warzonerat | d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
Size

409KB
MD5

f672d1603b04f6a1bb2c1168429768de
SHA1

7321c9d98b08b4e2a59240666a17787d583e74f0
SHA256

d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165
SHA512

21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575
SSDEEP

12288:L2LfajrFOnz+EtLLz7YVWy+OPWejt/pTwQqXPU:L2Lmw+EtYVR1Fjt/pTwQqs

Score

10^/10

warzonerat infostealer persistence rat upx

Malware Config

Extracted

Family

warzonerat

111.90.146.200:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 12 IoCs

rat

resource	yara_rule
behavioral1/memory/2376-7-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2376-18-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2376-19-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2376-34-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2376-35-0x0000000002C50000-0x0000000002D25000-memory.dmp	warzonerat
behavioral1/memory/2152-63-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2720-70-0x00000000031B0000-0x0000000003285000-memory.dmp	warzonerat
behavioral1/memory/2152-71-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2600-79-0x0000000002AF0000-0x0000000002B30000-memory.dmp	warzonerat
behavioral1/memory/2472-78-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2472-84-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2152-107-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs	notepad.exe

Executes dropped EXE 3 IoCs

pid	Process
2876	images.exe
2152	images.exe
2516	images.exe

Loads dropped DLL 2 IoCs

pid	Process
2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2416-2-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2416-3-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2004-11-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2004-15-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2004-16-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/files/0x0028000000015e09-24.dat	upx
behavioral1/memory/2720-40-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2876-41-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2876-46-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2720-54-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2720-44-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2876-37-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2516-68-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/3004-72-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2516-74-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2600-80-0x0000000002AF0000-0x0000000002B30000-memory.dmp	upx
behavioral1/memory/3004-81-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2440-87-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2440-88-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2440-90-0x0000000000400000-0x00000000004D5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images1 = "C:\\ProgramData\\images.exe"	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 2376	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	29
PID 2876 set thread context of 2152	2876	images.exe	37
PID 2720 set thread context of 2472	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	38

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2876	images.exe
2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
2600	powershell.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2428	powershell.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe
2516	images.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
2876	images.exe
2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2376	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2376	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2376	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2376	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2004	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2004	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2004	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2004	2416	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2600	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2600	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2600	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2600	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2876	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2876	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2876	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2876	2376	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2720	2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2720	2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2720	2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2720	2004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	34
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2876 wrote to memory of 2808	2876	images.exe	35
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2876 wrote to memory of 2152	2876	images.exe	37
PID 2876 wrote to memory of 2152	2876	images.exe	37
PID 2876 wrote to memory of 2152	2876	images.exe	37
PID 2876 wrote to memory of 2152	2876	images.exe	37
PID 2720 wrote to memory of 2620	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	36
PID 2720 wrote to memory of 2472	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	38
PID 2720 wrote to memory of 2472	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	38
PID 2720 wrote to memory of 2472	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	38
PID 2720 wrote to memory of 2472	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	38
PID 2876 wrote to memory of 2516	2876	images.exe	39
PID 2876 wrote to memory of 2516	2876	images.exe	39
PID 2876 wrote to memory of 2516	2876	images.exe	39
PID 2876 wrote to memory of 2516	2876	images.exe	39
PID 2720 wrote to memory of 3004	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	40
PID 2720 wrote to memory of 3004	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	40
PID 2720 wrote to memory of 3004	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	40
PID 2720 wrote to memory of 3004	2720	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	40
PID 3004 wrote to memory of 2440	3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	41
PID 3004 wrote to memory of 2440	3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	41
PID 3004 wrote to memory of 2440	3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	41
PID 3004 wrote to memory of 2440	3004	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	41
PID 2440 wrote to memory of 1632	2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	42
PID 2440 wrote to memory of 1632	2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	42
PID 2440 wrote to memory of 1632	2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	42
PID 2440 wrote to memory of 1632	2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	42
PID 2440 wrote to memory of 1632	2440	f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe	42
PID 2152 wrote to memory of 2428	2152	images.exe	43

C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:2808
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:1248
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe" 2 2152 259399226
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2516
- C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2376 259397074
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      Drops startup file
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2472 259399460
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
9f682defdaeed1a680601c7ee29e98be

SHA1
d3fce83f2a61eedb5e7679f95d36d2a501fa7c4a

SHA256
ecd123794bb41e2129d7d9af51129ae745556a231ed9116c7654b623d6d3066f

SHA512
356b05e037b0c73fa1fcc9087190f54a2a2f33268f81e7648c0af3021a408a846515e089f48acc180d59e16825d6e08334bf2b1f212899f16ac39b8bb69a7032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs

Filesize
158B

MD5
3cccf9435b659bf318d80f780097ffbf

SHA1
f0af7b20ad3498befcc19d90c0c1c7d4f021e77f

SHA256
a5c69769ed69652017de0ac5b2b49978af9580a67f0ce473742fc3a04c00a86a

SHA512
d28c78ce84c518b8446aaa2b10bced63c7877b969abdcc0d3b65251123c1472f66598935de7facab9f5608c2bdc01b03156b00413687ee40b272c1b307e29b40

Download Submit
\ProgramData\images.exe

Filesize
409KB

MD5
f672d1603b04f6a1bb2c1168429768de

SHA1
7321c9d98b08b4e2a59240666a17787d583e74f0

SHA256
d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165

SHA512
21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575

Download Submit
memory/1248-104-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2004-17-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2004-39-0x0000000001E20000-0x0000000001EF5000-memory.dmp

Filesize
852KB

Download
memory/2004-11-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2004-15-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2004-16-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2004-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2152-63-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2152-71-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2152-107-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2296-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2296-13-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2376-19-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2376-34-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2376-35-0x0000000002C50000-0x0000000002D25000-memory.dmp

Filesize
852KB

Download
memory/2376-18-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2376-7-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2416-4-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2416-3-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2416-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2416-9-0x0000000002130000-0x0000000002205000-memory.dmp

Filesize
852KB

Download
memory/2416-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2416-2-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2428-101-0x0000000002B00000-0x0000000002B40000-memory.dmp

Filesize
256KB

Download
memory/2428-100-0x00000000742F0000-0x000000007489B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-102-0x00000000742F0000-0x000000007489B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-98-0x00000000742F0000-0x000000007489B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-99-0x0000000002B00000-0x0000000002B40000-memory.dmp

Filesize
256KB

Download
memory/2440-90-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2440-88-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2440-87-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2440-92-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2472-84-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2472-78-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2516-68-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2516-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2516-74-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2516-77-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2600-76-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-83-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-80-0x0000000002AF0000-0x0000000002B30000-memory.dmp

Filesize
256KB

Download
memory/2600-75-0x0000000002AF0000-0x0000000002B30000-memory.dmp

Filesize
256KB

Download
memory/2600-73-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-79-0x0000000002AF0000-0x0000000002B30000-memory.dmp

Filesize
256KB

Download
memory/2720-44-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2720-40-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2720-70-0x00000000031B0000-0x0000000003285000-memory.dmp

Filesize
852KB

Download
memory/2720-59-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2720-50-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2720-54-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2876-41-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2876-37-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2876-42-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2876-47-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2876-46-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3004-82-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3004-72-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3004-81-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download