Malware Analysis Report

2025-04-03 10:14

Sample ID 250211-t9d73atjal
Target JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24
SHA256 11590510fb5da1bc1c0daad0b97ebd1bb030ec732c5bd8e730df740761e0eb93
Tags
blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

11590510fb5da1bc1c0daad0b97ebd1bb030ec732c5bd8e730df740761e0eb93

Threat Level: Known bad

The file JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat

Blackshades payload

Blackshades

Blackshades family

Modifies firewall policy service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-11 16:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-11 16:45

Reported

2025-02-11 16:47

Platform

win7-20241023-en

Max time kernel

148s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\wJhbr.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wJhbr.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1872 set thread context of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2564 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 1872 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s70fzqp8.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE32.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBE31.tmp"

C:\Users\Admin\AppData\Local\Temp\wBZ533.exe

"C:\Users\Admin\AppData\Local\Temp\wBZ533.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\puw9etfe.cmdline"

C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 growniqqa.no-ip.biz udp
PS 94.73.22.163:1311 growniqqa.no-ip.biz tcp
PS 94.73.22.163:1311 growniqqa.no-ip.biz tcp
US 8.8.8.8:53 1growniqqa.no-ip.biz udp
US 8.8.8.8:53 2growniqqa.no-ip.biz udp
US 8.8.8.8:53 3growniqqa.no-ip.biz udp
PS 94.73.22.65:1311 3growniqqa.no-ip.biz tcp
US 8.8.8.8:53 4growniqqa.no-ip.biz udp
US 8.8.8.8:53 5growniqqa.no-ip.biz udp
US 8.8.8.8:53 6growniqqa.no-ip.biz udp
US 8.8.8.8:53 7growniqqa.no-ip.biz udp
US 8.8.8.8:53 8growniqqa.no-ip.biz udp

Files

memory/1872-0-0x0000000073F42000-0x0000000073F44000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\s70fzqp8.cmdline

MD5 24b4b1b36ccf510cfd6c2a9f38818016
SHA1 98b5c960df79623ba0d4840334c128ec34f8798d
SHA256 7d6b849202e33764135e40da28d1b6f648fdd8fc1bab348d00a1da31228c0f9a
SHA512 e3971c16805c6e853ab3a6af54fd6759f630154c215654aa852117fe9fae6c2b639b213ed301a9d647806705a5ee0714105c10cc7a3c0ca1b974754bada3a3dc

\??\c:\Users\Admin\AppData\Local\Temp\s70fzqp8.0.cs

MD5 fa8ecc4bed09977912341bb3d2852526
SHA1 3a90a7e5a650714fd0c56354481e9bb901d6324f
SHA256 dd0d91cf4f9356a3d0da47bc8efd935ee8a38b0681cd8f7b9ba9b728cb93a215
SHA512 dd11778c93b95eb8de43c68adf7e7a8f09bd15f510a5fe4209b5cf8d8791f05c6df4d020367d9464f4b2af1f6ca44d02c9d2743b11387f2dd89176acec84a793

\??\c:\Users\Admin\AppData\Local\Temp\CSCBE31.tmp

MD5 cd17c25d11207293c8c7dfeb2b07bc89
SHA1 4f4b8d4f6a640d8150dadaa0b834b80d222e287d
SHA256 d9861c3eb023b96f4cc07fc4b9c26990c9fb371eb006997916dd234b59598c68
SHA512 9ed1b2b78e4535a96a758599af67223f9e0cc90b18e409d8fadecc38743dfc3c34c2f442b96508e16cb85a0b4f0a0d2c8f30a98612794b917d83eb379ad52e18

C:\Users\Admin\AppData\Local\Temp\RESBE32.tmp

MD5 a40773127faf65119e460ebba016b22b
SHA1 183b1ad30a46d0e38264baef3d5881f2ae71ead0
SHA256 4d146081ccb646724a6ad6949fb043b5aa32ad660e220404fbf7976a566212bf
SHA512 286c49860cdd6bf0f58c90f2fecf9bc789f0fd2d729563b324f9ac8ed8879d3bf0c90b44b05b5f36d2a2921f8c5fe9533dc804dad9c0fbfdc564a1267506b934

C:\Users\Admin\AppData\Local\Temp\wBZ533.exe

MD5 9af74d92ad74bd9fe422ac96e8473bf8
SHA1 55e4497f971560c96e06497b81c35cd8826f5261
SHA256 99a8ebbd9c78d30a86b242cdddb537e9571514062fad8d4326ab24c2ae8aabc5
SHA512 9de7965995397e91da30f16b55bb44277c7ad1d693b0719c79e326a558fba7176712fbd37530de4ebdcc2d2034842626155ed96848859aa59f57b715c4fbb5e6

\??\c:\Users\Admin\AppData\Local\Temp\puw9etfe.cmdline

MD5 974741d26b7191136b411f563c87d48d
SHA1 8d77073c452de70045d9fc68dea23500c32c7fc3
SHA256 233a72d25d50e049474750202e065f2be5f222c025944c237c049769594f0299
SHA512 66728f97ca82752e55f78f2591cb01c70ff15c3620072c4817c7d7b707ff0d610da6ba907e88de513933d13e7cdc3b18f15724d421eec9b2f8d84f8d83ae3ee3

\??\c:\Users\Admin\AppData\Local\Temp\puw9etfe.0.cs

MD5 bcb07738fe369aa5e46665c771fb6b58
SHA1 9fe43b77ee328d351505d3302108f88e80000acb
SHA256 d86c2e4138b6fe0e028643148e9b134324520aced3cd4c1bbd4e2883b1c185cb
SHA512 5368781560d5492b6022d4e97579ac5c3eefb9be9f77c7a67b08aac773d9d1aa26462bc8eca3a4141dc63cc0552724d94b0b13f3d75703b36461b6cea5a62108

\Users\Admin\AppData\Local\Temp\wJhbr.exe

MD5 ed797d8dc2c92401985d162e42ffa450
SHA1 0f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256 b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512 e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

memory/2836-34-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1872-43-0x00000000005F0000-0x00000000006F0000-memory.dmp

memory/2836-41-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2836-38-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-36-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-53-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-54-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-56-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-57-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-58-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-61-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-62-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-64-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-68-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2836-69-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-11 16:45

Reported

2025-02-11 16:47

Platform

win10v2004-20250211-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\wJhbr.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wJhbr.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4796 set thread context of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBZ533.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4796 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4796 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4796 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4572 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4572 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4572 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4796 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 4796 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 4796 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wBZ533.exe
PID 4796 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4796 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4796 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1416 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1416 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1416 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4796 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe
PID 4796 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe
PID 4796 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4796 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe C:\Users\Admin\AppData\Local\Temp\wJhbr.exe
PID 4360 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\wJhbr.exe C:\Windows\SysWOW64\cmd.exe
PID 1420 wrote to memory of 3412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1420 wrote to memory of 3412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1420 wrote to memory of 3412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3880 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3880 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3880 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3396 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3396 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3396 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1632 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1632 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1632 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8533f00c91e7a8b22eb9fb731c92d24.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ppdb4ksb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A15.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A14.tmp"

C:\Users\Admin\AppData\Local\Temp\wBZ533.exe

"C:\Users\Admin\AppData\Local\Temp\wBZ533.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\btiqzysf.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CC4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4CC3.tmp"

C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe

"C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe"

C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wJhbr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 growniqqa.no-ip.biz udp
PS 94.73.22.163:1311 growniqqa.no-ip.biz tcp
PS 94.73.22.163:1311 growniqqa.no-ip.biz tcp
US 8.8.8.8:53 1growniqqa.no-ip.biz udp
US 8.8.8.8:53 2growniqqa.no-ip.biz udp
US 8.8.8.8:53 3growniqqa.no-ip.biz udp
PS 94.73.22.65:1311 3growniqqa.no-ip.biz tcp
US 8.8.8.8:53 4growniqqa.no-ip.biz udp
US 8.8.8.8:53 5growniqqa.no-ip.biz udp
US 8.8.8.8:53 6growniqqa.no-ip.biz udp
US 8.8.8.8:53 7growniqqa.no-ip.biz udp
US 8.8.8.8:53 8growniqqa.no-ip.biz udp

Files

memory/4796-0-0x0000000074142000-0x0000000074143000-memory.dmp

memory/4796-1-0x0000000074140000-0x00000000746F1000-memory.dmp

memory/4796-2-0x0000000074140000-0x00000000746F1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ppdb4ksb.cmdline

MD5 27237e7aaa6240067ef8d51deaaa32ae
SHA1 a9dce92b44ae6f4fe6193431b26bb7f824343000
SHA256 2fbb71670a5f1aa49b4618a28104251ae31aa7ad3cc4a4f4bf987ec985afaf68
SHA512 a2f4a69358edd4b36c22cd8d75c0ccb82437cdbb1c10139c0f400647a273819366a9401502620a7d93aa3a2b004b069e22b4548f72bf1d09290cec6ba9ead140

\??\c:\Users\Admin\AppData\Local\Temp\ppdb4ksb.0.cs

MD5 fa8ecc4bed09977912341bb3d2852526
SHA1 3a90a7e5a650714fd0c56354481e9bb901d6324f
SHA256 dd0d91cf4f9356a3d0da47bc8efd935ee8a38b0681cd8f7b9ba9b728cb93a215
SHA512 dd11778c93b95eb8de43c68adf7e7a8f09bd15f510a5fe4209b5cf8d8791f05c6df4d020367d9464f4b2af1f6ca44d02c9d2743b11387f2dd89176acec84a793

memory/4572-8-0x0000000074140000-0x00000000746F1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC4A14.tmp

MD5 cd17c25d11207293c8c7dfeb2b07bc89
SHA1 4f4b8d4f6a640d8150dadaa0b834b80d222e287d
SHA256 d9861c3eb023b96f4cc07fc4b9c26990c9fb371eb006997916dd234b59598c68
SHA512 9ed1b2b78e4535a96a758599af67223f9e0cc90b18e409d8fadecc38743dfc3c34c2f442b96508e16cb85a0b4f0a0d2c8f30a98612794b917d83eb379ad52e18

C:\Users\Admin\AppData\Local\Temp\RES4A15.tmp

MD5 49eab87d31f699257ac53dede84dd75a
SHA1 f4232503f5bfc1149180cc8c53627d3363c95661
SHA256 adcdbd6fbb6a947629eb5a0fa40a84db71048af429d6b1e84bde7416ff21382b
SHA512 81c02ef53539837561203a7c772b263f609177747d8bbcc38fc427f5ece14c16fabc54110ec32535c8b45f18595e41c29a27451dbac0ef862aa864a37a0c7f77

memory/4572-15-0x0000000074140000-0x00000000746F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wBZ533.exe

MD5 4cf7af2345558a9f97c3bbb769054fbd
SHA1 522e57ce1afe7d3b9ac7851219c0b928905eb2a6
SHA256 4a9a918fad8744ef6639395cd6467d16cff92114968f89bbebbbbf3530f186f9
SHA512 442fd9e00bf23b73d112719d2146bb666a97696c319ff09e03cd7241e9dc9ccfd7980c99640502e4b4965a36ac6ba5c1d49af040db5bd4215eba4745f9016b17

memory/1376-21-0x0000000074140000-0x00000000746F1000-memory.dmp

memory/4796-22-0x0000000074140000-0x00000000746F1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\btiqzysf.cmdline

MD5 fa3fa5512a0f8ec8d0de168e1868f4e2
SHA1 e260c80ad973bd34f04c0a63f1737e584b79de9f
SHA256 2898afffe4e9bfca810e84e89a4afc4bdb964e7020d06ccd47f643dbb2018e1b
SHA512 5b97a99173503e59960f838c98968820f822f1cd9aaaea84fec7f2c081f4d6b1e5e24ac06e5367b1225ee5154eba8c7850862ed03b5f5eeecaffe7348581f2f7

\??\c:\Users\Admin\AppData\Local\Temp\resource.resources

MD5 d0294b85a3cb4ef59a5565a2e6b1209f
SHA1 0c9f87cd89f2388d9d16d25533ac4dfe59ef0874
SHA256 35f139b7ff1909d42b09123c4fce94bfdbf0a944bc2d482f31d4edcd44ee3b09
SHA512 aef43cc881516364dcd6fdcba34e44448ff91e2cfe6849b36aef868ed7fde432662c3a32e14887e7f5f3f2cbad2a30aa6dcc15377f636bfbf8f394e8d14b7f06

memory/1416-32-0x0000000074140000-0x00000000746F1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\btiqzysf.0.cs

MD5 50c62a59a041668a5b37034d6f883695
SHA1 544f7dadcaac14381e4d0e0b1588aa0b1314cfd0
SHA256 94b7e1ea63d5ee69901010dc0595fe653d0bf400bd2f0d01fc80820d4b3aca79
SHA512 ec5b510606b4f26a20360517e181fc49c3c5b100f4950b48a392e057415bc53f49984311e17058636f870c7e471dd496b1b33924bfdc311bfc15b64e94723b19

C:\Users\Admin\AppData\Local\Temp\RES4CC4.tmp

MD5 e6ad421dcd11007d7c8eea2563a7e49e
SHA1 0de8cbfcac601076fa412439a4bbc1b56ad35e1b
SHA256 458f9855dbf05b3d6fba96f67bc6de395dfbc10ff56accffa5d7639fae4a73f9
SHA512 38ffe590fab7f7520681546c4f960b2b26deeeed4fc1e454e3ae9b933296fa304dfe6af76aa80874bd90357c6d33b6e45de0d60de48fe6afccd80e8086be0b09

memory/1416-37-0x0000000074140000-0x00000000746F1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC4CC3.tmp

MD5 cdceb31979434090bc25d826da6db7b6
SHA1 8c21fd098979323370bccc41015ff449d56e1e84
SHA256 85e459874e3bb9e2aea3095f6eaad1458b686d0a1c3f4a43d4d9e79779e8274b
SHA512 5d3004a3bcf536847f5e805598e89824455483c842dfe5c60d682cffa5152ded66bff0d9eb79946f4c45aefb39cad541dae5720b7a80a928106285d2bfc45890

C:\Users\Admin\AppData\Local\Temp\BaeM7J.exe

MD5 6e0f2a098903031dbf464cd98fb49c87
SHA1 7d7e37fba2b078c6d74e27c2245b0ddcd8c232cf
SHA256 a880fac18e9b8c25434633d2a49985c7ce256e69e6d663a9080482558acf9e44
SHA512 2b692a6495a3dbdfdb4799d176224acbce043340bf8ba7245d387898abf4a72d975eec7f1b26a01f01078052bd8a83012e759c8c85cd5e075f3f2caebb3a7f04

C:\Users\Admin\AppData\Local\Temp\wJhbr.exe

MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

memory/4360-47-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-43-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4796-51-0x0000000074140000-0x00000000746F1000-memory.dmp

memory/1376-54-0x0000000074140000-0x00000000746F1000-memory.dmp

memory/4360-55-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-58-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-59-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-60-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-63-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-66-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-67-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-68-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-70-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4360-71-0x0000000000400000-0x0000000000470000-memory.dmp