blackshades | df1bf8af7030dfb6c3871314fa0e55405bb1a1d41d3943ac96ba9f19006c854b

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/03/2025, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Size

704KB
MD5

5f3b2bc4fdbd5416aa1329c364316995
SHA1

d798f10b6ea6b36924e46eebacfb6a8468b55ec6
SHA256

df1bf8af7030dfb6c3871314fa0e55405bb1a1d41d3943ac96ba9f19006c854b
SHA512

d9057c6e2f9224289a44ba30dcd5cc82226f5dfbe1c5a1598a9489298b4eedd844e70a6c6090ca86a9a247e072028b17b2627fea27dc8e0c6ef8d8e8d432ec59
SSDEEP

12288:CN5VwkA3RvcGo6k5u3kFpm61J+Zg1DztDnaHZE3h4nLlg7j8Cqd3/O+fvcUcnAsT:C/OalhJRaHZu4n2j0jvuG

Score

10^/10

blackshades defense_evasion discovery rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 15 IoCs

resource	yara_rule
behavioral1/memory/2708-30-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-27-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-69-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-70-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-72-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-73-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-74-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-76-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-77-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-78-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-80-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-81-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-82-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-84-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral1/memory/2708-85-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ctfmon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ctfmon.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	ctfmon.exe

Loads dropped DLL 2 IoCs

pid	Process
2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2656 set thread context of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1480	ipconfig.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
656	reg.exe
1108	reg.exe
2280	reg.exe
2336	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Token: 1	2708	ctfmon.exe
Token: SeCreateTokenPrivilege	2708	ctfmon.exe
Token: SeAssignPrimaryTokenPrivilege	2708	ctfmon.exe
Token: SeLockMemoryPrivilege	2708	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	2708	ctfmon.exe
Token: SeMachineAccountPrivilege	2708	ctfmon.exe
Token: SeTcbPrivilege	2708	ctfmon.exe
Token: SeSecurityPrivilege	2708	ctfmon.exe
Token: SeTakeOwnershipPrivilege	2708	ctfmon.exe
Token: SeLoadDriverPrivilege	2708	ctfmon.exe
Token: SeSystemProfilePrivilege	2708	ctfmon.exe
Token: SeSystemtimePrivilege	2708	ctfmon.exe
Token: SeProfSingleProcessPrivilege	2708	ctfmon.exe
Token: SeIncBasePriorityPrivilege	2708	ctfmon.exe
Token: SeCreatePagefilePrivilege	2708	ctfmon.exe
Token: SeCreatePermanentPrivilege	2708	ctfmon.exe
Token: SeBackupPrivilege	2708	ctfmon.exe
Token: SeRestorePrivilege	2708	ctfmon.exe
Token: SeShutdownPrivilege	2708	ctfmon.exe
Token: SeDebugPrivilege	2708	ctfmon.exe
Token: SeAuditPrivilege	2708	ctfmon.exe
Token: SeSystemEnvironmentPrivilege	2708	ctfmon.exe
Token: SeChangeNotifyPrivilege	2708	ctfmon.exe
Token: SeRemoteShutdownPrivilege	2708	ctfmon.exe
Token: SeUndockPrivilege	2708	ctfmon.exe
Token: SeSyncAgentPrivilege	2708	ctfmon.exe
Token: SeEnableDelegationPrivilege	2708	ctfmon.exe
Token: SeManageVolumePrivilege	2708	ctfmon.exe
Token: SeImpersonatePrivilege	2708	ctfmon.exe
Token: SeCreateGlobalPrivilege	2708	ctfmon.exe
Token: 31	2708	ctfmon.exe
Token: 32	2708	ctfmon.exe
Token: 33	2708	ctfmon.exe
Token: 34	2708	ctfmon.exe
Token: 35	2708	ctfmon.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	ctfmon.exe
2708	ctfmon.exe
2708	ctfmon.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2800	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	30
PID 2656 wrote to memory of 2800	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	30
PID 2656 wrote to memory of 2800	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	30
PID 2656 wrote to memory of 2800	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	30
PID 2800 wrote to memory of 2736	2800	csc.exe	32
PID 2800 wrote to memory of 2736	2800	csc.exe	32
PID 2800 wrote to memory of 2736	2800	csc.exe	32
PID 2800 wrote to memory of 2736	2800	csc.exe	32
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2656 wrote to memory of 2708	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	33
PID 2708 wrote to memory of 2740	2708	ctfmon.exe	34
PID 2708 wrote to memory of 2740	2708	ctfmon.exe	34
PID 2708 wrote to memory of 2740	2708	ctfmon.exe	34
PID 2708 wrote to memory of 2740	2708	ctfmon.exe	34
PID 2708 wrote to memory of 2552	2708	ctfmon.exe	35
PID 2708 wrote to memory of 2552	2708	ctfmon.exe	35
PID 2708 wrote to memory of 2552	2708	ctfmon.exe	35
PID 2708 wrote to memory of 2552	2708	ctfmon.exe	35
PID 2708 wrote to memory of 2560	2708	ctfmon.exe	36
PID 2708 wrote to memory of 2560	2708	ctfmon.exe	36
PID 2708 wrote to memory of 2560	2708	ctfmon.exe	36
PID 2708 wrote to memory of 2560	2708	ctfmon.exe	36
PID 2708 wrote to memory of 2568	2708	ctfmon.exe	37
PID 2708 wrote to memory of 2568	2708	ctfmon.exe	37
PID 2708 wrote to memory of 2568	2708	ctfmon.exe	37
PID 2708 wrote to memory of 2568	2708	ctfmon.exe	37
PID 2560 wrote to memory of 656	2560	cmd.exe	42
PID 2560 wrote to memory of 656	2560	cmd.exe	42
PID 2560 wrote to memory of 656	2560	cmd.exe	42
PID 2560 wrote to memory of 656	2560	cmd.exe	42
PID 2568 wrote to memory of 1108	2568	cmd.exe	43
PID 2568 wrote to memory of 1108	2568	cmd.exe	43
PID 2568 wrote to memory of 1108	2568	cmd.exe	43
PID 2568 wrote to memory of 1108	2568	cmd.exe	43
PID 2740 wrote to memory of 2280	2740	cmd.exe	44
PID 2740 wrote to memory of 2280	2740	cmd.exe	44
PID 2740 wrote to memory of 2280	2740	cmd.exe	44
PID 2740 wrote to memory of 2280	2740	cmd.exe	44
PID 2552 wrote to memory of 2336	2552	cmd.exe	45
PID 2552 wrote to memory of 2336	2552	cmd.exe	45
PID 2552 wrote to memory of 2336	2552	cmd.exe	45
PID 2552 wrote to memory of 2336	2552	cmd.exe	45
PID 2656 wrote to memory of 2444	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	46
PID 2656 wrote to memory of 2444	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	46
PID 2656 wrote to memory of 2444	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	46
PID 2656 wrote to memory of 2444	2656	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	46
PID 2444 wrote to memory of 1480	2444	cmd.exe	48
PID 2444 wrote to memory of 1480	2444	cmd.exe	48
PID 2444 wrote to memory of 1480	2444	cmd.exe	48
PID 2444 wrote to memory of 1480	2444	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cpthjhmn.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D51.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1D50.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
- C:\Users\Admin\AppData\Roaming\ctfmon.exe
  C:\Users\Admin\AppData\Roaming\ctfmon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\DNS.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdnsipconfig/releaseipconfig/renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DNS.bat

Filesize
47B

MD5
4b403bd7ff6fe021fcf3ecdd2c029f87

SHA1
890642fc02dbfffd5d3aef0ec652fa636a48c3ee

SHA256
267c9197388ab6b34c7516e728a3529df2b7aab5029588ffb47540bbe651f654

SHA512
3bdef29cfeab451d45182420bd179f9450a0da5c842992260a420728e212635f90cc1f394687c8ac852ccd8caf529e9bdb4aff24e2d07f6705594931b3ef5e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1D51.tmp

Filesize
1KB

MD5
7ed9384696f7854b1454b094b0820d1a

SHA1
86a3de129f60c3c8b06833ec07c53806558b0b0e

SHA256
bf6e056b815b04bb3d95813b57308761a9db780b4b573b41a477a1a357735cdd

SHA512
198614f13bebb51941b5da7441b05e94dd232f76ccc02c5ef349579462c89d2be532f78cf22c5de6e47971c4fc0170a254fd957bb18d9b8aa1aae26647f2845d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpthjhmn.dll

Filesize
5KB

MD5
a67c088743d77e37677985a0e7b650ea

SHA1
20f18165f1519e81141fa1cc47e6a15a5e0f0198

SHA256
ac07ddf7ab3cb50763f06b857dd5b004233fd3ed61869b9ee2f704611c024868

SHA512
f1b0f2b96fbd7a75dcabbbc98707da36ce4855c331aaa5fd425b3e91f45fb4b4bd21a1d3143c706c1b583cfb9ec7e2f343d7ed9faa9a32751ef64970b15aa157

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
1e3bac557fd2718212f2306ab9671b47

SHA1
49e39343e82d3ec38063ef327832f2a0fbacc8d1

SHA256
1fa11e0761fa0471e28ebe32015cb75aa9758bfc05b54827867f97408d498986

SHA512
483f898930ad7f7485a7586dc2198a3f3254e4076bc7556ec67a47fbd9bb9a88713f6690884eedb3cecb913457465ce623bf29a4cdb4fc59dc40ef5d1acc45bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC1D50.tmp

Filesize
652B

MD5
5bac51de4f04af6ce7937ffa4a7e2de6

SHA1
44f15f619d0d05f7ab3483b9ec033842ca22c624

SHA256
0030c0f41f3fd633e1b05b15a21bab617c979047f2fcd8afe9c09acc94d499fc

SHA512
4b5548fa660be6b897b1904ccbdf1aceaeda01e3147d2e42cecb8621ff4cf41c89904ba6495ea4fd7628bdb9e993af8129a6825c604a784ad0824905060d794c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cpthjhmn.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cpthjhmn.cmdline

Filesize
206B

MD5
3a7b4bff6f85e6fe069d674b144ac5b3

SHA1
88354007efba69023d42cd7d1f93134dd5cf73f8

SHA256
2bc3764b3a0fae454465de655ad4e8368fa8a9932d66cd2b941b64609a06f9aa

SHA512
ade07d82c0d1b1d88cdd77c9605bebc22ba9aa43d0c6061c316f6b416987ce6c51798c0cb4428fc590f772043d82715c68b233f24d4f03189f772650cb6806f2

Download Submit
\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
12KB

MD5
df84665b4093dbb940f44cd14813ca89

SHA1
77bbdfb408e4638a6fa451d6b1e7ff305a31b5fd

SHA256
5b1328c108dc8b32851189fee744b4338de5d1ebe52d0f969a49f82f51480511

SHA512
447c4bd630f9c4752d31ebd7951398140302072eb4e75d858b080ccb47f1c15d1c2cbb4688bcd46a7e801f62a551be9d5c2bbc305829846de08327292eeba7d7

Download Submit
memory/2656-1-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-2-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-0-0x0000000074C01000-0x0000000074C02000-memory.dmp

Filesize
4KB

Download
memory/2656-68-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2708-76-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-25-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-26-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-30-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-85-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-69-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-70-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-27-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-73-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-74-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-84-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-77-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-78-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-80-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-81-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2708-82-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2800-9-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2800-16-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download