runningrat | 1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16-11-2023 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Size

801KB
MD5

eb49928c6e5be7f6c2dcfe158df9dda8
SHA1

7334ef0afa8ecdf497716c1309a43406138155f1
SHA256

1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9
SHA512

72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f
SSDEEP

12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MMNj:GnsJ39LyjbJkQFMhmC+6GD996

Score

10^/10

runningrat persistence rat

Malware Config

Signatures

RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

RunningRat payload 19 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	family_runningrat
C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	family_runningrat
\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	family_runningrat
C:\ProgramData\Synaptics\Synaptics.exe	family_runningrat
C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	family_runningrat
behavioral1/memory/1716-28-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat
C:\ProgramData\Synaptics\Synaptics.exe	family_runningrat
\ProgramData\Synaptics\Synaptics.exe	family_runningrat
\ProgramData\Synaptics\Synaptics.exe	family_runningrat
\ProgramData\Synaptics\Synaptics.exe	family_runningrat
C:\ProgramData\Synaptics\Synaptics.exe	family_runningrat
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe	family_runningrat
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe	family_runningrat
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe	family_runningrat
behavioral1/memory/1100-81-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat
behavioral1/memory/1100-85-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat
behavioral1/memory/1100-86-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat
behavioral1/memory/1100-90-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat
behavioral1/memory/1100-115-0x0000000000400000-0x00000000004CE000-memory.dmp	family_runningrat

Sets DLL path for service in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe._cache_Synaptics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OERSDs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259439677.dll"	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OERSDs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259440270.dll"	._cache_Synaptics.exe

Executes dropped EXE 4 IoCs

Processes:

._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exeSynaptics.exe._cache_Synaptics.exeOERSDs.exe

pid process

1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1100 Synaptics.exe
2872 ._cache_Synaptics.exe
2136 OERSDs.exe

pid	process
1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1100	Synaptics.exe
2872	._cache_Synaptics.exe
2136	OERSDs.exe

Loads dropped DLL 15 IoCs

Processes:

NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exesvchost.exeSynaptics.exe._cache_Synaptics.exeOERSDs.exe

pid	process
1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
2724	svchost.exe
1100	Synaptics.exe
1100	Synaptics.exe
1100	Synaptics.exe
2872	._cache_Synaptics.exe
2724	svchost.exe
2136	OERSDs.exe
2136	OERSDs.exe
2136	OERSDs.exe
2136	OERSDs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe

Creates a Windows Service
persistence
Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\OERSDs.exe svchost.exe
File opened for modification C:\Windows\SysWOW64\OERSDs.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\SysWOW64\OERSDs.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\OERSDs.exe	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OERSDs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OERSDs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OERSDs.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE

Modifies data under HKEY_USERS 5 IoCs

Processes:

OERSDs.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	OERSDs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	OERSDs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	OERSDs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	OERSDs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	OERSDs.exe

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

2996 PING.EXE
2040 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2660 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe._cache_Synaptics.exe

pid process

1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
2872 ._cache_Synaptics.exe

pid	process
2996	PING.EXE
2040	PING.EXE

pid	process
2660	EXCEL.EXE

pid	process
1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
2872	._cache_Synaptics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe._cache_Synaptics.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Token: SeIncBasePriorityPrivilege	2872	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe._cache_Synaptics.exeEXCEL.EXE

pid process

1656 ._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
2872 ._cache_Synaptics.exe
2660 EXCEL.EXE

pid	process
1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
2872	._cache_Synaptics.exe
2660	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exeSynaptics.exe._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.execmd.exe._cache_Synaptics.execmd.exesvchost.exe

description	pid	process	target process
PID 1716 wrote to memory of 1656	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
PID 1716 wrote to memory of 1656	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
PID 1716 wrote to memory of 1656	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
PID 1716 wrote to memory of 1656	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
PID 1716 wrote to memory of 1100	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	Synaptics.exe
PID 1716 wrote to memory of 1100	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	Synaptics.exe
PID 1716 wrote to memory of 1100	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	Synaptics.exe
PID 1716 wrote to memory of 1100	1716	NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	Synaptics.exe
PID 1100 wrote to memory of 2872	1100	Synaptics.exe	._cache_Synaptics.exe
PID 1100 wrote to memory of 2872	1100	Synaptics.exe	._cache_Synaptics.exe
PID 1100 wrote to memory of 2872	1100	Synaptics.exe	._cache_Synaptics.exe
PID 1100 wrote to memory of 2872	1100	Synaptics.exe	._cache_Synaptics.exe
PID 1656 wrote to memory of 816	1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	cmd.exe
PID 1656 wrote to memory of 816	1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	cmd.exe
PID 1656 wrote to memory of 816	1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	cmd.exe
PID 1656 wrote to memory of 816	1656	._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe	cmd.exe
PID 816 wrote to memory of 2996	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 2996	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 2996	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 2996	816	cmd.exe	PING.EXE
PID 2872 wrote to memory of 2612	2872	._cache_Synaptics.exe	cmd.exe
PID 2872 wrote to memory of 2612	2872	._cache_Synaptics.exe	cmd.exe
PID 2872 wrote to memory of 2612	2872	._cache_Synaptics.exe	cmd.exe
PID 2872 wrote to memory of 2612	2872	._cache_Synaptics.exe	cmd.exe
PID 2612 wrote to memory of 2040	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2040	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2040	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2040	2612	cmd.exe	PING.EXE
PID 2724 wrote to memory of 2136	2724	svchost.exe	OERSDs.exe
PID 2724 wrote to memory of 2136	2724	svchost.exe	OERSDs.exe
PID 2724 wrote to memory of 2136	2724	svchost.exe	OERSDs.exe
PID 2724 wrote to memory of 2136	2724	svchost.exe	OERSDs.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
4⤵
- Runs ping.exe
PID:2996

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "OERSDs"
1⤵
PID:2160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "OERSDs"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\OERSDs.exe
C:\Windows\system32\OERSDs.exe "c:\users\admin\appdata\local\temp\259439677.dll",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2136

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEUzXZe4.xlsm
Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\SysWOW64\OERSDs.exe
Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\SysWOW64\OERSDs.exe
Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\??\c:\users\admin\appdata\local\temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
801KB

MD5
eb49928c6e5be7f6c2dcfe158df9dda8

SHA1
7334ef0afa8ecdf497716c1309a43406138155f1

SHA256
1db552b3054965e79fe9b4766d9daefb69a72fceb2e5a31186a9235c5fca7ad9

SHA512
72ddae4db2855f7da04698a1cd811edad985c5eaeade9d91f09aaac115390b4036b2621873f8a3b877ab717b9ee3c77f0359f2710a987db80e919b55b3ab0a8f

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_NEAS.eb49928c6e5be7f6c2dcfe158df9dda8.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Filesize
48KB

MD5
baaa08a9723edf38c38fca9f245e06d3

SHA1
bd8c6db41444c29b5380ce8e819cad0cff1b87a6

SHA256
bbc91d159de0dcc389c6005ca1be5e776593800ed8aec81cadffce9d9e5e4797

SHA512
0d2d57b7d0400d6e34ec35f11872a8a6b57085485a0a4de253ee13a570b6805905d026e4d1f248d98e62c1dc1217548f8bb9bfc1c923ceb2b50cacd743d02d55

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259439677.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Users\Admin\AppData\Local\Temp\259440270.dll
Filesize
25KB

MD5
e454c59b2616686f92b20d733ab0db1f

SHA1
af744f4d209466878b045f879e2e6d2e85624839

SHA256
01b0d61c344961370ad3aee1bcc75f22f6eaa9c0cd7735fd1b2ea6610eeb5fbc

SHA512
b733efd33dc05c4a36d37c4e0f69e2a7c89f75b2b1e0e9127af6977698ea76c0818423d2fb6eed2ee8be6c8ca00a4b6fa3ed25ce3d99f88d796a798d80699d95

Download Submit
\Windows\SysWOW64\OERSDs.exe
Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/1100-32-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1100-81-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1100-83-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1100-85-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1100-86-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1100-90-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1100-115-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1716-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1716-28-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/2660-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2660-61-0x00000000729BD000-0x00000000729C8000-memory.dmp

Filesize
44KB

Download
memory/2660-84-0x00000000729BD000-0x00000000729C8000-memory.dmp

Filesize
44KB

Download