darkcomet | 9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318

Resubmissions

28/10/2022, 17:48

221028-wds3fshdhq 10

28/10/2022, 17:45

221028-wbwesshchp 1

Analysis

max time kernel
637s
max time network
645s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 17:48

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

new calc.bin.zip
Size

1.1MB
MD5

86293673d26bf1147c4d30b788a8daf1
SHA1

113e557deaa3602893bdd50ffb4ac9880cc20d79
SHA256

9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318
SHA512

65a4d09416e6898c18bb91c80c666e47ae57b3a5f0cf4827f9602392a648e1f39984945e0b4706c906af15c06244da1bded9eae92356f95a8b7ec697037759ea
SSDEEP

24576:UGIllGQbztkD3hqAYZg7PEtMJa7Wz9XypI1DWF64xDsFae:7IlN/yDRDDEtMJLNyQWF64eFp

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

dc2012.ddns.net:77

Mutex

DC_MUTEX-F666ELN

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
M472kUGFekzF
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	STUB.EXE

Executes dropped EXE 4 IoCs

pid	Process
2620	new calc.exe
1184	ESBCALCPORT.EXE
2828	STUB.EXE
2152	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2864	attrib.exe
2920	attrib.exe

Loads dropped DLL 5 IoCs

pid	Process
2620	new calc.exe
2620	new calc.exe
2620	new calc.exe
2828	STUB.EXE
2828	STUB.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	STUB.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*Restore = "C:\\Windows\\System32\\rstrui.exe /runonce"	rstrui.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
72	freegeoip.app

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	STUB.EXE
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	STUB.EXE
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	STUB.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	rstrui.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16A091E1-56FA-11ED-8B0A-7A3897842414} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2016	chrome.exe
548	chrome.exe
548	chrome.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2552	chrome.exe
2660	chrome.exe
548	chrome.exe
548	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2532	rstrui.exe
2152	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1700	AUDIODG.EXE
Token: 33	1700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1700	AUDIODG.EXE
Token: SeDebugPrivilege	2152	taskmgr.exe
Token: SeRestorePrivilege	904	7zFM.exe
Token: 35	904	7zFM.exe
Token: SeSecurityPrivilege	904	7zFM.exe
Token: SeIncreaseQuotaPrivilege	2828	STUB.EXE
Token: SeSecurityPrivilege	2828	STUB.EXE
Token: SeTakeOwnershipPrivilege	2828	STUB.EXE
Token: SeLoadDriverPrivilege	2828	STUB.EXE
Token: SeSystemProfilePrivilege	2828	STUB.EXE
Token: SeSystemtimePrivilege	2828	STUB.EXE
Token: SeProfSingleProcessPrivilege	2828	STUB.EXE
Token: SeIncBasePriorityPrivilege	2828	STUB.EXE
Token: SeCreatePagefilePrivilege	2828	STUB.EXE
Token: SeBackupPrivilege	2828	STUB.EXE
Token: SeRestorePrivilege	2828	STUB.EXE
Token: SeShutdownPrivilege	2828	STUB.EXE
Token: SeDebugPrivilege	2828	STUB.EXE
Token: SeSystemEnvironmentPrivilege	2828	STUB.EXE
Token: SeChangeNotifyPrivilege	2828	STUB.EXE
Token: SeRemoteShutdownPrivilege	2828	STUB.EXE
Token: SeUndockPrivilege	2828	STUB.EXE
Token: SeManageVolumePrivilege	2828	STUB.EXE
Token: SeImpersonatePrivilege	2828	STUB.EXE
Token: SeCreateGlobalPrivilege	2828	STUB.EXE
Token: 33	2828	STUB.EXE
Token: 34	2828	STUB.EXE
Token: 35	2828	STUB.EXE
Token: SeIncreaseQuotaPrivilege	2152	msdcsc.exe
Token: SeSecurityPrivilege	2152	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2152	msdcsc.exe
Token: SeLoadDriverPrivilege	2152	msdcsc.exe
Token: SeSystemProfilePrivilege	2152	msdcsc.exe
Token: SeSystemtimePrivilege	2152	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2152	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2152	msdcsc.exe
Token: SeCreatePagefilePrivilege	2152	msdcsc.exe
Token: SeBackupPrivilege	2152	msdcsc.exe
Token: SeRestorePrivilege	2152	msdcsc.exe
Token: SeShutdownPrivilege	2152	msdcsc.exe
Token: SeDebugPrivilege	2152	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2152	msdcsc.exe
Token: SeChangeNotifyPrivilege	2152	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2152	msdcsc.exe
Token: SeUndockPrivilege	2152	msdcsc.exe
Token: SeManageVolumePrivilege	2152	msdcsc.exe
Token: SeImpersonatePrivilege	2152	msdcsc.exe
Token: SeCreateGlobalPrivilege	2152	msdcsc.exe
Token: 33	2152	msdcsc.exe
Token: 34	2152	msdcsc.exe
Token: 35	2152	msdcsc.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeBackupPrivilege	1000	wbengine.exe
Token: SeRestorePrivilege	1000	wbengine.exe
Token: SeSecurityPrivilege	1000	wbengine.exe
Token: SeBackupPrivilege	2484	vssvc.exe
Token: SeRestorePrivilege	2484	vssvc.exe
Token: SeAuditPrivilege	2484	vssvc.exe
Token: SeBackupPrivilege	2532	rstrui.exe
Token: SeRestorePrivilege	2532	rstrui.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
548	chrome.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
2152	taskmgr.exe
548	chrome.exe
548	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	chrome.exe
2152	msdcsc.exe
2960	iexplore.exe
2960	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1292	548	chrome.exe	30
PID 548 wrote to memory of 1292	548	chrome.exe	30
PID 548 wrote to memory of 1292	548	chrome.exe	30
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 1840	548	chrome.exe	31
PID 548 wrote to memory of 2016	548	chrome.exe	32
PID 548 wrote to memory of 2016	548	chrome.exe	32
PID 548 wrote to memory of 2016	548	chrome.exe	32
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33
PID 548 wrote to memory of 804	548	chrome.exe	33

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2864	attrib.exe
2920	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\new calc.bin.zip"
1⤵
PID:1088

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c74f50,0x7fef5c74f60,0x7fef5c74f70
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1680 /prefetch:8
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1132 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3836 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,12109072743731311573,17840917481579128920,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:2320

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2152

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:456

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\new calc.bin.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Users\Admin\AppData\Local\Temp\new calc.exe
"C:\Users\Admin\AppData\Local\Temp\new calc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620
- C:\Users\Admin\AppData\Roaming\ESBCALCPORT.EXE
  "C:\Users\Admin\AppData\Roaming\ESBCALCPORT.EXE"
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2824
- C:\Users\Admin\AppData\Roaming\STUB.EXE
  "C:\Users\Admin\AppData\Roaming\STUB.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\STUB.EXE" +s +h
    3⤵
    PID:2120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Roaming\STUB.EXE" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h
    3⤵
    PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Roaming" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2864
- - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
    "C:\Windows\system32\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:1916
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://192.168.1.1/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c74f50,0x7fef5c74f60,0x7fef5c74f70
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1116,3292626790499390682,5298296990167431803,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1352 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,3292626790499390682,5298296990167431803,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1128 /prefetch:2
  2⤵
  PID:2480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c74f50,0x7fef5c74f60,0x7fef5c74f70
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1120,7008818337305225879,3975814323543803410,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1288 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,7008818337305225879,3975814323543803410,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1136 /prefetch:2
  2⤵
  PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c74f50,0x7fef5c74f60,0x7fef5c74f70
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1072,6438690897741789033,17875548828149900502,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1140 /prefetch:2
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,6438690897741789033,17875548828149900502,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1352 /prefetch:8
  2⤵
  PID:2780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="560.0.2014137362\532343448" -parentBuildID 20200403170909 -prefsHandle 1156 -prefMapHandle 1148 -prefsLen 1 -prefMapSize 219796 -appdir "C:\Program Files\Mozilla Firefox\browser" - 560 "\\.\pipe\gecko-crash-server-pipe.560" 1232 gpu
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="560.3.602615801\1043693148" -childID 1 -isForBrowser -prefsHandle 1628 -prefMapHandle 1556 -prefsLen 156 -prefMapSize 219796 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 560 "\\.\pipe\gecko-crash-server-pipe.560" 1528 tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="560.13.351555535\1910021477" -childID 2 -isForBrowser -prefsHandle 2616 -prefMapHandle 2612 -prefsLen 6938 -prefMapSize 219796 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 560 "\\.\pipe\gecko-crash-server-pipe.560" 2628 tab
    3⤵
    PID:2036

C:\Windows\system32\rstrui.exe
"C:\Windows\system32\rstrui.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2664

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004B8" "0000000000000590"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1964

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:916

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\ImportSubmit.wmv

Filesize
1.2MB

MD5
6207acd2a2d2594b0cb4a43b3de353c6

SHA1
cda3b3b79fe7dabbad68c471d61709774f51e10f

SHA256
ab61e3e2c057fe3246e53e73f63c8af8d2f1e09ed2b53f71a87a8ef22491493e

SHA512
436d9e19b8200d3233d3bdee6265c4cbdde8f78123367c1b39f59d165c52210afcb34151a91c21a909be6f54fc7fbd34a43b6c4068ad4e235d46564519a95218

Download Submit
C:\Users\Admin\Desktop\MountPing.ppt

Filesize
393KB

MD5
d33bab492dd274f10264d61edf35b03a

SHA1
625baf68535f095f5ced833ee6ed15a7fe6ec47e

SHA256
e28e5af55442a2ce78a529f3b45e93f0aba66f13d8455f901e7ade0776bcdd40

SHA512
f37ca26fc479fe65799679a4bd7e3994710f26c860bf784c312fdff87a68297cfff5fa3a7ff14e12251bd6781416636e750a5a6f05b09dc1c52e27f6df25e965

Download Submit
C:\Users\Admin\Desktop\OutInstall.ods

Filesize
842KB

MD5
97c0e62a83930035cc372b7a58d24e5f

SHA1
7bb1471fc0b4c1bc9142f131272d946afc4e08c0

SHA256
8e59a08893321abd3698247486c0f97bc8cf86b1f3923b84b9a2ef2005d021c5

SHA512
565522d0b6c6447340fc510de0da0eb49247774759e07db34d7438b27e90a4b9a7ac030519d4131ed7ed65736842705a315b695aac7ff18907eab1cd58f07e20

Download Submit
C:\Users\Admin\Desktop\ProtectBlock.jfif

Filesize
865KB

MD5
650f32ca2609789d85636737b1e7d42b

SHA1
3015580c7fb813752d9837a08f567532cf26daa6

SHA256
f588f64c637dbd21183f278bc2db7fc48b79b8321fff82436f86ce36d39cb188

SHA512
418a813da17b7ac0be60b50e3ae649cf4c8c41292cd91916d367624b8386aa36564433719a8684553c15c29a6338f53419eb9abcc007241760079f981deb1541

Download Submit
C:\Users\Admin\Desktop\PublishSync.htm

Filesize
685KB

MD5
5666afb8f5b1903085fd83f84f42b205

SHA1
e7dfabe563dc05b17805148116a78883b0a15ac1

SHA256
a04d7e21f7a8e810a178abe314bd7bf36a62ea2b857a7012e247a2c3999ba511

SHA512
400bedb2821c4e04a8487874e60b204f30cb93b11573d34106fd5b7980b3bb5c79b925771e0ac4bb7e2f1f35b1e326b25e53fee9b520fd69ea1fd0a76a235f63

Download Submit
C:\Users\Admin\Desktop\PublishSync.htm

Filesize
685KB

MD5
5666afb8f5b1903085fd83f84f42b205

SHA1
e7dfabe563dc05b17805148116a78883b0a15ac1

SHA256
a04d7e21f7a8e810a178abe314bd7bf36a62ea2b857a7012e247a2c3999ba511

SHA512
400bedb2821c4e04a8487874e60b204f30cb93b11573d34106fd5b7980b3bb5c79b925771e0ac4bb7e2f1f35b1e326b25e53fee9b520fd69ea1fd0a76a235f63

Download Submit
C:\Users\Admin\Desktop\RedoBlock.mht

Filesize
505KB

MD5
c3146a8f1dc3ae854fd08f5f58f25863

SHA1
a46c34c851b68c9c8d950fa70f2488cffcdf7f40

SHA256
2dad0c3eea6d667ff12c7439ebc6447309c251b1ae1c31cbab3f560c4fd58bcb

SHA512
2cd0db47162160a7c8ddf7212019852ffb35a743114e4afd110cfd76f567dcd2f1a62866e95781138b5949072f3bd134fa7223b4b678edad119e6c4489bb12f4

Download Submit
C:\Users\Admin\Desktop\RenameDebug.pdf

Filesize
303KB

MD5
be5c43d299315cecc965a4384e51a7c5

SHA1
d3cf6adf98304a635df7d887a9791435353a4d63

SHA256
b1996e909e4cd7c319e82242de233c84cc6a731a6d4e08b04bf06c65f4ad1277

SHA512
19a78e2d9b7ff9808e0a07f2087b9592474d2973ba5f100684d013b2666c3190ec549c83f633b279a45b0ee496423dca4f83163add816e6f4bd71c2c93e19449

Download Submit
C:\Users\Admin\Desktop\RestoreGrant.tiff

Filesize
820KB

MD5
df1354b46722fa9e26cc339408e5b197

SHA1
a2f5e413f71126e9efc355d54a06590f924d5e61

SHA256
fbb56107ef23f543f93e901fd8d9c43a091ca27b01772fea78da8cd981ed25b6

SHA512
6e98851fa192faabe65a47c3855a55d4ff016b5cd2e4ab872456f70365b5f05ed7a19fa2ed066a3eb81746d39c627f88e8ded6e22f829b9823641558f9c30f45

Download Submit
C:\Users\Admin\Desktop\RestoreGrant.tiff

Filesize
820KB

MD5
df1354b46722fa9e26cc339408e5b197

SHA1
a2f5e413f71126e9efc355d54a06590f924d5e61

SHA256
fbb56107ef23f543f93e901fd8d9c43a091ca27b01772fea78da8cd981ed25b6

SHA512
6e98851fa192faabe65a47c3855a55d4ff016b5cd2e4ab872456f70365b5f05ed7a19fa2ed066a3eb81746d39c627f88e8ded6e22f829b9823641558f9c30f45

Download Submit
C:\Users\Admin\Desktop\SendEnter.cr2

Filesize
573KB

MD5
cd430a408e6d6572869a74da514589f3

SHA1
fda458059eafb1f222ed259001bdd63c56cea974

SHA256
19e2f803dcec76f7d8bae984115a5a1fbc849cf8762f18338f0fedcc7c10e98d

SHA512
ca25222b505ea25fbb2a836bca5950072845e7c257d6935e0633d37455777fbd2f56d2fcc34c4423a86b88dc455728acb2b2eaabafddf6dd34c983c42dc0348f

Download Submit
C:\Users\Admin\Desktop\SkipCompress.wdp

Filesize
595KB

MD5
fe603a60daf92792dbee6c029637c4cd

SHA1
c551dfdaee8cffa4968170833e57c0417077f0c5

SHA256
afb5d4204ea64728a1c4efe2b8c75988bb1e57537a752ec7f958ae93079118ae

SHA512
6e4b4525433e7b635bcc3f39326fb590834665c03a8e0e3eaa24792ce8427038ec6e60bba29901ebd4f8fe329d49bfeda75b7c590f24277e00f16501e5a96f58

Download Submit
C:\Users\Admin\Desktop\UndoReset.css

Filesize
325KB

MD5
778f073514bb3dea1acd3dec8e99e292

SHA1
cd42b103910d805938554dbdd6c92a4ececaa32e

SHA256
ea5e62c893ad9ffc452e385aa7bb1412728cda9b1b9a02a4cf9fe3d434bffe55

SHA512
79bf09f4226c61867d9ec976c4ceeed93e9921ca77610593f25a04ac860400f633c6146649c5a6cd7f74faf2374a6a1aa77cb8547493e44d3436a660e6bb7586

Download Submit
C:\Users\Admin\Desktop\UnregisterClear.csv

Filesize
528KB

MD5
85cd6e31c1fffe6fc9cdbd7587c1a44f

SHA1
1d9c2e8672578c13dd71217c7e102b611926824a

SHA256
41ac0d5641ba55e884a000b2516ffab99fc3af667a87cb9dab3a7c22ae6fd34e

SHA512
508bc5082ca6733d7882654949932664977110727ee6bc08df0dba834442fa1f0fc446ce74de4700703e08afab60fbc2d920a1db538f52004b813da1b6aced43

Download Submit
C:\Users\Admin\Desktop\UseUndo.m3u

Filesize
348KB

MD5
99a1384767ad619ef7302d4e9b756c53

SHA1
58e4d2530208347aee91e505bbb86c83e4b85233

SHA256
917340ccf9c467a83406dab45dffec45b651e4e23fca5f62b5ef19ac219d7306

SHA512
cb33f45f1fe54004a98151be59674e785dd198901eddc5a3defd9f0e25e87cc0344b3118b4d0b0e62456b093e78e61bf9d1d39d08f3171423bcb967a2876af64

Download Submit
C:\Users\Admin\Documents\CompleteFormat.pot

Filesize
705KB

MD5
3787dd18a9d8933d2251129cc356e116

SHA1
ee954356761a1d9ef60ead13c9c6315711eaa552

SHA256
844cac9e5da719a21ffebfe14184b77a242780b167b605fbf40e931c28067e3e

SHA512
cea54ab69fbfc71d0f33539208861864a0ab593096b02c6e45836dca567b8d263835a51fff87c328848d70ef10151de735fb87c19387b44ed53d64f748982948

Download Submit
C:\Users\Admin\Documents\CompleteShow.pub

Filesize
527KB

MD5
fcabd82e1b3ca78c3352d385dd8315b1

SHA1
331765013010b38bbf23fa7f9efe72b7d3f8e9de

SHA256
36316258da6ab9e4adf3315dd8e0df6c7ebff5998f977a9e98055c059d3890c7

SHA512
3ccfc655d4d8dad9922821379f479ffdba58bd48b2bb559fc4dc767bf8e9d5119d7685493fecb3232e3b60f12fcce71b033bc09e3f4a8b3fe160f4dab9e6563c

Download Submit
C:\Users\Admin\Documents\ConvertToSubmit.dot

Filesize
812KB

MD5
6c54f21e250ea46cbabe7f5cd96f7dd2

SHA1
48d1ebbf7647ddab47e6508a52727bc3167fa8fe

SHA256
dfa5af0518e4d27e81fdd5592df1dd5ae2f977e6799b4e5e97d28eadb4bfaae3

SHA512
604da7e346f02ca97a584d1dc762990eece9f5545da38895b54d261eef31e3b4affae610c995f0934ff25fcbc030ef206fb5f0563baa3e325d3f88e37240142b

Download Submit
C:\Users\Admin\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\Documents\FormatClose.xla

Filesize
759KB

MD5
6162b01408c76fef2198b2a26b38a622

SHA1
8781af5813b979e86225acd79564ca1a3a544ab6

SHA256
b6d01b1e3acbd472c2fbde466c761d418cf114a17364c4c95c70adf32a1b3c64

SHA512
aba8cae18a66fdd92274c831b1a234abf4de3e35bc01b22711a5206c7f013852d8839eed02d51ea5e021c3bda16c71ecae241d118d3205a287f3713767f97b91

Download Submit
C:\Users\Admin\Documents\InitializeGrant.potx

Filesize
473KB

MD5
c8a8e57cf85078a21d39a8acf9f07106

SHA1
9c81e6ff3a5db1dcea48e7724be636d06cca6588

SHA256
ce8de190004459484913caf076c19f9e55710b6127a645ab4a2b0a9da851eb4d

SHA512
9abf76411656be45b504b9f6612b4c607f8a033e8fd25386cf578379667cbba809d24f484b58570584f619c4fb357775708983f2e81435b764b66df21a6d0375

Download Submit
C:\Users\Admin\Documents\InitializeReceive.pptm

Filesize
419KB

MD5
f064c15df65d2eaba46fb2f97b250bed

SHA1
6014b3435807e7bcf600462b92dc859c8242a699

SHA256
24c08cbd73033a34a01ae4cf73d2e9e5b8e7f7730055a732d4194ecfdc6df2d4

SHA512
184347101dccccb095711603eab45c8b0a120df9ea96ffd6518d4647cb9e085c6684f38468cf41504bc37de61b1a74ddfe0d86bae621acb0284ca27d998aa53f

Download Submit
C:\Users\Admin\Documents\InvokeFind.xlsb

Filesize
437KB

MD5
337e7dd3e2913b6e2a23e723e03e8dee

SHA1
393f10de16c93ab8fed9bf8036cd6923a16857e0

SHA256
43fa39c7751c23ad6876580f842705ce2d25ebb87e4faa71ae7882c8a724f348

SHA512
e63ce88ca31aa1364469eaa52685be5e7312b156ee95d2dc561c524160bc9092175558464cba538388a292e8f2f854882bbfc135656cfef4ed89863d72e26226

Download Submit
C:\Users\Admin\Documents\MergeSave.pot

Filesize
616KB

MD5
722eb9b76e5c883b8e3a3401fa0e08a1

SHA1
c2c4a916a4771da6025c0a6e97dc936877f3d00c

SHA256
08f46a453d55c41934ef18cc44c304865d2bacfe3ad7a00afa4ec63bf8753eb7

SHA512
f3e85d172566f318ea0b0d916e2942db0738869ff622068219818317269294e55db618ad0f9756973f7371ff99348c5957108e2230e522480bde11a2e8d782f4

Download Submit
C:\Users\Admin\Documents\MountGroup.vssx

Filesize
562KB

MD5
9b685825b3ea7b2950516aba4ce5e18d

SHA1
92885e209ed66f8223f56932109112024c93cbbc

SHA256
8eb143be6c77000bcfed5122f86a27b6b5ae188d442af6c870cf936d859d1388

SHA512
b470e4b523b6f49c52d218bf27a5715ae86b442c7a0fb1318ed2512036c2201dca6efdb35c702fbdb3f115e598f3c69551467c1c30fa87a27e59261e14209eff

Download Submit
C:\Users\Admin\Documents\NewMove.mhtml

Filesize
687KB

MD5
8839b0eb5d96a406894d3e5e280219dc

SHA1
47e6ab5d886d6357b4dbd74d23bdbfd7f8860ece

SHA256
b3af01dabae255c342ac6de0615734b0de06bf6926f8b51de16e19cc1f901498

SHA512
3ce38ca7d52c50473ebdd8505838c8f259a14598ea3924458bdf27dfc5fa12802b9f563e38ff0927a249c4df72816de95f6b28cfcc7a4cae19246df0f563f3f1

Download Submit
C:\Users\Admin\Downloads\BackupSync.shtml

Filesize
673KB

MD5
3e3846103bb62247791c86695c5b7fab

SHA1
d3ea6bce66493e4a6220322f6ee2a2d2271c7525

SHA256
8bae1543374eb90784aefb98501d993a6350dbfd92df6b35de7ae0b5dffe52fd

SHA512
c6c6516322b0740d3450d227468217711ad9d8fdfe1f78ed3379506d683d358eacaf60fe55bf890a52e1fa327362bbc42a961b48a15b9850926a72de22fb9da5

Download Submit
C:\Users\Admin\Downloads\CheckpointSelect.m4v

Filesize
620KB

MD5
db810b0ff466bed3f07d4d5f72b3a48d

SHA1
b55acfde48a018ce53ce50b368d6634cbd47dc36

SHA256
78b4fca59e722468af4e2a40bde1f88812e788605b11d0751a6dbc59e347a693

SHA512
b632918c80306ceabb1ed62fc07cd72f5625737b878a28a2bc587db44404409fe01ce55d7972f8f6519434b6adae5724fcc3f8e2c7b43f3f18e5746067bd0b56

Download Submit
C:\Users\Admin\Downloads\ClearSet.temp

Filesize
709KB

MD5
3a2208680883771b38cd25d8edc9bf58

SHA1
a551d8b49305cc33a96173d8068e8686a9681572

SHA256
06e387d7c3c139c149497c02f4a512bee7097f7db3b8e298505fff9df8ddf9ef

SHA512
c07d1bbf2c459dc5226d6b7eb0fd330f2b365bfe52a1828d547c3517789dff6f1cbcbf638b214351d51b5f28ab3fd5cb5526b0bfd79c00550043b08026caf57e

Download Submit
C:\Users\Admin\Downloads\CloseStep.odt

Filesize
1.3MB

MD5
0866d45ef20a503a4a8f2b9c851f360f

SHA1
1402068848cb26ea68a849495c6de3e40fdd0e4f

SHA256
73889c6dccb7001920cf649dacda2af6e3297fd2ff86f93987964bc990cd83e7

SHA512
2326d3b0536a45c5bf66a3734451e09b3c0bae67d2bfe73445713f8934ad5c59114c21ae2955f4a5a282f55c718aa601127d344f3366dd836e19799b48751191

Download Submit
C:\Users\Admin\Downloads\CompleteResume.mpeg

Filesize
549KB

MD5
8f38417378ff040f00511cd1643bf0a3

SHA1
225f35a3814c46f52fc7af5b47ed9cd892fc7ab9

SHA256
29f043373ac1e8fb2fb957878a53f37dc571120461ced45a622971f19bc737dc

SHA512
de59e350ee5a43f481ff1cb8eeb0d5738c1100117942165fb50300501c166af510464d24982f6b203fa71cc0be4910585ef1d9ea08f1d5b1a28f4d1d3f3275ec

Download Submit
C:\Users\Admin\Downloads\CompressMove.vdw

Filesize
797KB

MD5
30205b15125617aef0d8718aa99332c7

SHA1
82e8b4e5a991ddfa158e6b60618871725b5b7c5b

SHA256
48edab09af2ac973a1fa74fd2bcaa8bf2a17329022f1445788a18a5a0b0f1444

SHA512
d23bf6ad877d44803a47a5df1b08d04b413b97ad39e78a01854c3aa11279475e42aa975dd4280728347626157d6c5524aeae5c4b48a399d679cdc4384be30ed4

Download Submit
C:\Users\Admin\Downloads\ConfirmFormat.crw

Filesize
691KB

MD5
7ef14f891867c9c8a130d9a874c479aa

SHA1
ee88339d2dccfc4e588010e5bbc6c335125c5c80

SHA256
1147318c038970c032c917581d581f4b53d05a5d6954cf98c032cd65af4115c5

SHA512
dabb9fb8910b51d94a71857d059e50215b4d41622e9e621f9e7c4134f3a08bc04f98ee5824b9b9bfcf336a1db2eb75e7ff302998d420b1bfbd84d904940eddf4

Download Submit
C:\Users\Admin\Downloads\ConvertRedo.ADTS

Filesize
443KB

MD5
bf9adf8fe710142900256205e34b9e88

SHA1
f458b35774b0cce03049406b38c1c5c1736c1349

SHA256
8c0a4151b8a06e31b1e19a760993b5790a16fa843b9a1733ff5e7dc7fac684b8

SHA512
f20f4de2d797558f5ed147a677691db6c3ddfefb75c48cbae64c5a58c8d9a93fa8ca9c6584432bb41fa95d83fd518269f03c8be8432fd5c88f4e2a194d88a7b8

Download Submit
C:\Users\Admin\Downloads\CopySearch.potm

Filesize
372KB

MD5
a25a7123ae00b604156d480c79988448

SHA1
76a66fd2797ec77cb52c7b6ed6746d2d71b1eb9f

SHA256
b06615f4233e3eb5590b8edc55e1a339209bb8260f2d75e010ae67936b6f805d

SHA512
1e6360419ce64ae976a2d9563232585774188475ca502e245e466b6283c6276924c40e430a2b701fcf42c5ed24d13f29ce6779691942bcd44283c5c2caae3283

Download Submit
C:\Users\Admin\Downloads\EnableSubmit.M2TS

Filesize
868KB

MD5
1b02b008f6395300951daa296f8a3b3a

SHA1
446824e66b59e78f058cade63255e0ddf478ca08

SHA256
bc1b0a094510c8a2d07ad7622388576382852cd04ef1053befb38bb22cb1ab5f

SHA512
46b78690470f042612ff8c347f883b12468c37b1c92aa3bea33c087aac44214c8ab4226da66ae7c4910f4847736020bb9aeda8b159d61fbf3a0d01a8b9565024

Download Submit
C:\Users\Admin\Downloads\ExpandStop.dwfx

Filesize
567KB

MD5
9e3e12e7f23f8e668daa03924543c905

SHA1
5279c72e6b885090ba9cb4495ee0359c03fd710d

SHA256
5963b283350596dbda1220deb4bb516e62da7caef0347bdccfd2df6b8edf734f

SHA512
7b624eb9b94643a618d9c46707500ede1226e4356c9c8bb8c4d7b656ff77d6410ffc64994d66f4dc1eb4a1d7316f310dbbdff48121b5c05d2a431ad0fb745fcf

Download Submit
C:\Users\Admin\Downloads\FormatLimit.M2T

Filesize
975KB

MD5
66f706026854cd2ebd94ab598a1b9e30

SHA1
f87bb64941d250bebc4772e5068325898d477244

SHA256
b784b1c4459355878eeab51461d10cf936690ee7dbefb266a49a662b9077d2cb

SHA512
aa8e295c2311d1deddb5f67a7e9f1c0cfce99b4bf18b29b9069bbe4fce2bfe39e6c59824f664fbb34cfbd0f1c327143ccbdc9d2177225d8dab1dfaefe6dd74a4

Download Submit
C:\Users\Admin\Downloads\GroupUninstall.001

Filesize
744KB

MD5
fecef2b0b1f7e2205986011924115745

SHA1
a6be450bc22567b8525df4bad3ff7c4bd279749c

SHA256
45ac5b1a6351a8d739e29323740c42832ed856b3defc8430bd76372c1cc63261

SHA512
ddd10057ee510540a9939a7ec2e9d17136a06e8bb0a421419e2fe9f4caaf02ef98388775897da4fbbff3beb5d44d2477bbc49f7ba0e02abcf032bee48ea42ece

Download Submit
C:\Users\Admin\Downloads\InstallOpen.vssx

Filesize
833KB

MD5
ceab5060ff0a3ef31732caeda2edb4e6

SHA1
5433d7514cbd2ba2f267679816b643fc7b17156f

SHA256
cb99c0dd70b6401f8d936ed27ccedaf7308f148c02c3c4c12da903a49e93e6d0

SHA512
2ba42124e36ad700de0fd61b42a299a2e6f3438b30e0d00711e791143c371c0a1fa164a929c5c47c235fddb6fab2e76b875e8eb070d9edf6dfbaab2c31a08698

Download Submit
C:\Users\Admin\Downloads\JoinOpen.ini

Filesize
390KB

MD5
f52005ec0ef4a6b6a61e30ef6f9888e4

SHA1
c4cfe3d58a6c810256d26cdc9f0cb40e3f9ab778

SHA256
405e50219aa38279ca5d2d582e231606c65961558b73fc7d18a6234e2a1e11ba

SHA512
ac247300aaf7c52563211570eeebaf483f35acf8f533ffb08d305737604f7591b5a564138566459e878c5513423fbd2a3bbd08b546033664949cda437db8a729

Download Submit
C:\Users\Admin\Downloads\LimitInitialize.AAC

Filesize
585KB

MD5
13c3f6d4d38fe2d2d02080f23e95e7da

SHA1
8637872606938f85dbc56170cfa627e1c8d592f3

SHA256
97622b40b69246d78be5706634ad3e4f885e863fb04b9607bac5f5fa68c55bac

SHA512
31e007ad9d767f4e912be76ca50a89ceb4ff21fbc6fc4edef3b1238062f45b2bad94ed70b109ab88d8a7fae968c0723431d57ad83d01055fd3e79cd63d00f86b

Download Submit
C:\Users\Admin\Downloads\LimitUnblock.mpp

Filesize
904KB

MD5
b08c8876e941a9e3c41d3cb801450c83

SHA1
9711d7a3b6a430ad6789c0ac81d1b7e8fcc20393

SHA256
dfe6b614b27422d2c7fc0f91fe77c787e099633eff3a6430163b58de98c37415

SHA512
ef335dacf89b3d3afeaba5f3c49bd46bb86e1e2d52ebac4e70e6f8c3cbd8a1e48f62ca9741b774720372d68b4f738f5728b76bc6a13032474038c4a348c8cc71

Download Submit
C:\Users\Admin\Downloads\MeasureSync.html

Filesize
336KB

MD5
9416cdbccfe2aa3e1371dbc9d24796d9

SHA1
e968e77ad8f044b056ce2a48ec4b491af710cb16

SHA256
f985919cc67d2729c78c720ca7b48dc4c9990418ba004e93b75d07fe1af2698c

SHA512
587db78f686d1eea7e3ba668ac6e53c0917c321aebc61b250b98ccb6f13a20b76d8dc5da225774f2c92659cdbfc05b125b3faf1bbbcce351987deeeb16112bfe

Download Submit
C:\Users\Admin\Downloads\MountSearch.3g2

Filesize
425KB

MD5
88d1e1f8bc2959b29f7f8177343d7d2b

SHA1
9662d82b741be51d3c102a1013f6cbf54ce67daf

SHA256
c15eea9ff9f4af9e1fca3b6f606c17b2122af5d57aa099d7f584f73e9de06d00

SHA512
4547a6f7bdd279246fde0f89d07a206129c5b728100877785b1dbd326a6ab9a81da446e0e5378a53004e4c87a1e7e8111c35a9d1d2b9a367041b619cc72a7db3

Download Submit
C:\Users\Admin\Downloads\ProtectExit.ADT

Filesize
354KB

MD5
b95fa26d7d7c848ace8c1cf207e0b4ce

SHA1
5e71dc30c66deaf7d6665870894721ebb2f6d717

SHA256
b79b400cf44699a7102f4a56c091d418592a73ed40ae406445ffab02528be7f8

SHA512
6935100ae679740f488db8befc0147fde2acc8668e504ce1a05288f2755f1017defc63fd9d53824419e3cef639b3b8b62e21a3ab360fc428e08e7f256f884e0e

Download Submit
C:\Users\Admin\Downloads\ProtectInitialize.3gp2

Filesize
939KB

MD5
0eefb6d90063caa97a4ab3cd893fd5db

SHA1
6ff764e8b6754f05385230e0654a9828500eff8f

SHA256
8109db56cbeadc8cf7e18e5f237b67b8988a25763873fbdbd990629e11c45678

SHA512
07391b96509729c503b8f7568eaefaf295201c16accf076b1fe778848d81f83ad12f45926bddd7abbb57e099d58d69533e9ea5aed05125b8ec4655a4692adea6

Download Submit
C:\Users\Admin\Downloads\ProtectStop.wav

Filesize
531KB

MD5
72ab37799ad309f1bc82bdee2da98966

SHA1
b9e4ff76d8433cf123ac897a22d5142062248892

SHA256
c252368ca7946c9005615e496fa9325e0a8c5a479802c8fb3df36285f09e47fe

SHA512
9bda2c863a821ca44b047dbaf6f84dcd0046f89f61552d788b80f333428512487d6b010c162755c46e03849758804dc8daf2cc7615c59d54fb93366f3c61d33d

Download Submit
C:\Users\Admin\Downloads\PublishLimit.lnk

Filesize
602KB

MD5
2fe13ffc51c9a42b1381c41569685823

SHA1
dfd894f311a2739a46a977877adcfc4f655bcebe

SHA256
48e9ea102b16304ec2efd6acf80df934685db25c277431b575761975bf38a691

SHA512
5d7d5ba246f76f8c9b4c9fddcd8440eed591420e70f900c9065a26dc02b40430c0c30958f7cfa4338af1b08cb9e8247edff4d3eabcfeabf3119abac8912bcc5a

Download Submit
C:\Users\Admin\Downloads\RedoPublish.ico

Filesize
514KB

MD5
5f050b216381b249a4aa9bb5ec558858

SHA1
272cdfd66c1ff1f12386e49a848f39c8b0fc2a4a

SHA256
d44cbb867151633e4f62b7ae806c560e49e6c7a392dc9ba17d51bcb0239e18e1

SHA512
0d2954c5ab58183a935f5ca8fa9fb01531c37df9b5cbc451a4ec8454113b97b9483feae18e4a7c4fde017b0ea0186ae83a1e971c036dfb1064dbeb5c375c014c

Download Submit
C:\Users\Admin\Downloads\RestartUninstall.MTS

Filesize
850KB

MD5
0850672f4a624616751bb5d4a0fdab40

SHA1
c490118ae117885073479794122ca0c85f01be02

SHA256
37d769719cdca67d3288db8716116db8eaacfc601d090530bef2ec6a463fb674

SHA512
e92e406e1fdb5649add8252ac46b15113567de520c0fa746e9ab6ef9da9055c2e3a3f575601236e339ad0cdf53fe3c1acea1e89c4e10f2c0485c8aa70288bf25

Download Submit
C:\Users\Admin\Downloads\RevokeOut.mp3

Filesize
886KB

MD5
3467f0ad2683f3e2dc6e1e1a7816ef7f

SHA1
9c283470adc310600876fc483f760a7362430842

SHA256
6fcf831d7ca8a242bb11ae741ea57babf5c3ff9462314cd73137b77ec1c3f041

SHA512
371589b1815ec4d2a32434c4bf46de46dca4ed7dd81582a92de0eb97f64c2b632d9f0829d4b1e9c1998ba5fdba312f193f8f1accd4d64a8b5c7c8d4c7684c15b

Download Submit
C:\Users\Admin\Downloads\SaveRead.bmp

Filesize
815KB

MD5
8b301ab9ede86249ca6bc7a0c8a173ed

SHA1
7c516c0027fa87174f86bccbb3dd875a00efd054

SHA256
81bb8219bf9c512aed757e8f8037515e908db612c972488e70c8eccd5c7332b8

SHA512
12b339ac78742f5f01fbac769e022423d6fc3d5fc4d66b0092eb54d4d3505e04ff0d65bba94671a889d68b708b415e4531559e7540dc88794dc4862be2faf4db

Download Submit
C:\Users\Admin\Downloads\SaveSubmit.DVR

Filesize
921KB

MD5
8d38d07e09430f57a2b65467f3c6f916

SHA1
88b9931dbef7dbc4e4902b5fc5aca5f6b57e5482

SHA256
77bd552bcd013eb34a30601f7410ac41ec60b28cb23c0ff47c399cb075a93a0a

SHA512
db88a0115f2b32be74a1711951d14e9f7946b1e5cf863bd870a90cb0f9245d1d04ae1fa726f847c0c32e54aa9fe9e06ef51c7a4338e206a1cb95281606af5185

Download Submit
C:\Users\Admin\Downloads\SelectCheckpoint.vb

Filesize
726KB

MD5
1ce3127d0059ac52d10a5113ee2c98b3

SHA1
85f51e69487c55346d28eed4b5823702fb57e73b

SHA256
88693b8444d1e62a7d49e569debac5b0405a9e14a13c5d33821a030b1ff665ee

SHA512
b3dbb10c98562a7440dfffcab9597d6f561d6cf720cc5dcde8f150be5bffb757c21d05c06a8aa4fd4c171a4195fdf37b901c8121141aa28b0f3966e34f442ba7

Download Submit
C:\Users\Admin\Downloads\SelectWait.ram

Filesize
762KB

MD5
ea94372771543e8dab317337cce3c753

SHA1
7770a0556608da265072612432899bc5b4505f9b

SHA256
42fb2e568f43431e1816bdaa3dea030e852410a8722c9b10fee8ae1bc2eac957

SHA512
81dbcc3f3146e085a024c761fbb8f9595af55dbbc037bbcd177cd9188dfcdc46d33b197c9bbb8534a2b4824c61a9f256de4b6d502e3be96f883035f422a390bf

Download Submit
C:\Users\Admin\Downloads\SkipCopy.vdw

Filesize
478KB

MD5
99e8c1dcfb818777d53466085c0d1c1d

SHA1
693e759f4ccb7d88e5515d695919c8281060c7db

SHA256
4480308ea4e6187988b866fd6539f9861ae08de2835ed0c325d72b2071ed0548

SHA512
691b00371ec36ed284a27c065caa21d3f4f1d06dcd29eb3e18a34132ba5c70be3b5cdd7d159d1cb61d67b63c325f76863fa15e1003e2a722c1dcadb1b6f6a7ba

Download Submit
C:\Users\Admin\Downloads\SwitchWrite.wmx

Filesize
957KB

MD5
66cc4a710b98d7c4ff1759ff5bdfae16

SHA1
58035efa846b488ae6331cf27f33615e4594e7ff

SHA256
f32b9140cba0c218c7bf330d6205d64eb94c1f4e37d928d1d71a1d333fd7e2be

SHA512
58d4b7700726de9f84acbbc3724318e5ef035c2496a2e56ba1d7983a606ba9fc4cba1e7f1bef9d0cd58e531f7195b4517aa4e9890d195359d0c0b6ec1e4229a5

Download Submit
C:\Users\Admin\Downloads\SyncCompare.mpp

Filesize
407KB

MD5
a4339dcfd80cd7a5faab886dc69f0ef0

SHA1
eee2202196e15dc0b4a3dce50ee32bcbafd810cb

SHA256
dfd667377f0a8457f83506d1a5a2337352790b133daed40366d217d8c5e0316c

SHA512
4ddba9945af3e51f92963d3ffa0e4af57c6443c90f78c49c1afb4a98bff28e1eafcd8797142690794d2de528753de3aec00cc27c5eb15e0140ec45af90c101b4

Download Submit
C:\Users\Admin\Downloads\TraceRepair.ods

Filesize
460KB

MD5
f8fefdd02635e2db3d51f1c93f9be4fa

SHA1
34aa4a10c3e4825467734d3428b2d99c52a3da2f

SHA256
e683c96739e20ab2ed012a8bcf0406ef09ea1415845287e8f2b5a5dc7aff452b

SHA512
cf4199ca77762c5e78adeab73219aa50424796e2e4f97a5aa97236aa15de2e821e7b719b771eff916958c3681cc21579f96db52b71476a1fa5a147161c072c2c

Download Submit
C:\Users\Admin\Downloads\UnprotectDisconnect.ogg

Filesize
496KB

MD5
0e19259a87808096b42df324b6715acf

SHA1
27a81f2c7e5dc7fb4ecc0c758d5eee13295b384c

SHA256
88b7be21435847814c854b4e283318876c8f8cb9345eb09be4d21daf389b6cf9

SHA512
a083c6b3155ea4a36f9fffe13b2a06eed13e1e5cbcd5ab532061a5c8f5ce26e62a93edf04929e4b0695c10a2436fb2f04471b1712e5648884e74f074b1e2f32b

Download Submit
C:\Users\Admin\Downloads\UnpublishCheckpoint.bat

Filesize
780KB

MD5
a21970ed08c5267168a1a052176c0802

SHA1
fbec4b4f3633d094e000ba363d24d1db1e57bdbb

SHA256
5f61770b3f54e998ff22a4f1d42fea3544a80039fe14a11a4b3c92e4a9720d73

SHA512
8642df51db74fb41afaba127fa55ce005a1d4ea41cf77e1e156f250f02ea9eb1375b629461a5fe3ed4a93094449a62f6e6ff83a172ffbc6fb5161aa7b7022897

Download Submit
C:\Users\Admin\Downloads\UpdateConvertFrom.M2T

Filesize
638KB

MD5
f7f357396f1110353614056821496cb6

SHA1
d8bcc6502b265693eed8931d3919d66fc0da1908

SHA256
29a42c8486a95bd5bf5464b51c253201cca4698db4f13e9edc09dba37c162546

SHA512
7d64a8e89ec3d012cd72fc477c5ea6dcbf858d38ffab4596767419cc9327f0d0656cf84da623e4c7cfd2c6e261b8240d88d9bdee15388b351fa39167302d94ea

Download Submit
C:\Users\Admin\Downloads\WatchCompare.emz

Filesize
655KB

MD5
577e806df1e50dfcf1976d125de47406

SHA1
b2beddefc79c05a2d470a3de9dae39c0df3b9b12

SHA256
712d9a41775c812d69443dce7111398b90599869f32c4e6ae367bf09fcbf295e

SHA512
25e4b5b9ae28e869e5613f075f40e0c96f19d14e5a3529db4e7c9efe64b973d7382bcfc4378ff30309a57fe8606c769f1a2e89654e29db82b8ca2aab17d6a298

Download Submit
memory/1184-127-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/1184-129-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/1184-147-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/1184-133-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/1184-130-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/1184-128-0x0000000000400000-0x00000000006DB000-memory.dmp

Filesize
2.9MB

Download
memory/2152-120-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2152-143-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2152-151-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2152-148-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2152-119-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2152-118-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download
memory/2620-123-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/2828-142-0x0000000003410000-0x00000000034C5000-memory.dmp

Filesize
724KB

Download
memory/2828-132-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2828-146-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads