ce4b62c42b73a1f7a68223d92b7cb2626aa4491ee11aa8ffe12943effcf868f7cfa1786d75b899e5f50d1c0310137b1bdf12304122c3760d535200120

Download Submit
\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
12KB

MD5
161725affce8b47d759f684bbf3605e2

SHA1
3ad09227181d86aa4c1f15e36783492f71555af9

SHA256
2c0b3dabe82da9063694f96eea8464c7b091a6cc7a1c81ab52b4a896a9b72e6d

SHA512
db6b11069bfce0f5fba910a5eb3413ecc58e895301aa6042fe46e16a3c8aa316769326bc5f57fc0a7baee05212a1374d58ed7b07b4870ccd24b306d9998f1935

Download Submit
memory/1848-27-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-52-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-61-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-58-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-55-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-25-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-53-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-39-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-37-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-36-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-32-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1848-29-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-50-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1848-48-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2744-47-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2744-0-0x0000000074411000-0x0000000074412000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2744-2-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2892-9-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2892-16-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download