blackshades | 0066825d67b346c21290768af5d0dad3eeaac879f0e008a961c0843fcadc9ffb

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/03/2025, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Size

736KB
MD5

3ce499bb928067c7fc964b40e8b8ff0d
SHA1

267116dad72bead174b560aa10900208588c2235
SHA256

0066825d67b346c21290768af5d0dad3eeaac879f0e008a961c0843fcadc9ffb
SHA512

f3b7dcb45476df913f1a05341c25be6f6b19938b4fcd040dc64145def81283801e6eff3a1d0c342d5e45d046bf2b1e1b01a0ba5c1131645de7aa1ff433aaac78
SSDEEP

12288:oz1/we3JHKHDAusozGWMBZVch9HJ87+QkAmQE+eEgwZQWnO19xOY6hJgoJ:oBkHDDs/8I+TAmNwFh

Score

10^/10

blackshades defense_evasion discovery rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 15 IoCs

resource	yara_rule
behavioral1/memory/2136-33-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-29-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-72-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-73-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-75-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-76-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-77-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-78-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-80-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-81-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-83-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-84-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-85-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-87-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2136-88-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ctfmon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ctfmon.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CYQVQCAI0O.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	ctfmon.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
344	ipconfig.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1664	reg.exe
828	reg.exe
236	reg.exe
1356	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Token: 1	2136	ctfmon.exe
Token: SeCreateTokenPrivilege	2136	ctfmon.exe
Token: SeAssignPrimaryTokenPrivilege	2136	ctfmon.exe
Token: SeLockMemoryPrivilege	2136	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	2136	ctfmon.exe
Token: SeMachineAccountPrivilege	2136	ctfmon.exe
Token: SeTcbPrivilege	2136	ctfmon.exe
Token: SeSecurityPrivilege	2136	ctfmon.exe
Token: SeTakeOwnershipPrivilege	2136	ctfmon.exe
Token: SeLoadDriverPrivilege	2136	ctfmon.exe
Token: SeSystemProfilePrivilege	2136	ctfmon.exe
Token: SeSystemtimePrivilege	2136	ctfmon.exe
Token: SeProfSingleProcessPrivilege	2136	ctfmon.exe
Token: SeIncBasePriorityPrivilege	2136	ctfmon.exe
Token: SeCreatePagefilePrivilege	2136	ctfmon.exe
Token: SeCreatePermanentPrivilege	2136	ctfmon.exe
Token: SeBackupPrivilege	2136	ctfmon.exe
Token: SeRestorePrivilege	2136	ctfmon.exe
Token: SeShutdownPrivilege	2136	ctfmon.exe
Token: SeDebugPrivilege	2136	ctfmon.exe
Token: SeAuditPrivilege	2136	ctfmon.exe
Token: SeSystemEnvironmentPrivilege	2136	ctfmon.exe
Token: SeChangeNotifyPrivilege	2136	ctfmon.exe
Token: SeRemoteShutdownPrivilege	2136	ctfmon.exe
Token: SeUndockPrivilege	2136	ctfmon.exe
Token: SeSyncAgentPrivilege	2136	ctfmon.exe
Token: SeEnableDelegationPrivilege	2136	ctfmon.exe
Token: SeManageVolumePrivilege	2136	ctfmon.exe
Token: SeImpersonatePrivilege	2136	ctfmon.exe
Token: SeCreateGlobalPrivilege	2136	ctfmon.exe
Token: 31	2136	ctfmon.exe
Token: 32	2136	ctfmon.exe
Token: 33	2136	ctfmon.exe
Token: 34	2136	ctfmon.exe
Token: 35	2136	ctfmon.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2136	ctfmon.exe
2136	ctfmon.exe
2136	ctfmon.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2660	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	30
PID 2232 wrote to memory of 2660	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	30
PID 2232 wrote to memory of 2660	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	30
PID 2232 wrote to memory of 2660	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	30
PID 2660 wrote to memory of 2676	2660	csc.exe	32
PID 2660 wrote to memory of 2676	2660	csc.exe	32
PID 2660 wrote to memory of 2676	2660	csc.exe	32
PID 2660 wrote to memory of 2676	2660	csc.exe	32
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2232 wrote to memory of 2136	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	33
PID 2136 wrote to memory of 2560	2136	ctfmon.exe	34
PID 2136 wrote to memory of 2560	2136	ctfmon.exe	34
PID 2136 wrote to memory of 2560	2136	ctfmon.exe	34
PID 2136 wrote to memory of 2560	2136	ctfmon.exe	34
PID 2136 wrote to memory of 2568	2136	ctfmon.exe	35
PID 2136 wrote to memory of 2568	2136	ctfmon.exe	35
PID 2136 wrote to memory of 2568	2136	ctfmon.exe	35
PID 2136 wrote to memory of 2568	2136	ctfmon.exe	35
PID 2136 wrote to memory of 2580	2136	ctfmon.exe	36
PID 2136 wrote to memory of 2580	2136	ctfmon.exe	36
PID 2136 wrote to memory of 2580	2136	ctfmon.exe	36
PID 2136 wrote to memory of 2580	2136	ctfmon.exe	36
PID 2136 wrote to memory of 2616	2136	ctfmon.exe	37
PID 2136 wrote to memory of 2616	2136	ctfmon.exe	37
PID 2136 wrote to memory of 2616	2136	ctfmon.exe	37
PID 2136 wrote to memory of 2616	2136	ctfmon.exe	37
PID 2232 wrote to memory of 2732	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	42
PID 2232 wrote to memory of 2732	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	42
PID 2232 wrote to memory of 2732	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	42
PID 2232 wrote to memory of 2732	2232	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	42
PID 2580 wrote to memory of 1356	2580	cmd.exe	44
PID 2580 wrote to memory of 1356	2580	cmd.exe	44
PID 2580 wrote to memory of 1356	2580	cmd.exe	44
PID 2580 wrote to memory of 1356	2580	cmd.exe	44
PID 2616 wrote to memory of 236	2616	cmd.exe	45
PID 2616 wrote to memory of 236	2616	cmd.exe	45
PID 2616 wrote to memory of 236	2616	cmd.exe	45
PID 2616 wrote to memory of 236	2616	cmd.exe	45
PID 2568 wrote to memory of 1664	2568	cmd.exe	43
PID 2568 wrote to memory of 1664	2568	cmd.exe	43
PID 2568 wrote to memory of 1664	2568	cmd.exe	43
PID 2568 wrote to memory of 1664	2568	cmd.exe	43
PID 2560 wrote to memory of 828	2560	cmd.exe	47
PID 2560 wrote to memory of 828	2560	cmd.exe	47
PID 2560 wrote to memory of 828	2560	cmd.exe	47
PID 2560 wrote to memory of 828	2560	cmd.exe	47
PID 2732 wrote to memory of 344	2732	cmd.exe	48
PID 2732 wrote to memory of 344	2732	cmd.exe	48
PID 2732 wrote to memory of 344	2732	cmd.exe	48
PID 2732 wrote to memory of 344	2732	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k-lovpjh.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD15.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD14.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- C:\Users\Admin\AppData\Roaming\ctfmon.exe
  C:\Users\Admin\AppData\Roaming\ctfmon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\DNS.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdnsipconfig/releaseipconfig/renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DNS.bat

Filesize
47B

MD5
4b403bd7ff6fe021fcf3ecdd2c029f87

SHA1
890642fc02dbfffd5d3aef0ec652fa636a48c3ee

SHA256
267c9197388ab6b34c7516e728a3529df2b7aab5029588ffb47540bbe651f654

SHA512
3bdef29cfeab451d45182420bd179f9450a0da5c842992260a420728e212635f90cc1f394687c8ac852ccd8caf529e9bdb4aff24e2d07f6705594931b3ef5e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFD15.tmp

Filesize
1KB

MD5
5da9afab90ace84487f3980aec0d4e95

SHA1
4b06a6a2840b86758f7f3b7285361ce364a4c88d

SHA256
6a783e5853df9be008f9ab79664ee61786b21ebc80074e70ac058b2d6f1eee8a

SHA512
1aca47f8795830bcab9367e165a5270e653395f062de492d21171938e9c6969e695ea130eb09db8e40887b46da36104f92e74094e4facaa44ca8d786c1c4fe7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\k-lovpjh.dll

Filesize
5KB

MD5
482a81e5c37b16b33530cefe597d709a

SHA1
f0222a8c710bc2f0768ad8c3463e34e075e57121

SHA256
90af5ca05b2bb5d8af91636b8bad4651fea49fb875f672bef9caa592cbe631c9

SHA512
a12d78ddb74d8fcfc139fb48a493684b4fc2eeaafe93eb440eb6a141f3dce93f851e504293e7d0db3d524bf30e99f89641762c9f5ab77a1c7f7cde8ed101d390

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
1e3bac557fd2718212f2306ab9671b47

SHA1
49e39343e82d3ec38063ef327832f2a0fbacc8d1

SHA256
1fa11e0761fa0471e28ebe32015cb75aa9758bfc05b54827867f97408d498986

SHA512
483f898930ad7f7485a7586dc2198a3f3254e4076bc7556ec67a47fbd9bb9a88713f6690884eedb3cecb913457465ce623bf29a4cdb4fc59dc40ef5d1acc45bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFD14.tmp

Filesize
652B

MD5
02200e99749d5e9be4d82b62a34a68cb

SHA1
e8af91e251c9deabcb5baf05ffe7e5197cb1d4cb

SHA256
587308ff4a09c8a0db5c4db4dbb3b8d3d0ea29f06d4bf04ab812ab75036af356

SHA512
4d3b1c294c927a35cfb9d8198af3974ddc74f46b9284d15318c4aa17366fe904e5875132da8ed9e71bfb0f51ba28a27038b23fe5de4fc4c0ecbc2dcbf6296ba1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k-lovpjh.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k-lovpjh.cmdline

Filesize
206B

MD5
90e2e95c2cfb46b20984bfda9fe544ef

SHA1
628423974014c551f788e30a78e03f9c3071a5b2

SHA256
85c059dd347771c4215a20fdb5a78d03fa6bb4123ecd6df3b5245ac81a66c156

SHA512
a3673f93fd77c4a86545d2e0a6c7ad2d9aa88072fa6720d1c762a84443e9d19cf329ffbac114748e0f4c081ae609bde59adcec93ec792b7b9c7a962899ed3ed6

Download Submit
\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
12KB

MD5
df84665b4093dbb940f44cd14813ca89

SHA1
77bbdfb408e4638a6fa451d6b1e7ff305a31b5fd

SHA256
5b1328c108dc8b32851189fee744b4338de5d1ebe52d0f969a49f82f51480511

SHA512
447c4bd630f9c4752d31ebd7951398140302072eb4e75d858b080ccb47f1c15d1c2cbb4688bcd46a7e801f62a551be9d5c2bbc305829846de08327292eeba7d7

Download Submit
memory/2136-78-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-88-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-33-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2136-29-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-27-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-26-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-87-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-85-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-84-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-83-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-73-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-75-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-76-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-77-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-81-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-80-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2232-0-0x0000000074F51000-0x0000000074F52000-memory.dmp

Filesize
4KB

Download
memory/2232-71-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-1-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-2-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2660-16-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2660-9-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download