blackshades | df1bf8af7030dfb6c3871314fa0e55405bb1a1d41d3943ac96ba9f19006c854b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2025, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Size

704KB
MD5

5f3b2bc4fdbd5416aa1329c364316995
SHA1

d798f10b6ea6b36924e46eebacfb6a8468b55ec6
SHA256

df1bf8af7030dfb6c3871314fa0e55405bb1a1d41d3943ac96ba9f19006c854b
SHA512

d9057c6e2f9224289a44ba30dcd5cc82226f5dfbe1c5a1598a9489298b4eedd844e70a6c6090ca86a9a247e072028b17b2627fea27dc8e0c6ef8d8e8d432ec59
SSDEEP

12288:CN5VwkA3RvcGo6k5u3kFpm61J+Zg1DztDnaHZE3h4nLlg7j8Cqd3/O+fvcUcnAsT:C/OalhJRaHZu4n2j0jvuG

Score

10^/10

blackshades defense_evasion discovery rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 16 IoCs

resource	yara_rule
behavioral2/memory/4556-20-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-24-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-55-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-56-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-58-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-59-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-60-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-62-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-63-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-64-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-66-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-67-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-68-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-70-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-71-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades
behavioral2/memory/4556-72-0x0000000000400000-0x000000000046F000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ctfmon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ctfmon.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Executes dropped EXE 1 IoCs

pid	Process
4556	ctfmon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3276	ipconfig.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4144	reg.exe
4756	reg.exe
4676	reg.exe
2712	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
Token: 1	4556	ctfmon.exe
Token: SeCreateTokenPrivilege	4556	ctfmon.exe
Token: SeAssignPrimaryTokenPrivilege	4556	ctfmon.exe
Token: SeLockMemoryPrivilege	4556	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	4556	ctfmon.exe
Token: SeMachineAccountPrivilege	4556	ctfmon.exe
Token: SeTcbPrivilege	4556	ctfmon.exe
Token: SeSecurityPrivilege	4556	ctfmon.exe
Token: SeTakeOwnershipPrivilege	4556	ctfmon.exe
Token: SeLoadDriverPrivilege	4556	ctfmon.exe
Token: SeSystemProfilePrivilege	4556	ctfmon.exe
Token: SeSystemtimePrivilege	4556	ctfmon.exe
Token: SeProfSingleProcessPrivilege	4556	ctfmon.exe
Token: SeIncBasePriorityPrivilege	4556	ctfmon.exe
Token: SeCreatePagefilePrivilege	4556	ctfmon.exe
Token: SeCreatePermanentPrivilege	4556	ctfmon.exe
Token: SeBackupPrivilege	4556	ctfmon.exe
Token: SeRestorePrivilege	4556	ctfmon.exe
Token: SeShutdownPrivilege	4556	ctfmon.exe
Token: SeDebugPrivilege	4556	ctfmon.exe
Token: SeAuditPrivilege	4556	ctfmon.exe
Token: SeSystemEnvironmentPrivilege	4556	ctfmon.exe
Token: SeChangeNotifyPrivilege	4556	ctfmon.exe
Token: SeRemoteShutdownPrivilege	4556	ctfmon.exe
Token: SeUndockPrivilege	4556	ctfmon.exe
Token: SeSyncAgentPrivilege	4556	ctfmon.exe
Token: SeEnableDelegationPrivilege	4556	ctfmon.exe
Token: SeManageVolumePrivilege	4556	ctfmon.exe
Token: SeImpersonatePrivilege	4556	ctfmon.exe
Token: SeCreateGlobalPrivilege	4556	ctfmon.exe
Token: 31	4556	ctfmon.exe
Token: 32	4556	ctfmon.exe
Token: 33	4556	ctfmon.exe
Token: 34	4556	ctfmon.exe
Token: 35	4556	ctfmon.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4556	ctfmon.exe
4556	ctfmon.exe
4556	ctfmon.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4140	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	87
PID 4356 wrote to memory of 4140	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	87
PID 4356 wrote to memory of 4140	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	87
PID 4140 wrote to memory of 4420	4140	csc.exe	90
PID 4140 wrote to memory of 4420	4140	csc.exe	90
PID 4140 wrote to memory of 4420	4140	csc.exe	90
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4356 wrote to memory of 4556	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	92
PID 4556 wrote to memory of 3552	4556	ctfmon.exe	93
PID 4556 wrote to memory of 3552	4556	ctfmon.exe	93
PID 4556 wrote to memory of 3552	4556	ctfmon.exe	93
PID 4556 wrote to memory of 5104	4556	ctfmon.exe	94
PID 4556 wrote to memory of 5104	4556	ctfmon.exe	94
PID 4556 wrote to memory of 5104	4556	ctfmon.exe	94
PID 4556 wrote to memory of 1096	4556	ctfmon.exe	95
PID 4556 wrote to memory of 1096	4556	ctfmon.exe	95
PID 4556 wrote to memory of 1096	4556	ctfmon.exe	95
PID 4556 wrote to memory of 788	4556	ctfmon.exe	96
PID 4556 wrote to memory of 788	4556	ctfmon.exe	96
PID 4556 wrote to memory of 788	4556	ctfmon.exe	96
PID 3552 wrote to memory of 2712	3552	cmd.exe	101
PID 3552 wrote to memory of 2712	3552	cmd.exe	101
PID 3552 wrote to memory of 2712	3552	cmd.exe	101
PID 4356 wrote to memory of 924	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	102
PID 4356 wrote to memory of 924	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	102
PID 4356 wrote to memory of 924	4356	JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe	102
PID 5104 wrote to memory of 4144	5104	cmd.exe	104
PID 5104 wrote to memory of 4144	5104	cmd.exe	104
PID 5104 wrote to memory of 4144	5104	cmd.exe	104
PID 1096 wrote to memory of 4756	1096	cmd.exe	105
PID 1096 wrote to memory of 4756	1096	cmd.exe	105
PID 1096 wrote to memory of 4756	1096	cmd.exe	105
PID 788 wrote to memory of 4676	788	cmd.exe	106
PID 788 wrote to memory of 4676	788	cmd.exe	106
PID 788 wrote to memory of 4676	788	cmd.exe	106
PID 924 wrote to memory of 3276	924	cmd.exe	107
PID 924 wrote to memory of 3276	924	cmd.exe	107
PID 924 wrote to memory of 3276	924	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f3b2bc4fdbd5416aa1329c364316995.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4he5kycv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC351.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC350.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4420
- C:\Users\Admin\AppData\Roaming\ctfmon.exe
  C:\Users\Admin\AppData\Roaming\ctfmon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ctfmon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ctfmon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RJ8Q6UARKC.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DNS.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdnsipconfig/releaseipconfig/renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4he5kycv.dll

Filesize
5KB

MD5
810187c8cba3ec44fa9218069dafbb14

SHA1
f72de3da09eb5afb448caa787f33fd9bd8b1054d

SHA256
6a23f1948baa2bf1e3ed84e9a45608bda2b72c6b54fcb584b2c81274cc2e867a

SHA512
ac544d4e1912a70a86b4377d6722b72022f91cec42956d36e94eb6109755da7a4480a294ca6845892ce0e150259054651ad84ebffcb6bd5d5f4aaf81e42337c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DNS.bat

Filesize
47B

MD5
4b403bd7ff6fe021fcf3ecdd2c029f87

SHA1
890642fc02dbfffd5d3aef0ec652fa636a48c3ee

SHA256
267c9197388ab6b34c7516e728a3529df2b7aab5029588ffb47540bbe651f654

SHA512
3bdef29cfeab451d45182420bd179f9450a0da5c842992260a420728e212635f90cc1f394687c8ac852ccd8caf529e9bdb4aff24e2d07f6705594931b3ef5e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC351.tmp

Filesize
1KB

MD5
65e0fcf00b5fcf25e6e083ea47efc29b

SHA1
4dfc23111e4e413812a4e35fab2893aa5fc10e92

SHA256
aa81de6b2510304baf87ec8e3109e8913a87508cdf0a42c791dd321d114f9757

SHA512
a2f8144308f4bc232ba5167f6a58eccc3698a3daa66c3840700048f7b11ebdc4339bd15c1786de2c52c41cc5b85ee615fd19b0b4a28ed51615eb02d7235693d0

Download Submit
C:\Users\Admin\AppData\Roaming\ctfmon.exe

Filesize
12KB

MD5
df84665b4093dbb940f44cd14813ca89

SHA1
77bbdfb408e4638a6fa451d6b1e7ff305a31b5fd

SHA256
5b1328c108dc8b32851189fee744b4338de5d1ebe52d0f969a49f82f51480511

SHA512
447c4bd630f9c4752d31ebd7951398140302072eb4e75d858b080ccb47f1c15d1c2cbb4688bcd46a7e801f62a551be9d5c2bbc305829846de08327292eeba7d7

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
353eb148f1548b7cfe6535d466aec419

SHA1
eb6debca23bd9f5de0b48b50ce80cf508f94d05b

SHA256
935c3c03427de65a23891c75db33d3e6c64697a60327d416adf30b31a68c52eb

SHA512
eec53e6c93a5294ab41bc981b0f9c1cfe043701fe0bbfc944953dc5c41fa3265db3c4a867d8ce7075a4cf7e3ea3b23af7968c4cf0b82d920e929d2e94a37b267

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4he5kycv.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4he5kycv.cmdline

Filesize
206B

MD5
16c64438dd5cd43788dca8109d115985

SHA1
130ce121f9cf60a32759ce5f2d3e8e48ca0ade3f

SHA256
841b72350ba1a20ec24bc6316f2c4957d354cc34ab2469022f15291be13b5fe1

SHA512
c69cf822f079d3cec5dbd9fd653e88d599440ef2de9305041dc1b3472ae11db63e8309d8ac11d3cd4ddb4cb0a7a659170e1ff103034ba8a6fb24860103d1bd70

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC350.tmp

Filesize
652B

MD5
00c3d9363e0aff76e532434b7e7e3c30

SHA1
26f314e6a60e8393e96a655301892b581de2dfc4

SHA256
fff12056060c880fe5c0fc185283324fab04692d474770ff9282dec8dbd2c629

SHA512
804fe1e92b1b4137f59a7f9a46add7446c010d25c5186e65a13a2213561c127521f18cbf916e43288975f87e350c3a59d4cb3ee042ddf37570efa679f0f0f12a

Download Submit
memory/4140-9-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4140-16-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4356-53-0x0000000074C62000-0x0000000074C63000-memory.dmp

Filesize
4KB

Download
memory/4356-0-0x0000000074C62000-0x0000000074C63000-memory.dmp

Filesize
4KB

Download
memory/4356-2-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4356-54-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4356-1-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4556-60-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-62-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-56-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-20-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-58-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-59-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-24-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-66-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-67-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-68-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-70-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-71-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4556-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download