ctblocker | 9005436ea8f7c0dede260d1b249540c94a02431afe4d26956b4199705577ea62

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20251223-en
resource tags

arch:x64arch:x86image:win10v2004-20251223-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2025, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe
Size 742KB
Sample251218-1p8phasqby
SHA256 9005436ea8f7c0dede260d1b249540c94a02431afe4d26956b4199705577ea62
MD5 39c0e005cd2892a7b315081f9db6dc37
SHA1 e9c2dda548ca0f53939d8bbf9228a92977964341
SHA512 e5b258b62685152ba0387a280a27957c6cd78848d31a7cd65089c0c8dbd0d59d65089f702fe0dd8e759a27c2974219f9c170ba67c6457a4725a8b09dc69ce77e
SSDEEP 12288:T2359uMww1bLO6ejFn8KL8XdChu/FiMZgi7hLEsOYt4ZmwjHCmac95RDOqruN2mE:S5p126wFn8KL8tz4MZHVLJtimSimHROY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware discovery ctblocker ransomware spyware

Malware Config

Extracted

Path

C:\ProgramData\qnzoiya.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://fizxfsi3cad3kn7v.onion.cab or http://fizxfsi3cad3kn7v.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://fizxfsi3cad3kn7v.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://fizxfsi3cad3kn7v.onion.cab
http://fizxfsi3cad3kn7v.tor2web.org
http://fizxfsi3cad3kn7v.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Ctblocker family
ctblocker

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\Control Panel\International\Geo\Nation	blnzgte.exe

Executes dropped EXE 2 IoCs

pid	Process
2536	blnzgte.exe
3740	blnzgte.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	blnzgte.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	blnzgte.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	blnzgte.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	blnzgte.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini	blnzgte.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-yjgvnxe.bmp"	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blnzgte.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blnzgte.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\Software\Microsoft\Internet Explorer\GPU	blnzgte.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\""	blnzgte.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	blnzgte.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	blnzgte.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-d01200000000}\MaxCapacity = "13092"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-f0ff3a000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00340032003600610039006400320033002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00340032003600610039006400320033002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-d01200000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{426a9d23-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "134109934643859971"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134113438977958957"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "134109934641359858"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134113439607802630"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134113438990615027"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3635778898-394320838-2529574076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134113439596396463"	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
344	JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe
344	JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
2536	blnzgte.exe
3740	blnzgte.exe
3740	blnzgte.exe
3740	blnzgte.exe
3740	blnzgte.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	blnzgte.exe
Token: SeDebugPrivilege	2536	blnzgte.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3740	blnzgte.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3740	blnzgte.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3740	blnzgte.exe
3740	blnzgte.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3240	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 788	2536	blnzgte.exe	8
PID 788 wrote to memory of 1908	788	svchost.exe	95
PID 2536 wrote to memory of 3240	2536	blnzgte.exe	54
PID 2536 wrote to memory of 3740	2536	blnzgte.exe	96
PID 788 wrote to memory of 4116	788	svchost.exe	98
PID 788 wrote to memory of 2348	788	svchost.exe	99
PID 788 wrote to memory of 4616	788	svchost.exe	100
PID 788 wrote to memory of 4512	788	svchost.exe	101

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1908
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:4116
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2348
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:4616
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4512

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of UnmapMainImage
PID:3240
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c0e005cd2892a7b315081f9db6dc37.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:344

C:\Users\Admin\AppData\Local\Temp\blnzgte.exe
C:\Users\Admin\AppData\Local\Temp\blnzgte.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\blnzgte.exe
  "C:\Users\Admin\AppData\Local\Temp\blnzgte.exe" -u
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

inhrefh

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\inhrefh
Size 654B
SHA256 f770599be5e02206df59f950941672777c27ad9cefc7400dc533f94e62dab9bf
MD5 9ea5f9d5948ea7207beccb8f7bdfc4c1
SHA1 1ab93317e02c0dc58db7bf9a04bcfbe0b3b24c4f
SHA512 c0e3cc7a3cc10eda336877630f7124f4926b72dca359e38e22e18035f523f221ffc8b6fad8e053af6bf79a059ff8056865ee95f509974a33659b65dcc3cb5b71
MD5 SHA1 SHA512

Submit Download

inhrefh

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\inhrefh
Size 654B
SHA256 4247491d27ed2c163be6b74a7d1dc156e7d849a0399912335604d76e3a3c98cd
MD5 b678f5155f0731b097df7de9924c19c2
SHA1 b1dfcffc2dffc65da07e47c646708987d812504f
SHA512 13b28c70fe88bd22bb67a21cc6f907443bf9cadaac25392eba4b1d20ece3b7008085dcd7cf7a1895f91c95a7677db719f1a7e56ecc176a5b9f0149ac3cb0d14f
MD5 SHA1 SHA512

Submit Download

inhrefh

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\inhrefh
Size 654B
SHA256 4185ba765ecd574a24643616625217b30454a87c4f8e5325af0f2eb51c98e02c
MD5 e22eea1b0b7e95856a337af517c2479c
SHA1 f3da5dfe2959181467b13e9a5de51d74132d5a39
SHA512 7b44e17e7403b37bd0f2570ea6f08c6df8e958c4d94de601dceaece34858b3d43f6df36c5d288040b2a42002fb69eafc7a129ba26f2ee119237f3064a8bd6f8d
MD5 SHA1 SHA512

Submit Download

inhrefh

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\inhrefh
Size 654B
SHA256 1e5e87afe3ae8a1f0c1289c8ce68fd78028dc0d234170015f825eb3183671306
MD5 89fda6f74591cc183c6322b81f6fb115
SHA1 9ee547f8cff67051af136b5c84896d1eb0f89210
SHA512 5125a784265db73c5919072a16a7d36a35edc1ccffd34e06132e094fe9f50b52e2d1f673b3e90f7e4e5b36892fe064f07167c48a7f00945aa0f6ddcd65854a07
MD5 SHA1 SHA512

Submit Download

qnzoiya.html

Path C:\ProgramData\qnzoiya.html
Size 235KB
SHA256 ac79102d87e24b2100edf88d5e7f2c42a4b7522160dacfbfbad77c214233b93a
MD5 74435e1f80e71d44348602f2a4215478
SHA1 2b0aa4dba3c02d1c3162bce1a8746e20a36f1653
SHA512 31ce927cd5397c2736a9c834067e9209f1129021e0d9c13c117ae3c473fb2a1c810641482d616807d0ff5a5c1cc7502b9f999e5ec05f2db50cc640bef7f0618e
SSDEEP 6144:uuiv9ZW/g2ZG0d4KUGsOp0LWKI+EKJyuS:R
MD5 SHA1 SHA512 SSDEEP

Submit Download

blnzgte.exe

Path C:\Users\Admin\AppData\Local\Temp\blnzgte.exe
Size 742KB
SHA256 9005436ea8f7c0dede260d1b249540c94a02431afe4d26956b4199705577ea62
MD5 39c0e005cd2892a7b315081f9db6dc37
SHA1 e9c2dda548ca0f53939d8bbf9228a92977964341
SHA512 e5b258b62685152ba0387a280a27957c6cd78848d31a7cd65089c0c8dbd0d59d65089f702fe0dd8e759a27c2974219f9c170ba67c6457a4725a8b09dc69ce77e
SSDEEP 12288:T2359uMww1bLO6ejFn8KL8XdChu/FiMZgi7hLEsOYt4ZmwjHCmac95RDOqruN2mE:S5p126wFn8KL8tz4MZHVLJtimSimHROY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CachedImage_1280_720_POS4.JPG.yjgvnxe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.JPG.yjgvnxe
Size 36KB
SHA256 5c2466438ded0a7843381879a690382667fee88312096f2020ecf1e21368ac7c
MD5 221df458cd026e63666041390359aafd
SHA1 5872322a8d41fe67321261d41b8c6487d61f2692
SHA512 7f1c2eef3ee7f50500a08600ce87954284075bee9cceb23fb31a4bc4e6cf9dd09c8281c10cffe96b300809a199f9bc4e47b202f8a9a166d0da610916ac78c66e
SSDEEP 768:rH9VyjRztdCICljFIhtjTKIJnElC5y2VzeD:rHujRZdC1FgtXKIhEc5fzeD
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

memory/344-0-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/344-221-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/344-4-0x0000000002870000-0x0000000002ABB000-memory.dmp

Download

memory/344-3-0x0000000002650000-0x000000000286A000-memory.dmp

Download

memory/344-2-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/344-1-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/788-15-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-14-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-51-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-54-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-3361-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-19-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-220-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-21-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/788-16-0x000000001AD70000-0x000000001ADE7000-memory.dmp

Download

memory/2536-3367-0x0000000001400000-0x000000000164B000-memory.dmp

Download

memory/2536-10-0x0000000001400000-0x000000000164B000-memory.dmp

Download

memory/3740-3394-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3395-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3425-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3424-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3427-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3428-0x0000000002770000-0x00000000029BB000-memory.dmp

Download

memory/3740-3431-0x0000000002770000-0x00000000029BB000-memory.dmp

Download