blackshades | 6099d3db49deb0b3e10f6ec70b77890facf037312ad54c3a5d279d7837ab3342

Analysis

max time kernel
148s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/02/2025, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
Size

808KB
MD5

7d88f1dc07795ebf10f9cb025c26df1c
SHA1

8b40bac4815a1f423bfb7392f3cd829d19a57425
SHA256

6099d3db49deb0b3e10f6ec70b77890facf037312ad54c3a5d279d7837ab3342
SHA512

9c8a0be31083ed5a0732b1ab5dd168dfd9b73d7939f78afba7827462863b1d2c3a8bf610927b30186a44957cd96129ca7c11e0f5a652084c53e36f8b8b2cb37e
SSDEEP

12288:RaTD5Z1TJnOKbSezj36YL/watEp1RMMTV+eFiGUCHF32:y5ZNJdbFfK6/lEpLTF9l

Score

10^/10

blackshades defense_evasion discovery persistence rat spyware stealer upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 12 IoCs

resource	yara_rule
behavioral1/memory/2108-30-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-42-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-44-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-46-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-47-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-48-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-50-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-51-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-52-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-55-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-56-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2108-60-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lf.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\lf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lf.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	lf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\msnmsngr = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe"	lf.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0A3CBAB9-CDDD-BCEE-FE93-8AEBEFCDFB5E}	lf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Active Setup\Installed Components\{0A3CBAB9-CDDD-BCEE-FE93-8AEBEFCDFB5E}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe"	lf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A3CBAB9-CDDD-BCEE-FE93-8AEBEFCDFB5E}	lf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A3CBAB9-CDDD-BCEE-FE93-8AEBEFCDFB5E}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe"	lf.exe

Executes dropped EXE 2 IoCs

pid	Process
1884	Server.exe
2108	lf.exe

Loads dropped DLL 5 IoCs

pid	Process
2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
2860	dw20.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msnmsngr = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe"	lf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\msnmsngr = "C:\\Users\\Admin\\AppData\\Roaming\\lf.exe"	lf.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2108-30-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/files/0x000600000001949e-27.dat	upx
behavioral1/memory/2108-42-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-44-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-46-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-47-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-48-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-50-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-51-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-52-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-55-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-56-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2108-60-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2616	reg.exe
2608	reg.exe
2624	reg.exe
2680	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1884	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: 1	2108	lf.exe
Token: SeCreateTokenPrivilege	2108	lf.exe
Token: SeAssignPrimaryTokenPrivilege	2108	lf.exe
Token: SeLockMemoryPrivilege	2108	lf.exe
Token: SeIncreaseQuotaPrivilege	2108	lf.exe
Token: SeMachineAccountPrivilege	2108	lf.exe
Token: SeTcbPrivilege	2108	lf.exe
Token: SeSecurityPrivilege	2108	lf.exe
Token: SeTakeOwnershipPrivilege	2108	lf.exe
Token: SeLoadDriverPrivilege	2108	lf.exe
Token: SeSystemProfilePrivilege	2108	lf.exe
Token: SeSystemtimePrivilege	2108	lf.exe
Token: SeProfSingleProcessPrivilege	2108	lf.exe
Token: SeIncBasePriorityPrivilege	2108	lf.exe
Token: SeCreatePagefilePrivilege	2108	lf.exe
Token: SeCreatePermanentPrivilege	2108	lf.exe
Token: SeBackupPrivilege	2108	lf.exe
Token: SeRestorePrivilege	2108	lf.exe
Token: SeShutdownPrivilege	2108	lf.exe
Token: SeDebugPrivilege	2108	lf.exe
Token: SeAuditPrivilege	2108	lf.exe
Token: SeSystemEnvironmentPrivilege	2108	lf.exe
Token: SeChangeNotifyPrivilege	2108	lf.exe
Token: SeRemoteShutdownPrivilege	2108	lf.exe
Token: SeUndockPrivilege	2108	lf.exe
Token: SeSyncAgentPrivilege	2108	lf.exe
Token: SeEnableDelegationPrivilege	2108	lf.exe
Token: SeManageVolumePrivilege	2108	lf.exe
Token: SeImpersonatePrivilege	2108	lf.exe
Token: SeCreateGlobalPrivilege	2108	lf.exe
Token: 31	2108	lf.exe
Token: 32	2108	lf.exe
Token: 33	2108	lf.exe
Token: 34	2108	lf.exe
Token: 35	2108	lf.exe
Token: SeDebugPrivilege	2108	lf.exe
Token: SeDebugPrivilege	1884	Server.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2108	lf.exe
2108	lf.exe
2108	lf.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1884	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	31
PID 2536 wrote to memory of 1884	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	31
PID 2536 wrote to memory of 1884	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	31
PID 2536 wrote to memory of 1884	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	31
PID 2536 wrote to memory of 2108	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	32
PID 2536 wrote to memory of 2108	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	32
PID 2536 wrote to memory of 2108	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	32
PID 2536 wrote to memory of 2108	2536	JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe	32
PID 2108 wrote to memory of 2820	2108	lf.exe	33
PID 2108 wrote to memory of 2820	2108	lf.exe	33
PID 2108 wrote to memory of 2820	2108	lf.exe	33
PID 2108 wrote to memory of 2820	2108	lf.exe	33
PID 2108 wrote to memory of 1728	2108	lf.exe	34
PID 2108 wrote to memory of 1728	2108	lf.exe	34
PID 2108 wrote to memory of 1728	2108	lf.exe	34
PID 2108 wrote to memory of 1728	2108	lf.exe	34
PID 2108 wrote to memory of 2632	2108	lf.exe	37
PID 2108 wrote to memory of 2632	2108	lf.exe	37
PID 2108 wrote to memory of 2632	2108	lf.exe	37
PID 2108 wrote to memory of 2632	2108	lf.exe	37
PID 2108 wrote to memory of 2812	2108	lf.exe	38
PID 2108 wrote to memory of 2812	2108	lf.exe	38
PID 2108 wrote to memory of 2812	2108	lf.exe	38
PID 2108 wrote to memory of 2812	2108	lf.exe	38
PID 1728 wrote to memory of 2616	1728	cmd.exe	42
PID 1728 wrote to memory of 2616	1728	cmd.exe	42
PID 1728 wrote to memory of 2616	1728	cmd.exe	42
PID 1728 wrote to memory of 2616	1728	cmd.exe	42
PID 2820 wrote to memory of 2608	2820	cmd.exe	41
PID 2820 wrote to memory of 2608	2820	cmd.exe	41
PID 2820 wrote to memory of 2608	2820	cmd.exe	41
PID 2820 wrote to memory of 2608	2820	cmd.exe	41
PID 2812 wrote to memory of 2624	2812	cmd.exe	43
PID 2812 wrote to memory of 2624	2812	cmd.exe	43
PID 2812 wrote to memory of 2624	2812	cmd.exe	43
PID 2812 wrote to memory of 2624	2812	cmd.exe	43
PID 2632 wrote to memory of 2680	2632	cmd.exe	44
PID 2632 wrote to memory of 2680	2632	cmd.exe	44
PID 2632 wrote to memory of 2680	2632	cmd.exe	44
PID 2632 wrote to memory of 2680	2632	cmd.exe	44
PID 1884 wrote to memory of 2860	1884	Server.exe	45
PID 1884 wrote to memory of 2860	1884	Server.exe	45
PID 1884 wrote to memory of 2860	1884	Server.exe	45
PID 1884 wrote to memory of 2860	1884	Server.exe	45

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7d88f1dc07795ebf10f9cb025c26df1c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 620
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2860
- C:\Users\Admin\AppData\Local\Temp\lf.exe
  "C:\Users\Admin\AppData\Local\Temp\lf.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\lf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\lf.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\lf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\lf.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lf.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lf.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lf.exe

Filesize
160KB

MD5
26f12296da8d7d93a4113d03d255c6e7

SHA1
04c423ea8b5d9a4f4ec6ca872ee3455536371a3a

SHA256
fc95ecc78c16f9fa946adfa8df03a4c5effc8f1b19b70a14d2a18530641c9739

SHA512
9fc7a593a2c2241e732053f2f0ad028eabbb3a00565e11d9f96a921345ef93a2c62e21d7c189ea25428122aa97565d6223423fccf8dc622c646ef66c5f648c6b

Download Submit
C:\Users\Admin\AppData\Roaming\WinSec.exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
116KB

MD5
905275d0ae6990d7bedbb9d73798a3dc

SHA1
c645701c8a28bc0baea626220588579793f55379

SHA256
5e92fc7ff5e192de2edb60c1a58647c00a3613ec7d6868f06de910c9bee2967a

SHA512
af3541b5d11a3faf80bdf5f3bdb508ebf4272d05099c66667062f20a46653b34c464598d9207e9b78d9cc89a53602781fed73352a3fdcc12561e4b64efdcc372

Download Submit
memory/1884-28-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-41-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-14-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-26-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/2108-52-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-50-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-30-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-51-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-60-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-42-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-44-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-46-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-47-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2108-48-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2536-31-0x0000000004870000-0x00000000048E1000-memory.dmp

Filesize
452KB

Download
memory/2536-34-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-29-0x0000000004870000-0x00000000048E1000-memory.dmp

Filesize
452KB

Download
memory/2536-0-0x0000000074731000-0x0000000074732000-memory.dmp

Filesize
4KB

Download
memory/2536-2-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-1-0x0000000074730000-0x0000000074CDB000-memory.dmp

Filesize
5.7MB

Download