dcrat | 1b42ae4ee479590709b22c88fc7e51f6bc1e87dfab3a1d0ea058dae21c494dae

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2022 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

130KB
MD5

f49ac08e35e9dfd51af32fc9ccbeac56
SHA1

76675937dd9d22f39be13a82c55f78f11b137a56
SHA256

1b42ae4ee479590709b22c88fc7e51f6bc1e87dfab3a1d0ea058dae21c494dae
SHA512

f2ce1a6fd0a24a920045ae695fab67e71c526e58fb004240456264ba4e74db6e0c0c80612ed9db957f94d71bad726c07d5b626879dbe6c18fe17da6d890d3ef3
SSDEEP

3072:K1ZrXW7JLzhKy6cpfY5sIDwa1Y/JsI9Ci1ovTB6Bf:MXW7J3YcG5o+Y/JJoir

Malware Config

Extracted

Family

djvu

http://acacaca.org/lancer/get.php

Attributes

extension
.qqkk
offline_id
0MVuBxT6o3dUivEUdhCKPfN5ljxbYptbzrFZvst1
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-USug3rryKI Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0549Jhyjd

rsa_pubkey.plain

Extracted

Family

raccoon

Botnet

8bdf02cee148823bdfbbb2b41964b926

http://185.112.83.116/

rc4.plain

Extracted

Family

socelars

https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818/

Signatures

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

file.exeC498.exe5C3B.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1235e009-9f83-4d9d-8a96-84742840175b\\C498.exe\" --AutoStart"	C498.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	5C3B.exe
1804	schtasks.exe
5692	schtasks.exe

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4572-140-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4572-143-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1972-144-0x00000000022C0000-0x00000000023DB000-memory.dmp	family_djvu
behavioral2/memory/4572-145-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4572-146-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4572-151-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1416-167-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1416-169-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1416-176-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1416-214-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/444-133-0x00000000004B0000-0x00000000004B9000-memory.dmp	family_smokeloader
behavioral2/memory/4440-265-0x00000000005F0000-0x00000000005F9000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	1928	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	1928	rundll32.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2292-270-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/4004-289-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/2292-299-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/2292-306-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 2900 created 2028	2900	svchost.exe	5C3B.exe
PID 2900 created 3140	2900	svchost.exe	csrss.exe
PID 2900 created 3140	2900	svchost.exe	csrss.exe
PID 2900 created 3140	2900	svchost.exe	csrss.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

22A9.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 22A9.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	22A9.exe

Executes dropped EXE 24 IoCs

Processes:

C498.exeC498.exeC498.exeC498.exeE4E4.exebuild2.exebuild2.exe22A9.exe3018.exe3C7C.exe3C7C.exe4EDD.exe5C3B.exe68C0.exe7052.exe798A.exe798A.exe861E.exe5C3B.execsrss.exeFA84.exeinjector.exe1C84.exe2762.exe

pid	process
1972	C498.exe
4572	C498.exe
3092	C498.exe
1416	C498.exe
2456	E4E4.exe
4484	build2.exe
4748	build2.exe
3184	22A9.exe
4440	3018.exe
2928	3C7C.exe
396	3C7C.exe
1072	4EDD.exe
2028	5C3B.exe
2292	68C0.exe
2416	7052.exe
3444	798A.exe
1480	798A.exe
4004	861E.exe
4028	5C3B.exe
3140	csrss.exe
3840	FA84.exe
3936	injector.exe
5360	1C84.exe
5652	2762.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1288 netsh.exe

pid	process
1288	netsh.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\68C0.exe	upx
C:\Users\Admin\AppData\Local\Temp\68C0.exe	upx
behavioral2/memory/2292-270-0x0000000000400000-0x000000000058E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\861E.exe	upx
C:\Users\Admin\AppData\Local\Temp\861E.exe	upx
behavioral2/memory/4004-289-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/2292-299-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/2292-306-0x0000000000400000-0x000000000058E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4EDD.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\4EDD.exe	vmprotect
behavioral2/memory/1072-254-0x0000000140000000-0x000000014068C000-memory.dmp	vmprotect
behavioral2/memory/3840-330-0x0000000140000000-0x000000014068C000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

22A9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	22A9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	22A9.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

C498.exeC498.exebuild2.exe3C7C.exe798A.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	C498.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	C498.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	3C7C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	798A.exe

Loads dropped DLL 6 IoCs

Processes:

regsvr32.exebuild2.exerundll32.exerundll32.exe

pid process

3788 regsvr32.exe
3788 regsvr32.exe
4748 build2.exe
4748 build2.exe
2312 rundll32.exe
808 rundll32.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

2796 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3788	regsvr32.exe
3788	regsvr32.exe
4748	build2.exe
4748	build2.exe
2312	rundll32.exe
808	rundll32.exe

pid	process
2796	icacls.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\22A9.exe	themida
C:\Users\Admin\AppData\Local\Temp\22A9.exe	themida
behavioral2/memory/3184-223-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida
behavioral2/memory/3184-224-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida
behavioral2/memory/3184-225-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida
behavioral2/memory/3184-226-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida
behavioral2/memory/3184-251-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida
behavioral2/memory/3184-282-0x0000000000BF0000-0x0000000001234000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

C498.exe5C3B.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1235e009-9f83-4d9d-8a96-84742840175b\\C498.exe\" --AutoStart"	C498.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	5C3B.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

22A9.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 22A9.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 api.2ip.ua
50 api.2ip.ua
57 api.2ip.ua
100 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

22A9.exe

pid process

3184 22A9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	22A9.exe

flow	ioc
49	api.2ip.ua
50	api.2ip.ua
57	api.2ip.ua
100	ip-api.com

pid	process
3184	22A9.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

C498.exeC498.exebuild2.exe

description	pid	process	target process
PID 1972 set thread context of 4572	1972	C498.exe	C498.exe
PID 3092 set thread context of 1416	3092	C498.exe	C498.exe
PID 4484 set thread context of 4748	4484	build2.exe	build2.exe

Drops file in Program Files directory 10 IoCs

Processes:

68C0.exe

description	ioc	process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	68C0.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	68C0.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	68C0.exe

Drops file in Windows directory 2 IoCs

Processes:

5C3B.exe

description ioc process

File opened for modification C:\Windows\rss 5C3B.exe
File created C:\Windows\rss\csrss.exe 5C3B.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1140 2312 WerFault.exe rundll32.exe
4824 808 WerFault.exe rundll32.exe
876 2456 WerFault.exe E4E4.exe

description	ioc	process
File opened for modification	C:\Windows\rss	5C3B.exe
File created	C:\Windows\rss\csrss.exe	5C3B.exe

pid	pid_target	process	target process
1140	2312	WerFault.exe	rundll32.exe
4824	808	WerFault.exe	rundll32.exe
876	2456	WerFault.exe	E4E4.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3018.exe7052.exefile.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7052.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3018.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3018.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7052.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1804 schtasks.exe
5692 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4168 timeout.exe

pid	process
1804	schtasks.exe
5692	schtasks.exe

pid	process
4168	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2296 taskkill.exe
4668 taskkill.exe

pid	process
2296	taskkill.exe
4668	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

5C3B.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	5C3B.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	5C3B.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	89	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	121	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
444	file.exe
444	file.exe
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3060
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

file.exe3018.exe7052.exe

pid process

444 file.exe
4440 3018.exe
2416 7052.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

4244 chrome.exe
4244 chrome.exe
4244 chrome.exe
4244 chrome.exe
4244 chrome.exe

pid	process
3060

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exeE4E4.exe68C0.exe

description	pid	process
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeDebugPrivilege	2456	E4E4.exe
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeCreateTokenPrivilege	2292	68C0.exe
Token: SeAssignPrimaryTokenPrivilege	2292	68C0.exe
Token: SeLockMemoryPrivilege	2292	68C0.exe
Token: SeIncreaseQuotaPrivilege	2292	68C0.exe
Token: SeMachineAccountPrivilege	2292	68C0.exe
Token: SeTcbPrivilege	2292	68C0.exe
Token: SeSecurityPrivilege	2292	68C0.exe
Token: SeTakeOwnershipPrivilege	2292	68C0.exe
Token: SeLoadDriverPrivilege	2292	68C0.exe
Token: SeSystemProfilePrivilege	2292	68C0.exe
Token: SeSystemtimePrivilege	2292	68C0.exe
Token: SeProfSingleProcessPrivilege	2292	68C0.exe
Token: SeIncBasePriorityPrivilege	2292	68C0.exe
Token: SeCreatePagefilePrivilege	2292	68C0.exe
Token: SeCreatePermanentPrivilege	2292	68C0.exe
Token: SeBackupPrivilege	2292	68C0.exe
Token: SeRestorePrivilege	2292	68C0.exe
Token: SeShutdownPrivilege	2292	68C0.exe
Token: SeDebugPrivilege	2292	68C0.exe
Token: SeAuditPrivilege	2292	68C0.exe
Token: SeSystemEnvironmentPrivilege	2292	68C0.exe
Token: SeChangeNotifyPrivilege	2292	68C0.exe
Token: SeRemoteShutdownPrivilege	2292	68C0.exe
Token: SeUndockPrivilege	2292	68C0.exe
Token: SeSyncAgentPrivilege	2292	68C0.exe
Token: SeEnableDelegationPrivilege	2292	68C0.exe
Token: SeManageVolumePrivilege	2292	68C0.exe
Token: SeImpersonatePrivilege	2292	68C0.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

chrome.exe

pid	process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
3060

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pid process

3060

pid	process
3060

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

C498.exeC498.exeregsvr32.exeC498.exeC498.exebuild2.exebuild2.execmd.exe

description	pid	process	target process
PID 3060 wrote to memory of 1972	3060		C498.exe
PID 3060 wrote to memory of 1972	3060		C498.exe
PID 3060 wrote to memory of 1972	3060		C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 1972 wrote to memory of 4572	1972	C498.exe	C498.exe
PID 4572 wrote to memory of 2796	4572	C498.exe	icacls.exe
PID 4572 wrote to memory of 2796	4572	C498.exe	icacls.exe
PID 4572 wrote to memory of 2796	4572	C498.exe	icacls.exe
PID 4572 wrote to memory of 3092	4572	C498.exe	C498.exe
PID 4572 wrote to memory of 3092	4572	C498.exe	C498.exe
PID 4572 wrote to memory of 3092	4572	C498.exe	C498.exe
PID 3060 wrote to memory of 3156	3060		regsvr32.exe
PID 3060 wrote to memory of 3156	3060		regsvr32.exe
PID 3156 wrote to memory of 3788	3156	regsvr32.exe	regsvr32.exe
PID 3156 wrote to memory of 3788	3156	regsvr32.exe	regsvr32.exe
PID 3156 wrote to memory of 3788	3156	regsvr32.exe	regsvr32.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3092 wrote to memory of 1416	3092	C498.exe	C498.exe
PID 3060 wrote to memory of 2456	3060		E4E4.exe
PID 3060 wrote to memory of 2456	3060		E4E4.exe
PID 3060 wrote to memory of 2456	3060		E4E4.exe
PID 1416 wrote to memory of 4484	1416	C498.exe	build2.exe
PID 1416 wrote to memory of 4484	1416	C498.exe	build2.exe
PID 1416 wrote to memory of 4484	1416	C498.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 4484 wrote to memory of 4748	4484	build2.exe	build2.exe
PID 3060 wrote to memory of 3184	3060		22A9.exe
PID 3060 wrote to memory of 3184	3060		22A9.exe
PID 3060 wrote to memory of 3184	3060		22A9.exe
PID 3060 wrote to memory of 4440	3060		3018.exe
PID 3060 wrote to memory of 4440	3060		3018.exe
PID 3060 wrote to memory of 4440	3060		3018.exe
PID 4748 wrote to memory of 3036	4748	build2.exe	cmd.exe
PID 4748 wrote to memory of 3036	4748	build2.exe	cmd.exe
PID 4748 wrote to memory of 3036	4748	build2.exe	cmd.exe
PID 3036 wrote to memory of 2296	3036	cmd.exe	taskkill.exe
PID 3036 wrote to memory of 2296	3036	cmd.exe	taskkill.exe
PID 3036 wrote to memory of 2296	3036	cmd.exe	taskkill.exe
PID 3036 wrote to memory of 4168	3036	cmd.exe	timeout.exe
PID 3036 wrote to memory of 4168	3036	cmd.exe	timeout.exe
PID 3036 wrote to memory of 4168	3036	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:444

C:\Users\Admin\AppData\Local\Temp\C498.exe
C:\Users\Admin\AppData\Local\Temp\C498.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\C498.exe
C:\Users\Admin\AppData\Local\Temp\C498.exe
2⤵
- DcRat
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\1235e009-9f83-4d9d-8a96-84742840175b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2796

C:\Users\Admin\AppData\Local\Temp\C498.exe
"C:\Users\Admin\AppData\Local\Temp\C498.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Local\Temp\C498.exe
"C:\Users\Admin\AppData\Local\Temp\C498.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe
"C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4484

C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe
"C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe" & del C:\PrograData\*.dll & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4168

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DA82.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\DA82.dll
2⤵
- Loads dropped DLL
PID:3788

C:\Users\Admin\AppData\Local\Temp\E4E4.exe
C:\Users\Admin\AppData\Local\Temp\E4E4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1220
2⤵
- Program crash
PID:876

C:\Users\Admin\AppData\Local\Temp\22A9.exe
C:\Users\Admin\AppData\Local\Temp\22A9.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3184

C:\Users\Admin\AppData\Local\Temp\3018.exe
C:\Users\Admin\AppData\Local\Temp\3018.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4440

C:\Users\Admin\AppData\Local\Temp\3C7C.exe
C:\Users\Admin\AppData\Local\Temp\3C7C.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2928

C:\Users\Admin\AppData\Local\Temp\3C7C.exe
"C:\Users\Admin\AppData\Local\Temp\3C7C.exe" -h
2⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:5024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 600
3⤵
- Program crash
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2312 -ip 2312
1⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\4EDD.exe
C:\Users\Admin\AppData\Local\Temp\4EDD.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Users\Admin\AppData\Local\Temp\5C3B.exe
C:\Users\Admin\AppData\Local\Temp\5C3B.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Local\Temp\5C3B.exe
"C:\Users\Admin\AppData\Local\Temp\5C3B.exe"
2⤵
- DcRat
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:876

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:1288

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3140

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:1804

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4820

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
PID:3936

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:5692

C:\Users\Admin\AppData\Local\Temp\68C0.exe
C:\Users\Admin\AppData\Local\Temp\68C0.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
PID:2212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f44a4f50,0x7ff9f44a4f60,0x7ff9f44a4f70
3⤵
PID:3240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:2
3⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
3⤵
PID:1816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:8
3⤵
PID:4140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
3⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
3⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
3⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
3⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:8
3⤵
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:8
3⤵
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
3⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
3⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5624 /prefetch:8
3⤵
PID:1060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
3⤵
PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
3⤵
PID:3936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:8
3⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
3⤵
PID:4820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,827410074272564697,11726806813608331032,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
3⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\7052.exe
C:\Users\Admin\AppData\Local\Temp\7052.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2416

C:\Users\Admin\AppData\Local\Temp\798A.exe
C:\Users\Admin\AppData\Local\Temp\798A.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3444

C:\Users\Admin\AppData\Local\Temp\798A.exe
"C:\Users\Admin\AppData\Local\Temp\798A.exe" -h
2⤵
- Executes dropped EXE
PID:1480

C:\Users\Admin\AppData\Local\Temp\861E.exe
C:\Users\Admin\AppData\Local\Temp\861E.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:2712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 600
3⤵
- Program crash
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 808 -ip 808
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2456 -ip 2456
1⤵
PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\FA84.exe
C:\Users\Admin\AppData\Local\Temp\FA84.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Users\Admin\AppData\Local\Temp\1C84.exe
C:\Users\Admin\AppData\Local\Temp\1C84.exe
1⤵
- Executes dropped EXE
PID:5360

C:\Users\Admin\AppData\Local\Temp\2762.exe
C:\Users\Admin\AppData\Local\Temp\2762.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png
Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js
Filesize
19KB

MD5
291fb23cb1ea646beb8ae8d8e4568962

SHA1
5aeee60b2c9d59e6de26f3fb5776730563236065

SHA256
a9ac44e4e50d2c4494744fcbf910d4d67aef6fe4b5ad2b36d76bdbacb1dc9671

SHA512
582f01a8bdb5c679db1aa1a50fad470103b7288279d87b1a38b0db43105ff1a71783872986526f03ba2b432b2bd5655a8d8eb401f745f2202cbf3f588fc8b06b

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js
Filesize
3KB

MD5
f79618c53614380c5fdc545699afe890

SHA1
7804a4621cd9405b6def471f3ebedb07fb17e90a

SHA256
f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c

SHA512
c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json
Filesize
1KB

MD5
6da6b303170ccfdca9d9e75abbfb59f3

SHA1
1a8070080f50a303f73eba253ba49c1e6d400df6

SHA256
66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

SHA512
872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

Download Submit
C:\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
97cf7fe64e53832e4f0e5f51dd17b201

SHA1
83a1efddccdacf46d30834996364ed36b8f7db3c

SHA256
151b6aa45c5c012c3904c60acac50fa66db7996dec3fe7ed3b0eb44aeb028723

SHA512
05137924c862a93baf1c4b16fb74aeb38cae901c942739bf44194741fc157d1ad47cab13a879ae92807dd0236bd2840974f3be8c2dd65fd7127b1a77a77713a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
a10bc9f101c0f166cfdc410b0a3fcefe

SHA1
50a52e5fe3de6ea5b4fb582132ea525c7cfd813d

SHA256
53ed365168b95a3b12a61d0db8707fc49aaf56b7acaea31fdbebda5a6b7f25fc

SHA512
11a6b4f13088f95d62f9681ba64fadba3cd848d04a7d2af10dc9a9db57bec30a61022aecf1ac176a89969273ce270d71a4bdf25f82c0f334b60581f4df497714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
0604bc0035192c8cb6ed12666c25d517

SHA1
5c04658a309d084b50cd98f16fa22d956151a248

SHA256
2ec3056ebab612ad4768e759847f1fdbfdb2fbc36f60375580b7e50eb0189220

SHA512
865dc8ec1acfd60a002f0aeff3e827a098759456269258751e9ce2d0cc6a8bf45122580db29561df4fcb1a9078f6254bc824b0dcadd5632c93fe58fac9f7cbba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
d703b7944febc39738d218f10b287f42

SHA1
5c4834cedc200b79606b856e1d125a9604379ea5

SHA256
21d5caa8c819513057d3a6d6e31a363b4b785c5e0354e3e2202be335a0cac40c

SHA512
970b960c4ed279bc4fb11ff69c752c6dc20e1530746fde1683a2e583352d3f4ffe4600a45fb456e6c5c2bf9b6bac0798237a29ac080b636e42c7ce3aa9449524

Download Submit
C:\Users\Admin\AppData\Local\1235e009-9f83-4d9d-8a96-84742840175b\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
e53b74bd9c08032a42f6d5470c931c26

SHA1
be56bcde5a9827bf42e9c06a5901d1b65261db69

SHA256
eaf58d0e77a8f4bed10e033c973864759caf0318b6516847091c11729bf1cc5a

SHA512
b9704349c1f66e7269aba0a39a2d9253bd68c4d875160f7c3824723aef1067fd205280d071756dc5c2ba30fa11962d01582e2d2407f30e3b8369a443b4eb8d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\22A9.exe
Filesize
5.0MB

MD5
7028a3fde9e48bcd4fbe6d8d6f6448cd

SHA1
ed1dcaa42e43fb94f0cbfcc5665eff5faac37232

SHA256
e8d744d17baf8d811f3ba156c407729d42aa205be19ef2d1a215b532eaf70d21

SHA512
cddd649b9d6f7d6a33e0e6af4d227f05283b122de7eb617ba3d79260065c3e9ca084cb5d6516b28faf6029d359c84095bc6419ef576b369780dcfa29544d7ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\22A9.exe
Filesize
5.0MB

MD5
7028a3fde9e48bcd4fbe6d8d6f6448cd

SHA1
ed1dcaa42e43fb94f0cbfcc5665eff5faac37232

SHA256
e8d744d17baf8d811f3ba156c407729d42aa205be19ef2d1a215b532eaf70d21

SHA512
cddd649b9d6f7d6a33e0e6af4d227f05283b122de7eb617ba3d79260065c3e9ca084cb5d6516b28faf6029d359c84095bc6419ef576b369780dcfa29544d7ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3018.exe
Filesize
132KB

MD5
af3ad1fe30a6b6f5bf9c02d8c6ca000f

SHA1
f2d15d30a0bdacc382efda4e5978cf54c7ca6e22

SHA256
d9b395d34550314b8d2cb416d676acb3579da85cf323aca8d3331bc3f0501bce

SHA512
c686a47221c6e3d4c59def6339c51a9fd7d7fad261650514ab2cebb856351e1de4aa0114118b3d3c4d1ba0bad2a0e4d675267f882b1d13bb8fca2dbac7af6d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\3018.exe
Filesize
132KB

MD5
af3ad1fe30a6b6f5bf9c02d8c6ca000f

SHA1
f2d15d30a0bdacc382efda4e5978cf54c7ca6e22

SHA256
d9b395d34550314b8d2cb416d676acb3579da85cf323aca8d3331bc3f0501bce

SHA512
c686a47221c6e3d4c59def6339c51a9fd7d7fad261650514ab2cebb856351e1de4aa0114118b3d3c4d1ba0bad2a0e4d675267f882b1d13bb8fca2dbac7af6d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C7C.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C7C.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C7C.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\4EDD.exe
Filesize
3.7MB

MD5
313b5dbc037492433a90ff59864e4f53

SHA1
4e4c5dbba6ca584bd476d8c2bc2dba2a371ffa1f

SHA256
9d1afde00cf422e69a1505bbd1e2b3482acbb5f16b3a3e4628d723586ba19098

SHA512
f258826532e1ede808aff4dd40d1d7916aefc297a704b74b615b33f174cb7beb5d5818d1cd6fcbb15b6bd149a4565e8cba4af74d7dba8b3af04b80a6956785e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4EDD.exe
Filesize
3.7MB

MD5
313b5dbc037492433a90ff59864e4f53

SHA1
4e4c5dbba6ca584bd476d8c2bc2dba2a371ffa1f

SHA256
9d1afde00cf422e69a1505bbd1e2b3482acbb5f16b3a3e4628d723586ba19098

SHA512
f258826532e1ede808aff4dd40d1d7916aefc297a704b74b615b33f174cb7beb5d5818d1cd6fcbb15b6bd149a4565e8cba4af74d7dba8b3af04b80a6956785e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C3B.exe
Filesize
4.0MB

MD5
e9385c0852aefe34cb6ab9569b654e8d

SHA1
f227fc30bbe02f74cc1eaa8c27906bce60431263

SHA256
0b22ca65250d3395f668fdb83ad418ac6547a418cdfbda525ef0181bd3e6f546

SHA512
a607175729d880ca2d17de02898259790e40fba0bbd8115d3b2aab4b482d13266ff4acfdaa5f283d79e7c94dda9276dba7a09296e6ae34707cf1562d06242c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C3B.exe
Filesize
4.0MB

MD5
e9385c0852aefe34cb6ab9569b654e8d

SHA1
f227fc30bbe02f74cc1eaa8c27906bce60431263

SHA256
0b22ca65250d3395f668fdb83ad418ac6547a418cdfbda525ef0181bd3e6f546

SHA512
a607175729d880ca2d17de02898259790e40fba0bbd8115d3b2aab4b482d13266ff4acfdaa5f283d79e7c94dda9276dba7a09296e6ae34707cf1562d06242c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C3B.exe
Filesize
4.0MB

MD5
e9385c0852aefe34cb6ab9569b654e8d

SHA1
f227fc30bbe02f74cc1eaa8c27906bce60431263

SHA256
0b22ca65250d3395f668fdb83ad418ac6547a418cdfbda525ef0181bd3e6f546

SHA512
a607175729d880ca2d17de02898259790e40fba0bbd8115d3b2aab4b482d13266ff4acfdaa5f283d79e7c94dda9276dba7a09296e6ae34707cf1562d06242c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\68C0.exe
Filesize
675KB

MD5
cc22b9b6e5a136dc65510aed5ce649fb

SHA1
f8b962f6031362e9b45c5e19b8f8dafccab57c62

SHA256
8dddaa3840f819a4276b6d156e9ba2cf366d0a2d42cc819c72d2cf1a683aa5c2

SHA512
2a2c77c900fe713e60d73ae7ee1d7f63921f812bbc81a367bcf82c34904a86140151e8a64d9c17152971eebe6e7a9b2aa0fa464f9c2e043646e0bfe2899548e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\68C0.exe
Filesize
675KB

MD5
cc22b9b6e5a136dc65510aed5ce649fb

SHA1
f8b962f6031362e9b45c5e19b8f8dafccab57c62

SHA256
8dddaa3840f819a4276b6d156e9ba2cf366d0a2d42cc819c72d2cf1a683aa5c2

SHA512
2a2c77c900fe713e60d73ae7ee1d7f63921f812bbc81a367bcf82c34904a86140151e8a64d9c17152971eebe6e7a9b2aa0fa464f9c2e043646e0bfe2899548e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7052.exe
Filesize
132KB

MD5
af3ad1fe30a6b6f5bf9c02d8c6ca000f

SHA1
f2d15d30a0bdacc382efda4e5978cf54c7ca6e22

SHA256
d9b395d34550314b8d2cb416d676acb3579da85cf323aca8d3331bc3f0501bce

SHA512
c686a47221c6e3d4c59def6339c51a9fd7d7fad261650514ab2cebb856351e1de4aa0114118b3d3c4d1ba0bad2a0e4d675267f882b1d13bb8fca2dbac7af6d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\7052.exe
Filesize
132KB

MD5
af3ad1fe30a6b6f5bf9c02d8c6ca000f

SHA1
f2d15d30a0bdacc382efda4e5978cf54c7ca6e22

SHA256
d9b395d34550314b8d2cb416d676acb3579da85cf323aca8d3331bc3f0501bce

SHA512
c686a47221c6e3d4c59def6339c51a9fd7d7fad261650514ab2cebb856351e1de4aa0114118b3d3c4d1ba0bad2a0e4d675267f882b1d13bb8fca2dbac7af6d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\798A.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\798A.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\798A.exe
Filesize
184KB

MD5
ae9e2ce4cf9b092a5bbfd1d5a609166e

SHA1
00c12ec16b5116403ae1a9923b114451880b741d

SHA256
ca5795709af3bc2e03ec02c7307d5c85a844c421e36afe30eb0f571e79342e87

SHA512
54727c7931293b6498e20b602da13ff48498f2f52abde5cb79a412c128cda203db11f616f22d70f37cad51d8642f5ddc8e3e761a2300545da8a0f379612f15da

Download Submit
C:\Users\Admin\AppData\Local\Temp\861E.exe
Filesize
675KB

MD5
cc22b9b6e5a136dc65510aed5ce649fb

SHA1
f8b962f6031362e9b45c5e19b8f8dafccab57c62

SHA256
8dddaa3840f819a4276b6d156e9ba2cf366d0a2d42cc819c72d2cf1a683aa5c2

SHA512
2a2c77c900fe713e60d73ae7ee1d7f63921f812bbc81a367bcf82c34904a86140151e8a64d9c17152971eebe6e7a9b2aa0fa464f9c2e043646e0bfe2899548e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\861E.exe
Filesize
675KB

MD5
cc22b9b6e5a136dc65510aed5ce649fb

SHA1
f8b962f6031362e9b45c5e19b8f8dafccab57c62

SHA256
8dddaa3840f819a4276b6d156e9ba2cf366d0a2d42cc819c72d2cf1a683aa5c2

SHA512
2a2c77c900fe713e60d73ae7ee1d7f63921f812bbc81a367bcf82c34904a86140151e8a64d9c17152971eebe6e7a9b2aa0fa464f9c2e043646e0bfe2899548e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Temp\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Temp\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Temp\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Temp\C498.exe
Filesize
650KB

MD5
d87d4c5d7873106cf0375190f600a539

SHA1
8b643438ef9b5b3bb7116dbefd1f170f3e61bfc2

SHA256
2294ab3e8ce962164118fc8a5ef2dbc2c77a305eebd07abc49862a0bad845a99

SHA512
093e85b62137af1fac08af4ffe8bbb312a46e53a6bf58f8a9913f07263bd5387a7c5df74f693f842a05296a40c0be1c87de6a554adb0b45573f889e7b943b096

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA82.dll
Filesize
1.6MB

MD5
0bd868c75f90fb59af6cd15c208118fc

SHA1
33f4815351b20a26d6dd338edcc3b1b82aeec2ec

SHA256
7e7e7bde222b4f1b95156babad17ed7c9ec60b6619052418904044083f14b54e

SHA512
ea5b4a4582bb211136e89db5b5470df041e81662856629d722cc9d9b6fc058ebab928de24af94702a5def54a65feefd7b2fff2adff120c32786a7d36c8c1db6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA82.dll
Filesize
1.6MB

MD5
0bd868c75f90fb59af6cd15c208118fc

SHA1
33f4815351b20a26d6dd338edcc3b1b82aeec2ec

SHA256
7e7e7bde222b4f1b95156babad17ed7c9ec60b6619052418904044083f14b54e

SHA512
ea5b4a4582bb211136e89db5b5470df041e81662856629d722cc9d9b6fc058ebab928de24af94702a5def54a65feefd7b2fff2adff120c32786a7d36c8c1db6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA82.dll
Filesize
1.6MB

MD5
0bd868c75f90fb59af6cd15c208118fc

SHA1
33f4815351b20a26d6dd338edcc3b1b82aeec2ec

SHA256
7e7e7bde222b4f1b95156babad17ed7c9ec60b6619052418904044083f14b54e

SHA512
ea5b4a4582bb211136e89db5b5470df041e81662856629d722cc9d9b6fc058ebab928de24af94702a5def54a65feefd7b2fff2adff120c32786a7d36c8c1db6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E4E4.exe
Filesize
241KB

MD5
7b8abbb2031e8195835b00ba184ffa4e

SHA1
8d2f48892d2dc0254972b00262a086272e367fb2

SHA256
81a3933a84fa92f1d1f5aedd09a45f62fb1f0db9abbd0f82c35ae1a17624be4b

SHA512
0929e3e5f96bc12d9adbf828086728def39f6e9b692869aac67a49c2fc29228fcaeb29d3468d9a99e77fa7163c640a2c6098ff210d600f8db6c52df04d247e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E4E4.exe
Filesize
241KB

MD5
7b8abbb2031e8195835b00ba184ffa4e

SHA1
8d2f48892d2dc0254972b00262a086272e367fb2

SHA256
81a3933a84fa92f1d1f5aedd09a45f62fb1f0db9abbd0f82c35ae1a17624be4b

SHA512
0929e3e5f96bc12d9adbf828086728def39f6e9b692869aac67a49c2fc29228fcaeb29d3468d9a99e77fa7163c640a2c6098ff210d600f8db6c52df04d247e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat
Filesize
557KB

MD5
720ec3d97f3cd9e1dc34b7ad51451892

SHA1
8c417926a14a0cd2d268d088658022f49e3dda4b

SHA256
6c05e113ed295140f979f4a8864eac92e119e013e74e6ed3d849a66217e34c6a

SHA512
0d681247d1f7f5932779da58d59de2dd0e01e904acc8702bea93676f029b2dd0745b961f833d49ef4a6af712a3a3ba51364533741cd605d39442fe2993279dee

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat
Filesize
557KB

MD5
720ec3d97f3cd9e1dc34b7ad51451892

SHA1
8c417926a14a0cd2d268d088658022f49e3dda4b

SHA256
6c05e113ed295140f979f4a8864eac92e119e013e74e6ed3d849a66217e34c6a

SHA512
0d681247d1f7f5932779da58d59de2dd0e01e904acc8702bea93676f029b2dd0745b961f833d49ef4a6af712a3a3ba51364533741cd605d39442fe2993279dee

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe
Filesize
367KB

MD5
48561700f2246230d542766b6a140212

SHA1
59d9c56afcb66b45cad6ee437894ce42a5062d7b

SHA256
a018edd12284d1cdcc235a08ba5da37d3da1d8e886b96c34f1dd8bf7fa41c544

SHA512
6dca867cdf1890b13d33760801de1f779849a66c68deae3cf739f4b2da34fe2185b8b48478ea4fcddfbe8ffb03da219a1c56288e4d146cdd6db9aa2ac093d4c1

Download Submit
C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe
Filesize
367KB

MD5
48561700f2246230d542766b6a140212

SHA1
59d9c56afcb66b45cad6ee437894ce42a5062d7b

SHA256
a018edd12284d1cdcc235a08ba5da37d3da1d8e886b96c34f1dd8bf7fa41c544

SHA512
6dca867cdf1890b13d33760801de1f779849a66c68deae3cf739f4b2da34fe2185b8b48478ea4fcddfbe8ffb03da219a1c56288e4d146cdd6db9aa2ac093d4c1

Download Submit
C:\Users\Admin\AppData\Local\bb8ea9bf-4c18-4ec5-a527-26c3497e8fae\build2.exe
Filesize
367KB

MD5
48561700f2246230d542766b6a140212

SHA1
59d9c56afcb66b45cad6ee437894ce42a5062d7b

SHA256
a018edd12284d1cdcc235a08ba5da37d3da1d8e886b96c34f1dd8bf7fa41c544

SHA512
6dca867cdf1890b13d33760801de1f779849a66c68deae3cf739f4b2da34fe2185b8b48478ea4fcddfbe8ffb03da219a1c56288e4d146cdd6db9aa2ac093d4c1

Download Submit
\??\pipe\crashpad_4244_CYQZCBQVMHTIPKNC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/396-242-0x0000000000000000-mapping.dmp

Download
memory/444-135-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/444-133-0x00000000004B0000-0x00000000004B9000-memory.dmp

Filesize
36KB

Download
memory/444-132-0x00000000004DA000-0x00000000004EB000-memory.dmp

Filesize
68KB

Download
memory/444-134-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/808-296-0x0000000000000000-mapping.dmp

Download
memory/876-323-0x0000000000000000-mapping.dmp

Download
memory/1072-254-0x0000000140000000-0x000000014068C000-memory.dmp

Filesize
6.5MB

Download
memory/1072-248-0x0000000000000000-mapping.dmp

Download
memory/1288-325-0x0000000000000000-mapping.dmp

Download
memory/1416-214-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1416-169-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1416-176-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1416-164-0x0000000000000000-mapping.dmp

Download
memory/1416-167-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1480-280-0x0000000000000000-mapping.dmp

Download
memory/1804-336-0x0000000000000000-mapping.dmp

Download
memory/1972-136-0x0000000000000000-mapping.dmp

Download
memory/1972-142-0x000000000207B000-0x000000000210D000-memory.dmp

Filesize
584KB

Download
memory/1972-144-0x00000000022C0000-0x00000000023DB000-memory.dmp

Filesize
1.1MB

Download
memory/2028-293-0x0000000001700000-0x0000000001F76000-memory.dmp

Filesize
8.5MB

Download
memory/2028-302-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/2028-260-0x0000000000000000-mapping.dmp

Download
memory/2028-294-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/2028-292-0x0000000001314000-0x00000000016FD000-memory.dmp

Filesize
3.9MB

Download
memory/2212-274-0x0000000000000000-mapping.dmp

Download
memory/2292-267-0x0000000000000000-mapping.dmp

Download
memory/2292-270-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/2292-299-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/2292-306-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/2296-234-0x0000000000000000-mapping.dmp

Download
memory/2312-245-0x0000000000000000-mapping.dmp

Download
memory/2416-271-0x0000000000000000-mapping.dmp

Download
memory/2416-318-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2416-305-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2416-304-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/2456-309-0x0000000008270000-0x00000000082C0000-memory.dmp

Filesize
320KB

Download
memory/2456-290-0x0000000006540000-0x00000000065D2000-memory.dmp

Filesize
584KB

Download
memory/2456-252-0x00000000051B0000-0x00000000057C8000-memory.dmp

Filesize
6.1MB

Download
memory/2456-175-0x0000000000000000-mapping.dmp

Download
memory/2456-257-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/2456-307-0x0000000007AD0000-0x0000000007C92000-memory.dmp

Filesize
1.8MB

Download
memory/2456-261-0x00000000059A0000-0x00000000059DC000-memory.dmp

Filesize
240KB

Download
memory/2456-308-0x0000000007CA0000-0x00000000081CC000-memory.dmp

Filesize
5.2MB

Download
memory/2456-238-0x0000000004BB0000-0x0000000005154000-memory.dmp

Filesize
5.6MB

Download
memory/2456-284-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/2456-291-0x0000000006760000-0x000000000677E000-memory.dmp

Filesize
120KB

Download
memory/2456-253-0x0000000005840000-0x0000000005852000-memory.dmp

Filesize
72KB

Download
memory/2456-286-0x0000000006480000-0x00000000064F6000-memory.dmp

Filesize
472KB

Download
memory/2456-217-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2456-216-0x0000000000760000-0x0000000000799000-memory.dmp

Filesize
228KB

Download
memory/2456-235-0x000000000080D000-0x0000000000839000-memory.dmp

Filesize
176KB

Download
memory/2456-236-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2456-215-0x000000000080D000-0x0000000000839000-memory.dmp

Filesize
176KB

Download
memory/2456-316-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2796-147-0x0000000000000000-mapping.dmp

Download
memory/2928-239-0x0000000000000000-mapping.dmp

Download
memory/3036-232-0x0000000000000000-mapping.dmp

Download
memory/3092-168-0x00000000021B8000-0x000000000224A000-memory.dmp

Filesize
584KB

Download
memory/3092-149-0x0000000000000000-mapping.dmp

Download
memory/3140-327-0x0000000000000000-mapping.dmp

Download
memory/3140-335-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/3140-334-0x0000000001700000-0x0000000001AE9000-memory.dmp

Filesize
3.9MB

Download
memory/3156-152-0x0000000000000000-mapping.dmp

Download
memory/3184-256-0x0000000077770000-0x0000000077913000-memory.dmp

Filesize
1.6MB

Download
memory/3184-220-0x0000000000000000-mapping.dmp

Download
memory/3184-228-0x0000000077770000-0x0000000077913000-memory.dmp

Filesize
1.6MB

Download
memory/3184-282-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3184-283-0x0000000077770000-0x0000000077913000-memory.dmp

Filesize
1.6MB

Download
memory/3184-226-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3184-225-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3184-251-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3184-224-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3184-223-0x0000000000BF0000-0x0000000001234000-memory.dmp

Filesize
6.3MB

Download
memory/3444-277-0x0000000000000000-mapping.dmp

Download
memory/3788-183-0x0000000002960000-0x0000000002A06000-memory.dmp

Filesize
664KB

Download
memory/3788-157-0x00000000023F0000-0x000000000258A000-memory.dmp

Filesize
1.6MB

Download
memory/3788-163-0x0000000000FB0000-0x0000000000FB6000-memory.dmp

Filesize
24KB

Download
memory/3788-182-0x00000000028A0000-0x000000000295B000-memory.dmp

Filesize
748KB

Download
memory/3788-159-0x00000000023F0000-0x000000000258A000-memory.dmp

Filesize
1.6MB

Download
memory/3788-154-0x0000000000000000-mapping.dmp

Download
memory/3840-329-0x0000000000000000-mapping.dmp

Download
memory/3840-330-0x0000000140000000-0x000000014068C000-memory.dmp

Filesize
6.5MB

Download
memory/3936-338-0x0000000000000000-mapping.dmp

Download
memory/4004-289-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/4004-285-0x0000000000000000-mapping.dmp

Download
memory/4028-324-0x00000000011CB000-0x00000000015B4000-memory.dmp

Filesize
3.9MB

Download
memory/4028-300-0x0000000000000000-mapping.dmp

Download
memory/4028-328-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/4028-326-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/4168-237-0x0000000000000000-mapping.dmp

Download
memory/4440-264-0x00000000004CB000-0x00000000004DC000-memory.dmp

Filesize
68KB

Download
memory/4440-275-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4440-229-0x0000000000000000-mapping.dmp

Download
memory/4440-265-0x00000000005F0000-0x00000000005F9000-memory.dmp

Filesize
36KB

Download
memory/4440-266-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4484-179-0x0000000000000000-mapping.dmp

Download
memory/4484-187-0x0000000002490000-0x00000000024D9000-memory.dmp

Filesize
292KB

Download
memory/4484-186-0x0000000000A0A000-0x0000000000A36000-memory.dmp

Filesize
176KB

Download
memory/4484-192-0x0000000000A0A000-0x0000000000A36000-memory.dmp

Filesize
176KB

Download
memory/4572-139-0x0000000000000000-mapping.dmp

Download
memory/4572-151-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4572-145-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4572-143-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4572-146-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4572-140-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4668-276-0x0000000000000000-mapping.dmp

Download
memory/4748-189-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4748-195-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4748-194-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4748-193-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4748-227-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4748-191-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4748-188-0x0000000000000000-mapping.dmp

Download
memory/4748-233-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4820-337-0x0000000000000000-mapping.dmp

Download
memory/5360-339-0x0000000000000000-mapping.dmp

Download
memory/5652-340-0x0000000000000000-mapping.dmp

Download
memory/5692-341-0x0000000000000000-mapping.dmp

Download
memory/5748-342-0x0000000000000000-mapping.dmp

Download