blackshades | 0066825d67b346c21290768af5d0dad3eeaac879f0e008a961c0843fcadc9ffb

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Size

736KB
MD5

3ce499bb928067c7fc964b40e8b8ff0d
SHA1

267116dad72bead174b560aa10900208588c2235
SHA256

0066825d67b346c21290768af5d0dad3eeaac879f0e008a961c0843fcadc9ffb
SHA512

f3b7dcb45476df913f1a05341c25be6f6b19938b4fcd040dc64145def81283801e6eff3a1d0c342d5e45d046bf2b1e1b01a0ba5c1131645de7aa1ff433aaac78
SSDEEP

12288:oz1/we3JHKHDAusozGWMBZVch9HJ87+QkAmQE+eEgwZQWnO19xOY6hJgoJ:oBkHDDs/8I+TAmNwFh

Score

10^/10

blackshades defense_evasion discovery rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 16 IoCs

resource	yara_rule
behavioral2/memory/3984-20-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-24-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-55-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-56-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-58-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-59-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-60-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-62-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-63-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-64-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-66-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-67-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-68-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-69-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-71-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/3984-72-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ctfmon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ctfmon.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CYQVQCAI0O.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Executes dropped EXE 1 IoCs

pid	Process
3984	ctfmon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3744 set thread context of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1408	ipconfig.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4148	reg.exe
1072	reg.exe
4248	reg.exe
460	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
Token: 1	3984	ctfmon.exe
Token: SeCreateTokenPrivilege	3984	ctfmon.exe
Token: SeAssignPrimaryTokenPrivilege	3984	ctfmon.exe
Token: SeLockMemoryPrivilege	3984	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	3984	ctfmon.exe
Token: SeMachineAccountPrivilege	3984	ctfmon.exe
Token: SeTcbPrivilege	3984	ctfmon.exe
Token: SeSecurityPrivilege	3984	ctfmon.exe
Token: SeTakeOwnershipPrivilege	3984	ctfmon.exe
Token: SeLoadDriverPrivilege	3984	ctfmon.exe
Token: SeSystemProfilePrivilege	3984	ctfmon.exe
Token: SeSystemtimePrivilege	3984	ctfmon.exe
Token: SeProfSingleProcessPrivilege	3984	ctfmon.exe
Token: SeIncBasePriorityPrivilege	3984	ctfmon.exe
Token: SeCreatePagefilePrivilege	3984	ctfmon.exe
Token: SeCreatePermanentPrivilege	3984	ctfmon.exe
Token: SeBackupPrivilege	3984	ctfmon.exe
Token: SeRestorePrivilege	3984	ctfmon.exe
Token: SeShutdownPrivilege	3984	ctfmon.exe
Token: SeDebugPrivilege	3984	ctfmon.exe
Token: SeAuditPrivilege	3984	ctfmon.exe
Token: SeSystemEnvironmentPrivilege	3984	ctfmon.exe
Token: SeChangeNotifyPrivilege	3984	ctfmon.exe
Token: SeRemoteShutdownPrivilege	3984	ctfmon.exe
Token: SeUndockPrivilege	3984	ctfmon.exe
Token: SeSyncAgentPrivilege	3984	ctfmon.exe
Token: SeEnableDelegationPrivilege	3984	ctfmon.exe
Token: SeManageVolumePrivilege	3984	ctfmon.exe
Token: SeImpersonatePrivilege	3984	ctfmon.exe
Token: SeCreateGlobalPrivilege	3984	ctfmon.exe
Token: 31	3984	ctfmon.exe
Token: 32	3984	ctfmon.exe
Token: 33	3984	ctfmon.exe
Token: 34	3984	ctfmon.exe
Token: 35	3984	ctfmon.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3984	ctfmon.exe
3984	ctfmon.exe
3984	ctfmon.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5100	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	85
PID 3744 wrote to memory of 5100	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	85
PID 3744 wrote to memory of 5100	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	85
PID 5100 wrote to memory of 3496	5100	csc.exe	88
PID 5100 wrote to memory of 3496	5100	csc.exe	88
PID 5100 wrote to memory of 3496	5100	csc.exe	88
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3744 wrote to memory of 3984	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	90
PID 3984 wrote to memory of 4232	3984	ctfmon.exe	91
PID 3984 wrote to memory of 4232	3984	ctfmon.exe	91
PID 3984 wrote to memory of 4232	3984	ctfmon.exe	91
PID 3984 wrote to memory of 4368	3984	ctfmon.exe	92
PID 3984 wrote to memory of 4368	3984	ctfmon.exe	92
PID 3984 wrote to memory of 4368	3984	ctfmon.exe	92
PID 3984 wrote to memory of 4848	3984	ctfmon.exe	93
PID 3984 wrote to memory of 4848	3984	ctfmon.exe	93
PID 3984 wrote to memory of 4848	3984	ctfmon.exe	93
PID 3984 wrote to memory of 5044	3984	ctfmon.exe	94
PID 3984 wrote to memory of 5044	3984	ctfmon.exe	94
PID 3984 wrote to memory of 5044	3984	ctfmon.exe	94
PID 4232 wrote to memory of 4148	4232	cmd.exe	99
PID 4232 wrote to memory of 4148	4232	cmd.exe	99
PID 4232 wrote to memory of 4148	4232	cmd.exe	99
PID 4848 wrote to memory of 1072	4848	cmd.exe	100
PID 4848 wrote to memory of 1072	4848	cmd.exe	100
PID 4848 wrote to memory of 1072	4848	cmd.exe	100
PID 4368 wrote to memory of 4248	4368	cmd.exe	101
PID 4368 wrote to memory of 4248	4368	cmd.exe	101
PID 4368 wrote to memory of 4248	4368	cmd.exe	101
PID 5044 wrote to memory of 460	5044	cmd.exe	102
PID 5044 wrote to memory of 460	5044	cmd.exe	102
PID 5044 wrote to memory of 460	5044	cmd.exe	102
PID 3744 wrote to memory of 3444	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	104
PID 3744 wrote to memory of 3444	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	104
PID 3744 wrote to memory of 3444	3744	JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe	104
PID 3444 wrote to memory of 1408	3444	cmd.exe	106
PID 3444 wrote to memory of 1408	3444	cmd.exe	106
PID 3444 wrote to memory of 1408	3444	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ce499bb928067c7fc964b40e8b8ff0d.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\usn4nklc.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES925E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC925D.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
- C:\Users\Admin\AppData\Roaming\ctfmon.exe
  C:\Users\Admin\AppData\Roaming\ctfmon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CYQVQCAI0O.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DNS.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdnsipconfig/releaseipconfig/renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DNS.bat

Filesize
47B

MD5
4b403bd7ff6fe021fcf3ecdd2c029f87

SHA1
890642fc02dbfffd5d3aef0ec652fa636a48c3ee

SHA256
267c9197388ab6b34c7516e728a3529df2b7aab5029588ffb47540bbe651f654

SHA512
3bdef29cfeab451d45182420bd179f9450a0da5c842992260a420728e212635f90cc1f394687c8ac852ccd8caf529e9bdb4aff24e2d07f6705594931b3ef5e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES925E.tmp

Filesize
1KB

MD5
7e015bba151cccc7a87d277c68d60584

SHA1
c097a747ac2ae0653064dae6de2c9fa7cb011644

SHA256
410873ae3be209d5b81a3f5a55e17c94df059b6efbd08752ac490b9527d5da58

SHA512
9f1db16a4c1c664c4ae4dbff396b7fe4d54626c4ed1257598f317438c021b9ddba69fe1b2386076a20d897d7c9a9e0565f3c4c723d3567b2deb82c49de0a7b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\usn4nklc.dll

Filesize
5KB

MD5
5ffd828c5ae0a3177e12297324cda258

SHA1
77de8fec9df8517cc77906a448498ca7205ffa87

SHA256
6aab2d2f86c87f40177fb49d82c3e93c6f590e56ed9dfc9ba6e334271b06e006

SHA512
9c14378e2a37d2ee35daf2669814b1ce77a5041291ca79ac516d906766fa7064bc9117de551d127ad797cb8db8c124997521960fcdab2154aad2dd552255ffa4

Download Submit
C:\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
12KB

MD5
df84665b4093dbb940f44cd14813ca89

SHA1
77bbdfb408e4638a6fa451d6b1e7ff305a31b5fd

SHA256
5b1328c108dc8b32851189fee744b4338de5d1ebe52d0f969a49f82f51480511

SHA512
447c4bd630f9c4752d31ebd7951398140302072eb4e75d858b080ccb47f1c15d1c2cbb4688bcd46a7e801f62a551be9d5c2bbc305829846de08327292eeba7d7

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
353eb148f1548b7cfe6535d466aec419

SHA1
eb6debca23bd9f5de0b48b50ce80cf508f94d05b

SHA256
935c3c03427de65a23891c75db33d3e6c64697a60327d416adf30b31a68c52eb

SHA512
eec53e6c93a5294ab41bc981b0f9c1cfe043701fe0bbfc944953dc5c41fa3265db3c4a867d8ce7075a4cf7e3ea3b23af7968c4cf0b82d920e929d2e94a37b267

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC925D.tmp

Filesize
652B

MD5
994ccaf933451a8094d6c5ffe6904f32

SHA1
db43eea84bd478eb2bf7f116945cf7ad7f2284e9

SHA256
1a5cfd5fbb07e50eaea16da32c70a0936520b6e0363560d4bf2f1b318ffd6f53

SHA512
ec650ef24ec6b1c152e8e7e7044d89499b510c3395e2f443b86fc3dd3a540f493d6ce4d84fe78daa498f6249a97d26931e341d355e872a8e2597b26027fc8420

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\usn4nklc.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\usn4nklc.cmdline

Filesize
206B

MD5
8fc5bbd67a386444d38e102ab0f879ce

SHA1
11803570a069c43bb1a6eb3013da5720c351afc1

SHA256
518df7ad8e06ca018c7ab736c465c66aeb5169592265c516e30eb056731ae5f1

SHA512
2ba57babe3d18bbfcc94b5906da92d4f371ab7020b9ad4c8a6643d10f7c2ea7f74744f864339115a3504666c4c183145caae358b64cb48ce78b86fa2c751958b

Download Submit
memory/3744-54-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3744-0-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/3744-53-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/3744-2-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3744-1-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3984-60-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-62-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-20-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-56-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-58-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-59-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-71-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-24-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-66-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-67-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-68-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-69-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5100-9-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/5100-16-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download