31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
Size

563KB
MD5

cb937632cfcaed9b85db096338b8b446
SHA1

a682f6247377d71a2953ed7a27bdcd016601e180
SHA256

31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928
SHA512

c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c
SSDEEP

12288:jjtju6APFo38dPbUpLbQJNBWQ40twjbY+lEIPD3Lkua:jAPq3SbUeXVF+aIPD3LkR

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Smrse.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Smrse.exe

Executes dropped EXE 5 IoCs

pid	Process
592	Smrsa.exe
320	Smrse.exe
1552	Smrse.exe
1556	Smrse.exe
552	Smrse.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1468-60-0x0000000000400000-0x0000000000546000-memory.dmp	upx
behavioral1/files/0x000500000000b2d2-75.dat	upx
behavioral1/memory/320-77-0x0000000000400000-0x0000000000546000-memory.dmp	upx
behavioral1/files/0x000500000000b2d2-78.dat	upx
behavioral1/files/0x000500000000b2d2-83.dat	upx
behavioral1/memory/320-85-0x0000000000400000-0x0000000000546000-memory.dmp	upx
behavioral1/files/0x000500000000b2d2-88.dat	upx
behavioral1/files/0x000500000000b2d2-95.dat	upx
behavioral1/memory/1556-97-0x0000000000400000-0x0000000000546000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Smrse.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1468-60-0x0000000000400000-0x0000000000546000-memory.dmp	autoit_exe
behavioral1/memory/320-85-0x0000000000400000-0x0000000000546000-memory.dmp	autoit_exe
behavioral1/memory/1556-97-0x0000000000400000-0x0000000000546000-memory.dmp	autoit_exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileRNSZ7760.htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\N3M6CRZ2.txt	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[9].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[10].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\N3M6CRZ2.txt	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[6].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile4C15Z4EE.htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[3].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[8].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileDMEU6QZD.htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileTQQBIV0U.htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\UJ2538NA.txt	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileA0PK4QQC.htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[2].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileZTVMMI1I.htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[7].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile9W1HIKDS.htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profileE8GUOZ00.htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[4].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[5].htm	Smrse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\UJ2538NA.txt	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\domain_profile[1].htm	Smrse.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\wm[1].htm	Smrse.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 320 set thread context of 1552	320	Smrse.exe	30
PID 1556 set thread context of 552	1556	Smrse.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecision = "0"	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Smrse.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Smrse.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Smrse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc\WpadDecisionTime = 9033a115020dd901	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Smrse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Smrse.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Smrse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadNetworkName = "Network 2"	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\9e-6f-1a-e7-0f-fc	Smrse.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc\WpadDecision = "0"	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Smrse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Smrse.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecisionReason = "1"	Smrse.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecisionTime = 9033a115020dd901	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Smrse.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Smrse.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Smrse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Smrse.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Smrse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Smrse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Smrse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Smrse.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
320	Smrse.exe
1556	Smrse.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
Token: SeDebugPrivilege	320	Smrse.exe
Token: SeDebugPrivilege	1556	Smrse.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
592	Smrsa.exe
1552	Smrse.exe
552	Smrse.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1468 wrote to memory of 1152	1468	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	27
PID 1152 wrote to memory of 592	1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	28
PID 1152 wrote to memory of 592	1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	28
PID 1152 wrote to memory of 592	1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	28
PID 1152 wrote to memory of 592	1152	31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe	28
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 320 wrote to memory of 1552	320	Smrse.exe	30
PID 1556 wrote to memory of 552	1556	Smrse.exe	32
PID 1556 wrote to memory of 552	1556	Smrse.exe	32
PID 1556 wrote to memory of 552	1556	Smrse.exe	32
PID 1556 wrote to memory of 552	1556	Smrse.exe	32
PID 1556 wrote to memory of 552	1556	Smrse.exe	32
PID 1556 wrote to memory of 552	1556	Smrse.exe	32

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Smrse.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Smrse.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Smrse.exe

C:\Users\Admin\AppData\Local\Temp\31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
"C:\Users\Admin\AppData\Local\Temp\31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe
  "C:\Users\Admin\AppData\Local\Temp\31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\ProgramData\Smrsa.exe
    "C:\ProgramData\Smrsa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:592

C:\ProgramData\Smrse.exe
C:\ProgramData\Smrse.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320
- C:\ProgramData\Smrse.exe
  "C:\ProgramData\Smrse.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1552

C:\ProgramData\Smrse.exe
C:\ProgramData\Smrse.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\ProgramData\Smrse.exe
  "C:\ProgramData\Smrse.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
C:\ProgramData\Smrse.exe

Filesize
563KB

MD5
cb937632cfcaed9b85db096338b8b446

SHA1
a682f6247377d71a2953ed7a27bdcd016601e180

SHA256
31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

SHA512
c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c

Download Submit
C:\ProgramData\Smrse.exe

Filesize
563KB

MD5
cb937632cfcaed9b85db096338b8b446

SHA1
a682f6247377d71a2953ed7a27bdcd016601e180

SHA256
31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

SHA512
c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c

Download Submit
C:\ProgramData\Smrse.exe

Filesize
563KB

MD5
cb937632cfcaed9b85db096338b8b446

SHA1
a682f6247377d71a2953ed7a27bdcd016601e180

SHA256
31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

SHA512
c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c

Download Submit
C:\ProgramData\Smrse.exe

Filesize
563KB

MD5
cb937632cfcaed9b85db096338b8b446

SHA1
a682f6247377d71a2953ed7a27bdcd016601e180

SHA256
31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

SHA512
c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c

Download Submit
C:\ProgramData\Smrse.exe

Filesize
563KB

MD5
cb937632cfcaed9b85db096338b8b446

SHA1
a682f6247377d71a2953ed7a27bdcd016601e180

SHA256
31a0773eddee340e030c3be34336346b60b373e31acc942a443006b5fe225928

SHA512
c7a5e7026bfd22825fd4c241f08dd7de6b67d6a74f13504cf8284435493a457c18b145e89ced5f91282b0a17c1f79ffaf6969ee9149cffd023ba807979c6281c

Download Submit
\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
\ProgramData\Smrsa.exe

Filesize
32KB

MD5
36ddeac2e4efaef6b7a23873319b0d26

SHA1
f82df553d5d645980b6d8cf50e5636a0966cc348

SHA256
ae7f942e4b8b2b0fae132b848bc29e933a43d74e136966c9c41cb8607b9cd626

SHA512
f865ecca31a50278a89e74cf35c02eb966e8b9d619c585fa1caa206817b55bbc1271bd8d5f5787cf3df670ea7471bf0fa92f6360f2ab2ee1422371293206a587

Download Submit
memory/320-77-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/320-85-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/552-100-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1152-72-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1152-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1152-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1468-60-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/1468-61-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/1552-101-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1552-102-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1556-97-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download