ardamax | 11f5b5ebfc2f25bf32e675728d4faa069311cefb66825f32106adf237d70a2e7

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-02-2025 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
Size

1.3MB
MD5

c1afd5d05b62a7b9fbbdf7935775c5c8
SHA1

641c7c01c6b93b72d761748a16c0fd416889fe40
SHA256

11f5b5ebfc2f25bf32e675728d4faa069311cefb66825f32106adf237d70a2e7
SHA512

5cd2d62ecbcc31f607e4139ea69a9a3d778d8f9f93e35eb9d3f669f1ea8a4f695fa6312090a502dc39353cdc143dfb8739fd6af8e745e3888e731041a7865992
SSDEEP

24576:bswyOQUyohQ9BO7Qtj6VUBYaff0Lo0Udkw/J8nPXJUF/8zhYWf:bpJQUt+UQtjOU2aff0c0Udkwnqm2

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000018b62-24.dat	family_ardamax

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	IEXPLORE.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}\StubPath = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe Restart"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}\StubPath = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe Restart"	POL.exe

Executes dropped EXE 4 IoCs

pid	Process
2736	silent_akl.exe
284	POL.exe
1324	NEW.exe
2084	NEW.exe

Loads dropped DLL 18 IoCs

pid	Process
2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
2736	silent_akl.exe
2736	silent_akl.exe
2736	silent_akl.exe
2736	silent_akl.exe
2736	silent_akl.exe
2736	silent_akl.exe
2736	silent_akl.exe
284	POL.exe
284	POL.exe
2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
1324	NEW.exe
284	POL.exe
284	POL.exe
284	POL.exe
1972	IEXPLORE.EXE
1952	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\POL Agent = "C:\\Program Files (x86)\\POL\\POL.exe"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	IEXPLORE.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 2084	1324	NEW.exe	35

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\POL\POL.exe	silent_akl.exe
File created	C:\Program Files (x86)\POL\qs.html	silent_akl.exe
File created	C:\Program Files (x86)\WindowsUptade\winuptade.exe.exe	IEXPLORE.EXE
File created	C:\Program Files (x86)\POL\POL.chm	silent_akl.exe
File created	C:\Program Files (x86)\POL\Uninstall.exe	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.001	POL.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\plugin.dat	IEXPLORE.EXE
File created	C:\Program Files (x86)\WindowsUptade\logs.dat	IEXPLORE.EXE
File created	C:\Program Files (x86)\POL\POL.004	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.006	silent_akl.exe
File created	C:\Program Files (x86)\POL\tray.gif	silent_akl.exe
File created	C:\Program Files (x86)\POL\menu.gif	silent_akl.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\winuptade.exe.exe	IEXPLORE.EXE
File opened for modification	C:\Program Files (x86)\WindowsUptade\	IEXPLORE.EXE
File opened for modification	C:\Program Files (x86)\WindowsUptade\logs.dat	IEXPLORE.EXE
File created	C:\Program Files (x86)\POL\POL.003	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.007	silent_akl.exe
File created	C:\Program Files (x86)\POL\AKV.exe	silent_akl.exe
File opened for modification	C:\Program Files (x86)\POL	POL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silent_akl.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000186d9-7.dat	nsis_installer_1
behavioral1/files/0x00070000000186d9-7.dat	nsis_installer_2
behavioral1/files/0x0005000000019cca-234.dat	nsis_installer_1
behavioral1/files/0x0005000000019cca-234.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002d82046a2bf81a468db4dd1cd4d8498f00000000020000000000106600000001000020000000dc3b2efc9d9b6f10c6decbe8dcf40eff2eeadff73342dbadbaa6c337478e31a1000000000e800000000200002000000037609c29ddddbb3bce37000df8f0b7d6e844d2323f3226b8331fdc01364874fb90000000708693c71464b1e863f4686c0e2e11b9b9d084547007cc68c1374ee44fcb83a5d84a6bef8bbd0fa49226ff57b7f75b4464b486aacc4eaf38d8cf892241efdce3a974887fe5a76cedfa53d467bfe330b52cce1dbd1deb8c65dc80d9c353d7d9da17f6438f80add3f5ab7dcf51bb63e8d5a810035f00f7b7a03d60e8cd6324281ce6f62830184091e8c4a3b0b552e9e71f40000000f3711c1db83ab4e91d463ad4e6aaddca3c7846762e39fae7f7e0077be23cbd2f54bcac0ff801ec0112234d072052457572b80de031aaf593580e9e18fd24305c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3012fba64a7bdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002d82046a2bf81a468db4dd1cd4d8498f00000000020000000000106600000001000020000000a35bed7b62eae97a87b5e4bb9085f32de8267cb59322f360fc5cb6757d32cd52000000000e80000000020000200000004e49cc177a48662a2eda0a3ec69d94cbcf4a0b2cc68d0a95f05d12dac1104e9c20000000f9b3f4787b26d17e9394f28b328f50c73ec08ce90d422cc06738ed5015e0c89940000000e92454bc58d1b5c8103048cfbee55e5645fc3b08e21be5ae38a674fb00de4e1b5c7b5906a2d37391ee5b1e313de1952e65be722c28feb65d5d48450e86bea9d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1FBEB81-E73D-11EF-AD31-F6257521C448} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445305691"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\ProgID\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\ = "GrooveOutlineToolBeta"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\0\win32	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\Version\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\57"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\FLAGS\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\TypeLib	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\TypeLib\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\ = "Ijemazox Ewedeqe Tesoqego"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\ProgID\ = "PLA.TraceSessionCollection.1"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\TypeLib\ = "{16E1894E-63A8-A5F4-C5B7-EB88F2159825}"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\VersionIndependentProgID	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\VersionIndependentProgID\ = "PLA.TraceSessionCollection"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\0\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\HELPDIR\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\Version\ = "1.0"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\0	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\HELPDIR	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\Version	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\0\win32\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\FLAGS	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\InprocServer32	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\InprocServer32\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\LocalServer32	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\VersionIndependentProgID\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\LocalServer32\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEA4AD07-89B7-49C7-5AB5-C43E2BE47FE1}\ProgID	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16E1894E-63A8-A5F4-C5B7-EB88F2159825}\1.0\FLAGS\ = "0"	POL.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2084	NEW.exe
2084	NEW.exe
2084	NEW.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	NEW.exe
Token: SeDebugPrivilege	2084	NEW.exe
Token: 33	284	POL.exe
Token: SeIncBasePriorityPrivilege	284	POL.exe
Token: SeDebugPrivilege	2084	NEW.exe
Token: SeDebugPrivilege	2084	NEW.exe
Token: SeDebugPrivilege	1952	IEXPLORE.EXE
Token: SeDebugPrivilege	1952	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2180	iexplore.exe
284	POL.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
284	POL.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1324	NEW.exe
284	POL.exe
284	POL.exe
284	POL.exe
284	POL.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2432 wrote to memory of 2736	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	30
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 284	2736	silent_akl.exe	31
PID 2736 wrote to memory of 2180	2736	silent_akl.exe	32
PID 2736 wrote to memory of 2180	2736	silent_akl.exe	32
PID 2736 wrote to memory of 2180	2736	silent_akl.exe	32
PID 2736 wrote to memory of 2180	2736	silent_akl.exe	32
PID 2432 wrote to memory of 1324	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	33
PID 2432 wrote to memory of 1324	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	33
PID 2432 wrote to memory of 1324	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	33
PID 2432 wrote to memory of 1324	2432	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	33
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 2180 wrote to memory of 1972	2180	iexplore.exe	34
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 1324 wrote to memory of 2084	1324	NEW.exe	35
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36
PID 2084 wrote to memory of 1952	2084	NEW.exe	36

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1468
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:352
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:740
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1160
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:836
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:960
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1052
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1104
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:344
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2944
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2972
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\silent_akl.exe
    "C:\Users\Admin\AppData\Local\Temp\silent_akl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Program Files (x86)\POL\POL.exe
      "C:\Program Files (x86)\POL\POL.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:284
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files (x86)\POL\qs.html
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1972
- - C:\Users\Admin\AppData\Local\Temp\NEW.exe
    "C:\Users\Admin\AppData\Local\Temp\NEW.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\NEW.exe
      C:\Users\Admin\AppData\Local\Temp\NEW.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
        5⤵
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\POL\POL.003

Filesize
4KB

MD5
b89311bdf4e6640cc9051e629476cbe4

SHA1
ced30235482232b045cd5d8004e8ead01b30f9ca

SHA256
db0e9d83d8a5309ae4ab4747ff6ce506a2f85b01a598caad697a69b3ddb557a1

SHA512
8e71c2238e23cd793feb061736d00f8aea0002f79e2632093529ed6242f9af2a99baa598d58c04bbc9c02715d7f18955ae88334e39caa2978e88904cf27911d4

Download Submit
C:\Program Files (x86)\POL\POL.004

Filesize
14KB

MD5
f8d18c97818ded4af98e1e6826e7678c

SHA1
d306778e454f5dc3eb8d7bfdf434dbcd3cb4fb01

SHA256
b1af1a31a22fb5a4eb5631526f1ad446ef5910c91987eb5c09be9935bdf23f33

SHA512
95e24d6b6d8c7665965906629255de887358b53fcfd9b70b6cbdde09cace93665b5bb9332ea6e959be10d5458fc8e5167235fae4e6a6260f5b304fc3b5addc01

Download Submit
C:\Program Files (x86)\POL\POL.007

Filesize
5KB

MD5
2183e6a435b000fc6e85b712513c3480

SHA1
c088b82494aaeca23a5acfaf83f55597bd0bdc6e

SHA256
9a1a58cea0b0cfe3479d29bb39b0a5af0ee75fbd94254529ad28f2e54aec30e5

SHA512
94ffbd46b10cf71ea59d3d44ceece691d7d50e8e111e330d44346f1e56e62d7a3b5c375917494fff89966d0ea5fc562d45b14b983269eba72b2831abce7a1afe

Download Submit
C:\Program Files (x86)\POL\POL.chm

Filesize
33KB

MD5
8e4c5c3fee759991597ebc2d855ad4e4

SHA1
b3da123c6300a330b8c869b1ba807115e42c6eab

SHA256
e97a9f0dd54d6013280cbb032e63b9cfcc976886a46eeeac07a45af2fc545547

SHA512
30a126b57b538f3429a66785521ce30e8dfe4e617d84381e9f5a0feae5956576aaf00253ea41170e12813f2637edd11c5ce643c08dd4920bf30d8bf94b95208e

Download Submit
C:\Program Files (x86)\POL\Uninstall.exe

Filesize
43KB

MD5
4bbbf32667e8d9aca25b74536c022802

SHA1
128ce5fb0d058cc9126da94a2f9799b2275dfa22

SHA256
df3a520beb7b22566981849512cfba209d108d65505b49f38ad054aad9940c17

SHA512
5a850f7d6ef5293aba4594370eb59116d78b31f07f663dfc737bb35992e8c2fc351935f30af512f319af5f26f0538029624b442eca00a9f00409a23f263d9d72

Download Submit
C:\Program Files (x86)\POL\menu.gif

Filesize
22KB

MD5
20fe009bce33b78dd40b48bc5f8accc6

SHA1
cd614d9b9e088eecb7e63722f61a39a0cf0ec196

SHA256
979c4b395172a53794b18d996df95c75c68d70ec3573aba66cdfe28c8d1cf0eb

SHA512
f6be54be78bfdf770c7c131c5d108b0b33376886b9b4a66598e2c92543a2e83ffafdaea36b9d749784a978d4327cdf52ce0ac6feb9a28d683162b0b3f2f40a37

Download Submit
C:\Program Files (x86)\POL\qs.html

Filesize
1KB

MD5
40d00fa24b9cc44fbf2d724842808473

SHA1
c0852aa2fb916c051652a8b2142ffb9d8c7ac87a

SHA256
35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035

SHA512
9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c

Download Submit
C:\Program Files (x86)\POL\tray.gif

Filesize
7KB

MD5
0ac69330c3b9181b8a109fddb91fa128

SHA1
ef9698ccce041ce8ba3f4af37d0c2b577f19b375

SHA256
e675fecb791ed568aae7f1c24b159f7c0f7e23fe8a7ce76f72b3dd1a4ac00e9d

SHA512
3a74c04baf3e1e842c0a2568a6480e4ece05baef31171397763de638c6e5b0d26255cf1d7802ea53c355563b8e4b600d24d04afb5168fbc54f66414445327749

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Ardamax Keylogger.lnk

Filesize
950B

MD5
3e41cba6ce303745e622bf90f2894da4

SHA1
5af5787336a8ae1043c06183c2c74b8212312f13

SHA256
8f72648468e270757ce852d1ab35d26a2c2184144915445f1ccfb89b785a93b9

SHA512
e9bfc2c9062a7f88beae4da974a9798e992afdcbc1f64cfb3dec631c1e2e9434e9acf8ed4f0bfbe78af5412f46d98b88328caf6277ae0e13d6149ab42ede8cf8

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Help.lnk

Filesize
906B

MD5
cf75aebc07aa9e5a409ff0b2e7cff831

SHA1
6186fc956e6ab5b2ba3854816af87886ea844c68

SHA256
c805d24afd59560fc2981369051e39fc452fa6a7244e918d1cef077e2a0a1fe2

SHA512
acd92881455e3bd4de12d8ead8802225cf44a617fccdf2555f806c2998019227a67a629dcd3e15b3aa189d742de0d737477ea324bdf776fbae64e1b98f573fae

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Log Viewer.lnk

Filesize
964B

MD5
0f504f667c99af680025be3da94e8f26

SHA1
b81146e754ab765010bcea558de39d771bf44958

SHA256
0e0397b1f52171eab433dd0318cc24fe330ecdef54f33c35f610eb389e8b199f

SHA512
06970e797ebf05a79610313eed1386f4f097602a96c099081c2ddaf73757d535c3f8989d4d81e6baeeb26b50e3117578e4d3480e52aed0c9ed5798b4c53250c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f6f4099497ea675808cef9e69be5a7

SHA1
cdc3716adb581f3d8f515171f425441e41cd540c

SHA256
f669650db08d257f731b05060576a8587e691dfd28c8d21e488e5219b24e1267

SHA512
be834ad67e51f3bfbdeffd3b5df13067165567d255cba8186b388b460095ff7afcbb60142d8d99022ac7ff25333336e201af6cd0cef07a6512208f2bf0bca54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5568db106f21f851ca64f273e11a587

SHA1
f2e08fc45918c97864a62d1851693cf4281cc108

SHA256
9126f2b33bc6e8dadb64d1b5697e87acd1798d0873af6392811de4b48ae9f637

SHA512
c1429642205e1d6a63f2023201a71a5c568ae3ab749d39f98dec582ca4d3920478d04e3d309e50de6d808b68d980d7ac82b0f85ff36541546b97d73bc7f90658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb7e702c1770b2ecc63ca414a162686

SHA1
43e6ac3bed0c0690a63199c3eae6b72d897fd4e3

SHA256
20882ac51f938a8bf9c24dee76f7b8222e0a17bc8418c0461208178dea174a23

SHA512
c5f309e77a0fc746e3f2a2b883b30e4d0ba12646abc42c03db683d9a338e8cca4368f6b3dd7ca7268f37517de1c50bd110da39be5676611f9cc0d4b77d4c21ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3a627c39dca972775216eb3b58f24d6

SHA1
38ea956a059aa1fdee50bc569ab900a71b25ec94

SHA256
6abbda3d53a46509b0c9c0907f1329dc9bf68841359a3f04a6d3d32c415272a7

SHA512
d3dd39be660cd99e60eef3a0fa6f3f1a055e494c058988221da3eab0a1e92073879fb8f584028118020c8b8b8df78a4efed2917218d5ad368c2a9841d7ae75e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7a5f4337c8e5211344fffbef623a0bf

SHA1
c914aba77aa2271f1e0e3762efd2c7074dd22c04

SHA256
8596c2cd030c503464b95b9b75af7a07d5157ff3b2ae4a02129d03a35fc91cc4

SHA512
cdcfdd8c68d9f5326642c1d418ac31cabe8efb548facf374920596e095955c54ddbcb72cb2037422c8e6585c8cf0f7966543039a701f4c853f6558fcc4ae2a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2057890f73a0722c5236f259d8c38283

SHA1
436b0bf49ec016e07952b18decf99286436d9265

SHA256
16b9e4cbdd7883249acbff0de82130197fa1c0dc7377299616f278abd4285f05

SHA512
921834b5003a1e4d6da43a31137933603bd6cbf2ec88648c3708992e05a672b0671db1b30820bfdeca65e1ad7d280027dcb861ca6b1ab176d7efa37ff11653d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA190.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEW.exe

Filesize
596KB

MD5
26c11f7c1f70bc17bb73f3161837072e

SHA1
688fcac954fa1da8f30a2573330bd6d26fc9a716

SHA256
5f303338c34c661a18362ab3700513f4162c5b15cc3f54fde3df6f659e863939

SHA512
bae88331f064d0dc7fc7e9b9fd26d1ea14cf6e5b4a206fbf23c240db2ae4d3ca9760a8fccefd7463bf609a2d43126e0036866386fb0ec1ca61f6a0645da523f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA26D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy22CE.tmp\ioSpecial.ini

Filesize
719B

MD5
f00584aa39ca5820c9df2b4e2545e805

SHA1
c4d7063d33b198b7e63c7edf1dbeea70f5243742

SHA256
b584afa91b76bc6727fab38c61fc4b2095103ad8659b86db0eb47c1d30dc849a

SHA512
6dc7b27485c6596d46aba0b2874d0d2bbb83656ce3d6ff3599bbd411093f209f778e658a99df6ffb49f132ef48fff1a93d00663d444a930a89c821e402e5655c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy22CE.tmp\ioSpecial.ini

Filesize
771B

MD5
3719e62aca9fd627d8c7feb192253d0c

SHA1
d1d075b90309cbff18a094f7109c51cf26d294f5

SHA256
6a21a8000295f8cca7f75c6d9c62e6ea9572953ba6ee3456d9e4e5eabd37b3a3

SHA512
d9d5c1b22e0ba6eb0b39588ff840ebf82a4c5b3cc132fef2c6d10897b4b79a99cda87f5cf092b2249c79e3ef2c043572ab1ffbd33d8b6d3ed2b087f8fe2b37d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\silent_akl.exe

Filesize
860KB

MD5
a373fc95d538fec7894ed1b336c81ef2

SHA1
14c862baf3812688c6ff2cf324eb3a2e34627381

SHA256
69593ad7cf2bc0fc3b384309f4e4e32fb81432f6fdffdda5c19b8469efb43b47

SHA512
0a8a388971d802c7f56252b90af6261b690d7ca5aaf48bb5bee57ca9b0e2134ed7c8748f15eee27bf522cf801a43e335b6bce1d6038adb103dbfc6ebabc901fd

Download Submit
\Program Files (x86)\POL\AKV.exe

Filesize
457KB

MD5
752e814c2a5d197b8065501e786683c9

SHA1
c7b5840ab79ec308d0aca9a8f07d59730b31ad99

SHA256
5b387c65f0c677d415a3ec75fc314ecf4825b85cc8316575267ece340810c3f7

SHA512
af4bad6716f4f57e776145eb68f64d31c0fb2146b02ccb3dcda1a864215b9aeaa80abd5314d999a0bef721185c62f38463da6caba1eb7eb95c86c22691c510bf

Download Submit
\Program Files (x86)\POL\POL.006

Filesize
8KB

MD5
911a5a213762001178a48b2ceefa1880

SHA1
de9b25ac58e893397ab9ad3331bd922bbd5043ae

SHA256
273375c7be87b6da793320ee25ea08967bf8cb43e6213e4af94955e565afabc9

SHA512
cc4f95dc64085033a6f5308d61bce83991a8949ec89513fa0428527b6c20f40bc4ce0b323da3020f405f29bf3fcf703722082247f591568d39e8e355543f04c9

Download Submit
\Program Files (x86)\POL\POL.exe

Filesize
647KB

MD5
b314bd03990cf08f3ca04dd98ece3e9c

SHA1
760dca4682edbefb1bb8636bf1011207b763a7b0

SHA256
c6b1edc51c705e8f46ab7b2ddc03378e0f2bdcc4948578eff870aad6d421acd1

SHA512
b331dff33995e4e2c7e926cd4f0ea2d40da972924d05d28fe0db2f8de92d0cad5a48ce95819f7243c7efadce11d1ecf17e093c1a7bed9497520123c8715fa47a

Download Submit
\Users\Admin\AppData\Local\Temp\nsy22CE.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit
memory/256-278-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/284-11355-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/284-11356-0x00000000004E0000-0x00000000005BF000-memory.dmp

Filesize
892KB

Download
memory/284-176-0x00000000004E0000-0x00000000005BF000-memory.dmp

Filesize
892KB

Download
memory/284-172-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/284-174-0x00000000004E0000-0x00000000005BF000-memory.dmp

Filesize
892KB

Download
memory/1324-226-0x00000000038A0000-0x0000000003936000-memory.dmp

Filesize
600KB

Download
memory/1324-227-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1324-200-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2084-218-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-249-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/2084-250-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/2084-259-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/2084-270-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2084-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-277-0x0000000010450000-0x000000001045A000-memory.dmp

Filesize
40KB

Download
memory/2084-220-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-222-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-210-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-212-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-214-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2736-166-0x0000000004640000-0x000000000471F000-memory.dmp

Filesize
892KB

Download
memory/2736-28-0x00000000007C0000-0x00000000007D0000-memory.dmp

Filesize
64KB

Download