wshrat | 8506e666c372ca8121a6919a63f06846894a32c5ea3ab4b2fd73fbb631fe991e

Analysis

max time kernel
77s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
26-09-2023 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe
Size

2.1MB
MD5

066dbf69cbfa16c46a2142a257c95f1d
SHA1

0300eb287c3e29642877772c348c6b683b86a305
SHA256

a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906
SHA512

c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a
SSDEEP

49152:wkQTArh5KH1JME1y9fb95r/6LGoc30b9KJp9D06dkRNLkL+mrcTuZqy:warh5s41rL6WY6SRpO+dTuZP

Score

10^/10

wshrat spyware stealer trojan

Malware Config

Extracted

Family

wshrat

http://80.76.51.33:2606

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000120be-25.dat	family_wshrat
behavioral1/files/0x00080000000130e5-62.dat	family_wshrat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/files/0x0004000000020c20-24211.dat	MailPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x0004000000020c20-24211.dat	Nirsoft

Blocklisted process makes network request 16 IoCs

flow	pid	Process
3	3036	wscript.exe
4	3036	wscript.exe
8	3036	wscript.exe
10	2944	wscript.exe
11	2944	wscript.exe
14	2944	wscript.exe
15	2944	wscript.exe
16	2944	wscript.exe
17	2944	wscript.exe
18	2944	wscript.exe
20	2944	wscript.exe
21	2944	wscript.exe
22	2944	wscript.exe
23	2944	wscript.exe
24	2944	wscript.exe
25	2944	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
8980	python.exe
7956	python.exe

Loads dropped DLL 64 IoCs

pid	Process
9000	cmd.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
8980	python.exe
7992	cmd.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe
7956	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
7744	taskkill.exe
7608	taskkill.exe
7496	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	wscript.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
6192	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6192	powershell.exe
Token: 35	8980	python.exe
Token: 35	7956	python.exe
Token: SeDebugPrivilege	7744	taskkill.exe
Token: SeDebugPrivilege	7608	taskkill.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1616 wrote to memory of 1164	1616	a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe	28
PID 1164 wrote to memory of 3036	1164	caspol.exe	29
PID 1164 wrote to memory of 3036	1164	caspol.exe	29
PID 1164 wrote to memory of 3036	1164	caspol.exe	29
PID 1164 wrote to memory of 3036	1164	caspol.exe	29
PID 3036 wrote to memory of 2944	3036	wscript.exe	31
PID 3036 wrote to memory of 2944	3036	wscript.exe	31
PID 3036 wrote to memory of 2944	3036	wscript.exe	31
PID 3036 wrote to memory of 2944	3036	wscript.exe	31
PID 2944 wrote to memory of 6192	2944	wscript.exe	36
PID 2944 wrote to memory of 6192	2944	wscript.exe	36
PID 2944 wrote to memory of 6192	2944	wscript.exe	36
PID 2944 wrote to memory of 6192	2944	wscript.exe	36
PID 2944 wrote to memory of 9000	2944	wscript.exe	38
PID 2944 wrote to memory of 9000	2944	wscript.exe	38
PID 2944 wrote to memory of 9000	2944	wscript.exe	38
PID 2944 wrote to memory of 9000	2944	wscript.exe	38
PID 9000 wrote to memory of 8980	9000	cmd.exe	40
PID 9000 wrote to memory of 8980	9000	cmd.exe	40
PID 9000 wrote to memory of 8980	9000	cmd.exe	40
PID 9000 wrote to memory of 8980	9000	cmd.exe	40
PID 2944 wrote to memory of 7992	2944	wscript.exe	41
PID 2944 wrote to memory of 7992	2944	wscript.exe	41
PID 2944 wrote to memory of 7992	2944	wscript.exe	41
PID 2944 wrote to memory of 7992	2944	wscript.exe	41
PID 7992 wrote to memory of 7956	7992	cmd.exe	43
PID 7992 wrote to memory of 7956	7992	cmd.exe	43
PID 7992 wrote to memory of 7956	7992	cmd.exe	43
PID 7992 wrote to memory of 7956	7992	cmd.exe	43
PID 2944 wrote to memory of 7752	2944	wscript.exe	44
PID 2944 wrote to memory of 7752	2944	wscript.exe	44
PID 2944 wrote to memory of 7752	2944	wscript.exe	44
PID 2944 wrote to memory of 7752	2944	wscript.exe	44
PID 7752 wrote to memory of 7744	7752	cmd.exe	46
PID 7752 wrote to memory of 7744	7752	cmd.exe	46
PID 7752 wrote to memory of 7744	7752	cmd.exe	46
PID 7752 wrote to memory of 7744	7752	cmd.exe	46
PID 2944 wrote to memory of 7620	2944	wscript.exe	47
PID 2944 wrote to memory of 7620	2944	wscript.exe	47
PID 2944 wrote to memory of 7620	2944	wscript.exe	47
PID 2944 wrote to memory of 7620	2944	wscript.exe	47
PID 7620 wrote to memory of 7608	7620	cmd.exe	49
PID 7620 wrote to memory of 7608	7620	cmd.exe	49
PID 7620 wrote to memory of 7608	7620	cmd.exe	49
PID 7620 wrote to memory of 7608	7620	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe
"C:\Users\Admin\AppData\Local\Temp\a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\vVqvy.vbs"
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\vVqvy.vbs"
      4⤵
      Blocklisted process makes network request
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ } > "C:\Users\Admin\AppData\Local\Temp\tmp.txt"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6192
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Local\Temp\wshsdk" && C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe C:\Users\Admin\AppData\Local\Temp\rundll > "C:\Users\Admin\AppData\Local\Temp\wshout"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe
        
        C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe C:\Users\Admin\AppData\Local\Temp\rundll
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Local\Temp\wshsdk" && C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe C:\Users\Admin\AppData\Local\Temp\rundll > "C:\Users\Admin\AppData\Local\Temp\wshout"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe
        
        C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe C:\Users\Admin\AppData\Local\Temp\rundll
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:7956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:7752
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM cmdc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:7620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM cmdc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\cmdc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cmdc.exe" /stext C:\Users\Admin\AppData\Local\Temp\cmdc.exedata
        5⤵
        
        PID:7556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
        5⤵
        
        PID:7468
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM cmdc.exe
        6⤵
        Kills process with taskkill
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\cmdc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cmdc.exe" /stext C:\Users\Admin\AppData\Local\Temp\cmdc.exedata
        5⤵
        
        PID:7448
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c mkdir "C:\Users\Admin\AppData\Local\Temp\wshlogs"
        5⤵
        
        PID:7392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8E7WD55\json[1].json

Filesize
323B

MD5
0c17abb0ed055fecf0c48bb6e46eb4eb

SHA1
a692730c8ec7353c31b94a888f359edb54aaa4c8

SHA256
f41e99f954e33e7b0e39930ec8620bf29801efc44275c1ee6b5cfa5e1be202c0

SHA512
645a9f2f94461d8a187261b736949df398ece5cfbf1af8653d18d3487ec1269d9f565534c1e249c12f31b3b1a41a8512953b1e991b001fc1360059e3fd494ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMDCEX~1.ZIP

Filesize
53KB

MD5
a8e496443115a63697cb350f47ae1729

SHA1
a69779b57ecc8457e85066e7a5ab742c70ea653d

SHA256
6f3cf374a1aa961be87dde5aaeb1706d95cdcadbd1a4c961363e5ff33fab168d

SHA512
0c3c5504567912cfd8cf40664463cdc518ce6810bfd05af91ffee30b13f4e115a93f6faae8e5c8aa88ee91e2c3b4404126dbdfcffb82aa2625199e432a3cea9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4720.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4761.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmdc.exe

Filesize
100KB

MD5
54e8ded7b148a13d3363ac7b33f6eb06

SHA1
63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9

SHA256
400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342

SHA512
bf6d047bb55150b2369bdd7dfea9c815894af2e05e5b45f2eedf67d5d6a9569189ee495870fddf334a173a4beed62d2a08807c000d4c47339ac76b760b4ae349

Download Submit
C:\Users\Admin\AppData\Local\Temp\vVqvy.vbs

Filesize
180KB

MD5
9bcc1d31eae798a11b1d50f46b1de92c

SHA1
8bc898b80ead2433ac20eaa9936d2e40ea1db01e

SHA256
cc2ca06bf02d0ba8b9ec6874b734bf6a39f84d536f6bb2d7cc5e3d577697e45b

SHA512
b0a13f056ce07f5bf1360cb9754759c499c1560ed19c684f50774d0d6f72e0669b9e10a243185d9c31555938ae2799a09222236d960fb36f935bda266b764d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk.zip

Filesize
12.4MB

MD5
d9a63dfd8b73629421bb44bcde09f312

SHA1
7855575c12eaee0e734f3901ca1da2931e9b587a

SHA256
9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

SHA512
df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\Lib\SITE-P~1\adodbapi\test\is64bit.py

Filesize
1KB

MD5
ca2cc8e73bbca371935bbc92ed18d567

SHA1
1adb458919e842cd78c72b1ff00e5e93cb6ef75e

SHA256
bea3f797921992fda45c19db41e10e3b325bcdd3ea35d35c1fa70535477ad9c1

SHA512
b63df3bad9272f45ba0f50e2c50aaed7a04eb1b000d5855d9f3a8e5c5f2d381c667b1e9c1e1f03f80584a7941a96992838664ae9dd25e1b8320e026da35b8223

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\__pycache__\abc.cpython-37.pyc

Filesize
6KB

MD5
cea4fa818d4468f70d14cae1c3fa9593

SHA1
cb060d183cb2f4850d2199a51e82301f653d51c4

SHA256
f64180d0a00e09801d9fa616f7fc21ffc7bb532b19209320059eb3d126e0485f

SHA512
9f434ebacc2d75483b00c4ee687ccd8df69dde06bbf1cb7bb32e7d6ca5db82130f78543a8166446a49fcd51ade6e2f983eb2469dcde0e1f6d4da595fbd01d3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\__pycache__\codecs.cpython-37.pyc

Filesize
33KB

MD5
31a2fe679cad1b609caba7c961f43d70

SHA1
21d411d11ce126c054ea70f90196c81b18eaa550

SHA256
6b903c49e04070578aa47a378ff830bc9407be92c8b952a134cec40e944fa30d

SHA512
34dde13a6a197caf1ed9fe73ca30e70c966027c44509e398334a6e9be8eb8f5c3289ef66383f3d9cc69da26cca2097c48cb5fde7be14476fe35fd2cc087da855

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\__pycache__\io.cpython-37.pyc

Filesize
3KB

MD5
deddc1aebef1d56aa912f32deff5355f

SHA1
472c6923a8fae0cfb7fba6890f2c37dfaf685bcc

SHA256
c27434a09d7e90d3e7980427fa6d22d0eb570663e110b68dd9a71f8bcc3aad24

SHA512
89edddf61d0ce04650e5886f5dc98931a3ac52ecacac6e8fe78ff2b3c5db5943118b600ca05fec3d4022a6469dfeeea0979b03313fbabfc057ac5772103bd328

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\abc.py

Filesize
5KB

MD5
17e3407344267dde764ecaa542cccd4d

SHA1
ec774abd2a9aa2729a8af6a9cd67dfb22fd0acae

SHA256
f3bbcdb6406b9f9a3467ecd5a8ba74f1accb36adc95aa50d805c2927f09a2304

SHA512
850b5f7293ac61d41eb5e13791aac643858daac0950ed1271ac1f3534184f8f379c248e94e63a9abbb699ae4436e4324a96daf5465abc6a50cbe99887024e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\codecs.py

Filesize
36KB

MD5
d1d8d96ee5398cda53cbddca69b8e2ab

SHA1
3998c0a2124ab260a7d83f296228be90418b8366

SHA256
39f79489cb6ef0f95dc0ae007c5ece25897f76fa9b56449922f764896cec5ed3

SHA512
0d324416498fba44b41d175194527d5035176642e535bb446ac2c64feed175df7c316507bda375baa77907465973d1340999c859b5d20b51cc2bd96a30857b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__init__.py

Filesize
5KB

MD5
82afd9dcb28c19afdc42097fcbdbe662

SHA1
329e052afe981c8ba32ff78df2deb9d041c05f8b

SHA256
921635dcb46ba5192db20e6c7ed0429c647f7d55ead2f6feaadc00b8410a646e

SHA512
4ae0a9de57f0df6119b99be7168e35917da63e24487b67a4afe96d3996cc42ad22716ac411791998642498bd5f64ab14d9571f4ebf2ee5abc6eb2761270cc897

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__pycache__\__init__.cpython-37.pyc

Filesize
3KB

MD5
e3f691d123a890f18538f5fead7bd6cd

SHA1
f6e77a0008cefa3a7e3f67c7d11c7787391db5d9

SHA256
3473f433a4d2c09e637f6da9b21172d31468a453c2b47fff27f776e820f25934

SHA512
776e40399adb6e7211ed67022c2b1b12309e5436760c7a0104fe243610e87559f9890575b972cc569d8d793c2d94c70e2f051f36d803ca7c8c89f77f0b39cc23

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__pycache__\aliases.cpython-37.pyc

Filesize
6KB

MD5
840a56d291513211bd0e65864b9169f3

SHA1
af58891c07f864d4753baa1dfdbdd71a614cded1

SHA256
a597b04b97a8bfe577010d816ca8a1480247ea96b025c59c345b7b120bb5f922

SHA512
b1fbfbc5ca147fd0fcb9e7a509d5ec5a4578bb038a8116c908aa48ecd593694ab4d318b2bc6c8240bc6c2b4e2e23b7b6ed9d295619a862748ad3609445cd3d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__pycache__\ascii.cpython-37.pyc

Filesize
1KB

MD5
e155072de8b3f0f7c8a089802f2f42fd

SHA1
416497f00986510600ae40c2b263d36c9d4e76c9

SHA256
e2ec095476cd398acf0f5f3e324f29e4e0756c3cb381c90a048ad87e1fef086d

SHA512
f0ffc043da6ec8e49b5d7fdd01685d9cac95d6cc41a69b924a89dbc6b0a11687a67d0ac150f9669ebc5df08942c5b6a79eb9df827d13823995e21620eb01f316

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__pycache__\latin_1.cpython-37.pyc

Filesize
1KB

MD5
2312f7d16eed297caa4a0da46f612479

SHA1
afc6f0ff4b5d57204b20c4127a58e8cdb0f1f09d

SHA256
3b033fb54ed66cfd73e6cd1479e3a7d7166d70d713d232707dd2b28ac92af2c7

SHA512
66faa5cc8ede6e929ac22ba48a6f1136a70879ccbdbe31146c1f4fb9f9d3744976e36fc47c533a3be4a6edb5b72870dc12018ac73924acf6217c17002c35815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\__pycache__\utf_8.cpython-37.pyc

Filesize
1KB

MD5
96f8cc58ae6da7199951c19543193a61

SHA1
c9c75c757cb1ea2198f84d80de052db7d874b7c7

SHA256
e24b41e43dae2dcda0a88cae0dc52993ce66790d5addd498d772ea5406f6068e

SHA512
fcb0d4c5f7ceac706b764caf495afb3517e807f89e3f21534997400c1b8fcfc7b23e09bfd3a4599ab4bdf388a36f3f9cd7c14f22ae9c48e03b1d85ed7a8c58dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\aliases.py

Filesize
15KB

MD5
794677da57c541836ef8c0be93415219

SHA1
67956cb212acc2b5dc578cff48d1fe189e5274e4

SHA256
9ed4517a5778b2efbd76704f841738c12441ff649eed83b2ea033b3843c9b3d5

SHA512
33c3fa687ea494029ff6f250557eaaa24647f847255628b9198a8a33859db0a716d5a3c54743d58b796a46102f2a57da3445935ca0fef1245164523ff4294088

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\ascii.py

Filesize
1KB

MD5
ff48c6334861799d8d554f5d2a30ba00

SHA1
08520b19d0353712cdfd919b3694945678c3d2d7

SHA256
698c578b9b5df7bd6f8b2761d114f74cff854c1396083c8ab912b11fcae83b86

SHA512
087a0e1ba9d9ca2c2f51f0156ad0ada1d1eb7ccba8b46159b95779b053d2431fc52ba1ca57fec381ea044a7f0e41490b5389b1af2dbf513c35cc1b29997fee6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\latin_1.py

Filesize
1KB

MD5
92c4d5e13fe5abece119aa4d0c4be6c5

SHA1
79e464e63e3f1728efe318688fe2052811801e23

SHA256
6d5a6c46fe6675543ea3d04d9b27ccce8e04d6dfeb376691381b62d806a5d016

SHA512
c95f5344128993e9e6c2bf590ce7f2cffa9f3c384400a44c0bc3aca71d666ed182c040ec495ea3af83abbd9053c705334e5f4c3f7c07f65e7031e95fdfb7a561

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\io.py

Filesize
3KB

MD5
2c098fb1d1a4c0a183da506daa34a786

SHA1
55fb1833342ad13c35c6d3cb5fda819327773b21

SHA256
f89251a16945f7c125554cc91c7e7ed1560b366396c3153a4cadfb7a7133cd03

SHA512
375903e7bf79cf6c8e7c4decff482f4b59594aaaef62e01f1f45d0f9e26f9e864690d79cdfbdcf46cd83562cc465ef419cac32739d35bcb9fe6124682a997918

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\lib\site.py

Filesize
21KB

MD5
51df50deeb52eb8ec6f4cbb40bb35fd4

SHA1
843ed1cdc13a01d49875c47e8c8447036189af1f

SHA256
7ce57be4214772d5a82e3a678e449cf41d881e048811a619cba86fcb98f0b98e

SHA512
4fb452299acb43bee2e2d93add7726b611aacec121a9b7033c563d3be8c4c9945a9fabb2e312ada85f385e9a1aba34fae0a77b432633bee350ea339798bee7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\wshsdk\ucrtbase.DLL

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
C:\Users\Admin\AppData\Roaming\vVqvy.vbs

Filesize
180KB

MD5
9bcc1d31eae798a11b1d50f46b1de92c

SHA1
8bc898b80ead2433ac20eaa9936d2e40ea1db01e

SHA256
cc2ca06bf02d0ba8b9ec6874b734bf6a39f84d536f6bb2d7cc5e3d577697e45b

SHA512
b0a13f056ce07f5bf1360cb9754759c499c1560ed19c684f50774d0d6f72e0669b9e10a243185d9c31555938ae2799a09222236d960fb36f935bda266b764d6d

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\ucrtbase.dll

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
\Users\Admin\AppData\Local\Temp\wshsdk\vcruntime140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
memory/1164-22-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-10-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-20-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-17-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-23-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/1164-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-26-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/1164-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1164-12-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1164-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1616-19-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1616-0-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1616-4-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/1616-7-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/1616-2-0x0000000004F70000-0x0000000005168000-memory.dmp

Filesize
2.0MB

Download
memory/1616-6-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Filesize
40KB

Download
memory/1616-1-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/1616-5-0x0000000004D70000-0x0000000004F6A000-memory.dmp

Filesize
2.0MB

Download
memory/1616-3-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/2944-8646-0x00000000746C0000-0x00000000746F2000-memory.dmp

Filesize
200KB

Download
memory/6192-23891-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/6192-23893-0x0000000073BF0000-0x000000007419B000-memory.dmp

Filesize
5.7MB

Download
memory/6192-23892-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/6192-23889-0x0000000073BF0000-0x000000007419B000-memory.dmp

Filesize
5.7MB

Download
memory/6192-23890-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/6192-23888-0x0000000073BF0000-0x000000007419B000-memory.dmp

Filesize
5.7MB

Download