Overview

overview

10

Static

static

5

4ad1b0398b...18.exe

windows7-x64

10

4ad1b0398b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 11:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ad1b0398bc3a371a82923383de2d0a4_JaffaCakes118.exe

  • Size

    7.4MB

  • MD5

    4ad1b0398bc3a371a82923383de2d0a4

  • SHA1

    9f977029800b4328dc752741156a6a0e5f6fa109

  • SHA256

    2877bf056524695a30300cc6f5469202538727e8003ea14e8d13480a59600171

  • SHA512

    469300fef819aebfe9dbeacf05f60eb509e31abaef0f596575107c69fbe56f0a95ac92135256e98c21c2e2c027fe2d12e1a5d8c402b59a758fea42fba671618b

  • SSDEEP

    98304:Zg560g56dJ0MpqXQg56Mx6rAVQ2QBPAUoU9H0YCg56L8uQhHrqrkjp:a5M5QpU5fvQxAUf9HXp5+hQHrdl

Score
10/10
limeratremcossalitywarzonerathostbackdoorevasioninfostealerrattrojanupx

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

seasons444.ddns.net:8128

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    window

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Office_vgqkluqlnw

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

limerat

Wallets

1BVfdhbuDbDuMXWErhTv8XwgwYP1K34oTD

Attributes
  • aes_key

    MAXS20

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/vnPLhhBH

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/vnPLhhBH

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Modifies firewall policy service 2 TTPs 3 IoCs
    evasion
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Drops startup file 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1068
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\4ad1b0398bc3a371a82923383de2d0a4_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\4ad1b0398bc3a371a82923383de2d0a4_JaffaCakes118.exe"
            2⤵
            • Drops startup file
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Users\Admin\AppData\Local\Temp\seg32.exe
              "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2680
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1328
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1240
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1252
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:868
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1136
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2876
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2028
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2664
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2764
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2120
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2364
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2304
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2428
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1944
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2352
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2372
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:672
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:780
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:816
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1424
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1416
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1632
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1408
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1472
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:812
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1760
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2448
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2452
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2392
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:3048
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1748
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1752
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:408
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1112
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2104
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2960
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2848
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1144
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1284
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1500
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2836
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1484
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1704
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2408
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:956
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1308
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1800
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:1756
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                • Executes dropped EXE
                PID:2976
              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                4⤵
                  PID:336
                • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                  "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:3052
                • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                  "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                  4⤵
                    PID:1720
                  • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                    "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:316
                  • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                    "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:936
                  • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                    "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                    4⤵
                      PID:1088
                    • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                      "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:2132
                    • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                      "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                      4⤵
                        PID:688
                      • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                        "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:1064
                      • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                        "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                        4⤵
                          PID:2056
                        • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                          "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:2572
                        • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                          "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                          4⤵
                            PID:2088
                          • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                            "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:2032
                          • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                            "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                            4⤵
                              PID:1912
                            • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                              "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:1444
                            • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                              "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                              4⤵
                                PID:1860
                              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:2096
                              • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                4⤵
                                  PID:3044
                                • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                  "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1724
                                • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                  "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                  4⤵
                                    PID:2576
                                  • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                    "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:3028
                                  • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                    "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                    4⤵
                                      PID:996
                                    • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                      "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:3040
                                    • C:\Users\Admin\AppData\Local\Temp\seg32.exe
                                      "C:\Users\Admin\AppData\Local\Temp\seg32.exe"
                                      4⤵
                                        PID:1940
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe"
                                          5⤵
                                            PID:2732
                                      • C:\Users\Admin\AppData\Local\Temp\Servicez.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Servicez.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:2704
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2620
                                      • C:\Users\Admin\AppData\Local\Temp\Internets.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Internets.exe"
                                        3⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:2724
                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                          "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          PID:916
                                      • C:\Windows\SysWOW64\svchost.exe
                                        "C:\Windows\SysWOW64\svchost.exe"
                                        3⤵
                                        • Modifies firewall policy service
                                        • UAC bypass
                                        • Windows security bypass
                                        • Enumerates connected drives
                                        • Drops autorun.inf file
                                        • Drops file in Program Files directory
                                        • Drops file in Windows directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:2508
                                  • C:\Windows\system32\conhost.exe
                                    \??\C:\Windows\system32\conhost.exe "-18047072691748710971-954836720-15652725721576158705-52061704-7547324-849559607"
                                    1⤵
                                      PID:2696

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\Internets.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      ecdcf6e29f917239ecd9f3c4cd4bd4b4

                                      SHA1

                                      131f924924ace74686b31640d3b781052abfd39e

                                      SHA256

                                      add54490ee3977e1bf2c7090d44a7ecd42dfc9488470e98ff9c3d8169e437b99

                                      SHA512

                                      78946683a1a3f1415b22fa7fad5c4a736591399e3fc915bce798470b437d4430f6f7679272b3d7818662e6451817aa3cba44b9ae6d404834ac8d92fde5847733

                                      Download Submit

                                    • F:\bkjtnr.pif
                                      Filesize

                                      100KB

                                      MD5

                                      5e2508d6635a9e7b3184c6e16bfcc067

                                      SHA1

                                      3043c8f97615fdf02eaf25e189573b702ccc3856

                                      SHA256

                                      987861b82e2e15d42936b7e02afa02eba12f0b1a2f4f32985b4b959913bed5e5

                                      SHA512

                                      b65d0ceed4c69251ed1bd7621a7f03497beca39ffd0c009048904135ae2f90d9bcb9d13135869ff819395f8a150c06c8cc073871dbcd5441be49a75a9d29ab55

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\Servicez.exe
                                      Filesize

                                      1.5MB

                                      MD5

                                      457d4329b66efcbd6bcba521502df6a8

                                      SHA1

                                      99228fcf0fcde75cfcba2f35a7060bf3917a507b

                                      SHA256

                                      276073fc5509436fed91dfa63e1a05478c8d1fe56d974fc5881bb3d545ab4aa7

                                      SHA512

                                      61303aa92141241914b707b8afdb12affa6fe2ad6e6a670268963078e31a09c1d1d557c527b038ace8eec9921dbc3b6edf686ec82cd64a7be30fad97fda74b33

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\seg32.exe
                                      Filesize

                                      1.6MB

                                      MD5

                                      0c6fa100c0fd612d9f55a87017989621

                                      SHA1

                                      3298eeae3f5138d3bb8ed821f43090362c12f362

                                      SHA256

                                      facb90d2a9cf3daa839e624a6a2d12ea2555b357ca7397fbcfae65dba25e2d16

                                      SHA512

                                      9659f78562558e3b30369fb008386131fe63724d5c668ae456905007ef7cab803f54b69199c5e4fac99ca05e817d813b4fbeb113450dd852afbabb29dde03364

                                      Download Submit

                                    • memory/1068-64-0x0000000000210000-0x0000000000212000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1616-76-0x00000000007B0000-0x00000000007B2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1616-75-0x0000000000830000-0x0000000000831000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/1616-73-0x0000000000830000-0x0000000000831000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/1616-72-0x00000000007B0000-0x00000000007B2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2508-101-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2508-107-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-51-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-48-0x0000000000400000-0x000000000042A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/2508-52-0x0000000000400000-0x000000000042A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/2508-50-0x0000000000400000-0x000000000042A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/2508-118-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-117-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-115-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-49-0x0000000000400000-0x000000000042A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/2508-57-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-58-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-59-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-60-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-61-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-62-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-63-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-111-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-56-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-106-0x0000000000180000-0x0000000000182000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2508-102-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2508-103-0x0000000001F70000-0x0000000002FFE000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/2620-202-0x0000000000400000-0x000000000040C000-memory.dmp

                                      Filesize

                                      48KB

                                      Download

                                    • memory/2680-104-0x0000000000750000-0x0000000000752000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2680-82-0x0000000000760000-0x0000000000761000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2704-99-0x00000000001B0000-0x00000000001B2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2704-88-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2724-105-0x00000000000B0000-0x00000000000B2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2724-94-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download