remcos | 4ba50be2c056423d1788cc6f2e7e1444e069684c14a302d1486725bc736d30c3

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCESTHTB.msi
Size

1.4MB
MD5

d5dd7c58c554c36c64ca86e6c172a3bb
SHA1

2401fff28f1208e3da5b44a528a6f6ece9fc25ac
SHA256

2dcafda9801e9cabf05f5824dc196f5fb966d53b5261207c7ea305bcc813aa2b
SHA512

d7f22b2e50ce9c603ea90be4f06e6e451414db6b0119907aaea0e2fd3f9ca6edb6a758dec659e03153fb17b4bbadc74b4100db35737d29b09d189f9b357ddfad
SSDEEP

24576:SHbU+DclSpAbi8cYeruT4HLGqidTsDo64N7im+o/gnWnsZ+/acJpDFWO5pjVOoKZ:AbU+mSpe2hfS4DoVN2m+o/gnWA+COZzr

Score

10^/10

remcos hotline discovery persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Botnet

HotLine

itadmincentral.com:443

itadmincentral.com:8080

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
35
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
putty
mouse_option
false
mutex
htl-TQFCUW
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Putty
screenshot_path
%AppData%
screenshot_time
1
startup_value
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;chrome;edge;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 1424	2432	atkexComSvc.exe	37

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76cc36.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76cc35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76cc35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD4D.tmp	msiexec.exe
File created	C:\Windows\Installer\f76cc38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76cc36.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Executes dropped EXE 2 IoCs

pid	Process
108	atkexComSvc.exe
2432	atkexComSvc.exe

Loads dropped DLL 11 IoCs

pid	Process
108	atkexComSvc.exe
108	atkexComSvc.exe
108	atkexComSvc.exe
108	atkexComSvc.exe
2432	atkexComSvc.exe
2432	atkexComSvc.exe
2432	atkexComSvc.exe
1424	cmd.exe
1424	cmd.exe
1424	cmd.exe
3048	dkyQuick_alpha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2512	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atkexComSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atkexComSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkyQuick_alpha.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2228	msiexec.exe
2228	msiexec.exe
108	atkexComSvc.exe
2432	atkexComSvc.exe
2432	atkexComSvc.exe
1424	cmd.exe
1424	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2432	atkexComSvc.exe
1424	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2228	msiexec.exe
Token: SeCreateTokenPrivilege	2512	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2512	msiexec.exe
Token: SeLockMemoryPrivilege	2512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2512	msiexec.exe
Token: SeMachineAccountPrivilege	2512	msiexec.exe
Token: SeTcbPrivilege	2512	msiexec.exe
Token: SeSecurityPrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeLoadDriverPrivilege	2512	msiexec.exe
Token: SeSystemProfilePrivilege	2512	msiexec.exe
Token: SeSystemtimePrivilege	2512	msiexec.exe
Token: SeProfSingleProcessPrivilege	2512	msiexec.exe
Token: SeIncBasePriorityPrivilege	2512	msiexec.exe
Token: SeCreatePagefilePrivilege	2512	msiexec.exe
Token: SeCreatePermanentPrivilege	2512	msiexec.exe
Token: SeBackupPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeShutdownPrivilege	2512	msiexec.exe
Token: SeDebugPrivilege	2512	msiexec.exe
Token: SeAuditPrivilege	2512	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2512	msiexec.exe
Token: SeChangeNotifyPrivilege	2512	msiexec.exe
Token: SeRemoteShutdownPrivilege	2512	msiexec.exe
Token: SeUndockPrivilege	2512	msiexec.exe
Token: SeSyncAgentPrivilege	2512	msiexec.exe
Token: SeEnableDelegationPrivilege	2512	msiexec.exe
Token: SeManageVolumePrivilege	2512	msiexec.exe
Token: SeImpersonatePrivilege	2512	msiexec.exe
Token: SeCreateGlobalPrivilege	2512	msiexec.exe
Token: SeBackupPrivilege	1732	vssvc.exe
Token: SeRestorePrivilege	1732	vssvc.exe
Token: SeAuditPrivilege	1732	vssvc.exe
Token: SeBackupPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2756	DrvInst.exe
Token: SeLoadDriverPrivilege	2756	DrvInst.exe
Token: SeLoadDriverPrivilege	2756	DrvInst.exe
Token: SeLoadDriverPrivilege	2756	DrvInst.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2512	msiexec.exe
2512	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	dkyQuick_alpha.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 108	2228	msiexec.exe	35
PID 2228 wrote to memory of 108	2228	msiexec.exe	35
PID 2228 wrote to memory of 108	2228	msiexec.exe	35
PID 2228 wrote to memory of 108	2228	msiexec.exe	35
PID 108 wrote to memory of 2432	108	atkexComSvc.exe	36
PID 108 wrote to memory of 2432	108	atkexComSvc.exe	36
PID 108 wrote to memory of 2432	108	atkexComSvc.exe	36
PID 108 wrote to memory of 2432	108	atkexComSvc.exe	36
PID 2432 wrote to memory of 1424	2432	atkexComSvc.exe	37
PID 2432 wrote to memory of 1424	2432	atkexComSvc.exe	37
PID 2432 wrote to memory of 1424	2432	atkexComSvc.exe	37
PID 2432 wrote to memory of 1424	2432	atkexComSvc.exe	37
PID 2432 wrote to memory of 1424	2432	atkexComSvc.exe	37
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39
PID 1424 wrote to memory of 3048	1424	cmd.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PCESTHTB.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Aardvark\atkexComSvc.exe
  "C:\Users\Admin\AppData\Local\Aardvark\atkexComSvc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\ProgramData\AOJ_Explore_alpha\atkexComSvc.exe
    C:\ProgramData\AOJ_Explore_alpha\atkexComSvc.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000390" "00000000000005AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76cc37.rbs

Filesize
8KB

MD5
bcb9fa78ae08a57713dc3e620d69597d

SHA1
badfa2a362b8017993bec979f3a1d82ab1d1fe0a

SHA256
8b7267c1916dbf152c47b9ad91f35c8841f64ac2b1626d672cab1fc67296571e

SHA512
970f805efa735b194ca742a70e746d02267d87734fa6f0fc25b8bb78984a3f0bbcd5f6ee15a2384467191fac306327106f2f3924cfb67b92dbf97c4eab6abe43

Download Submit
C:\ProgramData\putty\logs.dat

Filesize
184B

MD5
18c09d93ae92747a7d70e4e342ba42ed

SHA1
07d81dc148c5b68318c0f6e1a694c8a229cabf7d

SHA256
acac2f393e05ab3dfbf80e9316a50ea5958544be2ce4bad293695bb3f4e19615

SHA512
6476563742aa4d24d01efcacf505053e0c7c274b1d8962f2f8e018d06f8fe6f914bf2c5733c9daca420b45e7ed04c8538e870f2e035e66c0d51fea4ff16b1ec0

Download Submit
C:\Users\Admin\AppData\Local\Aardvark\ASUS_WMI.dll

Filesize
224KB

MD5
3f109a02c8d642e8003a1188df40d861

SHA1
f723f38471b8872443aa9177eef12a96c02cc84a

SHA256
6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5

SHA512
023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da

Download Submit
C:\Users\Admin\AppData\Local\Aardvark\AsIO.dll

Filesize
111KB

MD5
e3f5b27b0ca19c5c1170f2015ba38f97

SHA1
54f5350934c194ac5522c5ef7149f33aa5fcdb4d

SHA256
ccf5b18e0d708e20d2f98443233b398c57b2ea48a9f6b06077d2a8443361e9e4

SHA512
a4c3b34c4b970f2d0d14b136a41fc799bd99a7ab8c22e750ac6180529242504bebffd08be9fe602d7db38f61d4835aa36144a4a37e3e9f6de9c2eb81dbc432d2

Download Submit
C:\Users\Admin\AppData\Local\Aardvark\aaluc

Filesize
1.1MB

MD5
39a4a86256b2c64575cf80080ee05d60

SHA1
dadba54380df6c78e23b12b8d0611c41ef8b5cbe

SHA256
bc92c38ae31d419c62c2805aaf8183306fbc02db33d503a9feefba702fd1e6a4

SHA512
e2c20cf9e04a2109f7a799902f87985695a5d840e4b1aebfd7378ef0d530cb0ccde5ebe0b7ca0632fff594d68815a0aa146ae42ec2c7edd08a0d2a47cbc36fb2

Download Submit
C:\Users\Admin\AppData\Local\Aardvark\atkexComSvc.exe

Filesize
446KB

MD5
485008b43f0edceba0e0d3ca04bc1c1a

SHA1
55ae8f105af415bb763d1b87f6572f078052877c

SHA256
12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

SHA512
402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

Download Submit
C:\Users\Admin\AppData\Local\Aardvark\fpfqn

Filesize
16KB

MD5
6e9513a184f35757ce065a4c590e4630

SHA1
1dd885758961ec5037937fbce3511c7cae5823a9

SHA256
8efd81edd61a72085a2f802a8e53570d7b8b1f8db94bb8967d13390b142fa662

SHA512
2b8583db189f6c421b23cf89646801da04b365e35111fb83be69b4abd02c18de670da51cbf79c86395916fbd41e6d23ea2d2a247e55a4d025cf376f0e19591fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9423193

Filesize
1.6MB

MD5
1b426f394f23fa544f75b847d1ac0d35

SHA1
51b8115cf83dd1005fece36c1579e126b80092d2

SHA256
81ac0245aaf6f57f42675c24d3ae38fc36ed2e65be5439e7e4bc6830304e2160

SHA512
e6a64ad19253971825b4970f7a90721d683ccd3b7c5bdfdec2d744f53f37ecf18e83d89e99ace0c78cd7fce0358bb743d3a6c74572910f8659e8a28219c6a4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe

Filesize
433KB

MD5
fea067901f48a5f1faf7ca3b373f1a8f

SHA1
e8abe0deb87de9fe3bb3a611234584e9a9b17cce

SHA256
bf24b2f3e3a3c60ed116791b99e5421a4de34ac9c6e2201d34ab487e448ce152

SHA512
07c83a2d3d5dd475bc8aa48eba9b03e8fb742dbbd7bd623ed05dc1086efed7dfd1c1b8f037ee2e81efba1de58ea3243d7c84ac8b484e808cd28765f9c7517023

Download Submit
C:\Windows\Installer\f76cc35.msi

Filesize
1.4MB

MD5
d5dd7c58c554c36c64ca86e6c172a3bb

SHA1
2401fff28f1208e3da5b44a528a6f6ece9fc25ac

SHA256
2dcafda9801e9cabf05f5824dc196f5fb966d53b5261207c7ea305bcc813aa2b

SHA512
d7f22b2e50ce9c603ea90be4f06e6e451414db6b0119907aaea0e2fd3f9ca6edb6a758dec659e03153fb17b4bbadc74b4100db35737d29b09d189f9b357ddfad

Download Submit
\Users\Admin\AppData\Local\Aardvark\ATKEX.dll

Filesize
84KB

MD5
e68562f63265e1a70881446b4b9dc455

SHA1
da16ef9367bde3ce892b1a0e33bc179d8acdceb3

SHA256
c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb

SHA512
6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674

Download Submit
memory/108-38-0x0000000077090000-0x0000000077239000-memory.dmp

Filesize
1.7MB

Download
memory/108-37-0x00000000745C0000-0x0000000074734000-memory.dmp

Filesize
1.5MB

Download
memory/1424-91-0x00000000745D0000-0x0000000074744000-memory.dmp

Filesize
1.5MB

Download
memory/1424-63-0x0000000077090000-0x0000000077239000-memory.dmp

Filesize
1.7MB

Download
memory/2432-60-0x00000000745D0000-0x0000000074744000-memory.dmp

Filesize
1.5MB

Download
memory/2432-59-0x0000000077090000-0x0000000077239000-memory.dmp

Filesize
1.7MB

Download
memory/2432-58-0x00000000745D0000-0x0000000074744000-memory.dmp

Filesize
1.5MB

Download
memory/3048-99-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-100-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-102-0x0000000077090000-0x0000000077239000-memory.dmp

Filesize
1.7MB

Download
memory/3048-104-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3048-108-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3048-119-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3048-125-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3048-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download