dridex | 0a65e748685b606573e04e320955af33a9fc673b50c7dc4ca6a4d53d9235cfc1

Resubmissions

09/03/2024, 01:40

240309-b3w57abc62 10

09/03/2024, 01:37

240309-b14ggsbc37 10

Analysis

max time kernel
131s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9b70b4077ca44355b4850e19c6e17d6.dll
Size

2.1MB
MD5

b9b70b4077ca44355b4850e19c6e17d6
SHA1

01eff1a28fdfd36735a92e66ecc1b4ca7fb2c428
SHA256

0a65e748685b606573e04e320955af33a9fc673b50c7dc4ca6a4d53d9235cfc1
SHA512

acc2c62bc6103b766ce5df4bd207fe557e81b3490353e1f32b4b328a1c71769a056386f2497c3fa76bf22f87ccca82035aba269275ddf89e3ead1424d1d63ca6
SSDEEP

12288:5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:4fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral2/memory/3396-4-0x0000000001110000-0x0000000001111000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
336	msinfo32.exe
3784	ddodiag.exe
3868	DmNotificationBroker.exe

Loads dropped DLL 3 IoCs

pid	Process
336	msinfo32.exe
3784	ddodiag.exe
3868	DmNotificationBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ibefddkasjfzqiq = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ACCESS~1\\69IV9Y~1\\ddodiag.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DmNotificationBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ddodiag.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = e7021f006d02d5dfa3235f020400000000005b0200003153505305d5cdd59c2e1b10939708002b2cf9ae9701000012000000004100750074006f004c006900730074000000420000001e000000700072006f00700034003200390034003900360037003200390035000000000050010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000500014001f50e04fd020ea3a6910a2d808002b30309d3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000d4cb2571bd68da010a497103cb68da010a497103cb68da0114000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000006e185a8840a4da4a812bdb871b942259ffffffffffffffffffffffff00000000010000001b00530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f00610064007300000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000deb37655010000006f00000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001d000000530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f0061006400730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe000000200000000000000000000000000000000000000000000000000100000093022a0000001900efbe6e185a8840a4da4a812bdb871b9422590000000000000000000000000000000093020000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = bd021f006d02d5dfa3235f020400000000005b0200003153505305d5cdd59c2e1b10939708002b2cf9ae9701000012000000004100750074006f004c006900730074000000420000001e000000700072006f00700034003200390034003900360037003200390035000000000050010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000500014001f50e04fd020ea3a6910a2d808002b30309d3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000d4cb2571bd68da010a497103cb68da010a497103cb68da0114000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000006e185a8840a4da4a812bdb871b942259ffffffffffffffffffffffff00000000010000001b00530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f00610064007300000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000deb37655010000006f00000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001d000000530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f0061006400730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe000000200000000000000000000000000000000000000000000000000100000093020000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\TV_TopViewVersion = "0"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "4"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "250"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "50"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1050"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3396	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3396	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found
Token: SeShutdownPrivilege	3396	Process not Found
Token: SeCreatePagefilePrivilege	3396	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3396	Process not Found

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found
3396	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3396	Process not Found
3396	Process not Found

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1952	3396	Process not Found	95
PID 3396 wrote to memory of 1952	3396	Process not Found	95
PID 3396 wrote to memory of 336	3396	Process not Found	96
PID 3396 wrote to memory of 336	3396	Process not Found	96
PID 3396 wrote to memory of 1800	3396	Process not Found	97
PID 3396 wrote to memory of 1800	3396	Process not Found	97
PID 3396 wrote to memory of 3784	3396	Process not Found	98
PID 3396 wrote to memory of 3784	3396	Process not Found	98
PID 3396 wrote to memory of 3980	3396	Process not Found	99
PID 3396 wrote to memory of 3980	3396	Process not Found	99
PID 3396 wrote to memory of 3868	3396	Process not Found	101
PID 3396 wrote to memory of 3868	3396	Process not Found	101
PID 3396 wrote to memory of 2720	3396	Process not Found	115
PID 3396 wrote to memory of 2720	3396	Process not Found	115
PID 2720 wrote to memory of 4380	2720	chrome.exe	117
PID 2720 wrote to memory of 4380	2720	chrome.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b70b4077ca44355b4850e19c6e17d6.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2796

C:\Windows\system32\msinfo32.exe
C:\Windows\system32\msinfo32.exe
1⤵
PID:1952

C:\Users\Admin\AppData\Local\EDCzKNRt4\msinfo32.exe
C:\Users\Admin\AppData\Local\EDCzKNRt4\msinfo32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:336

C:\Windows\system32\ddodiag.exe
C:\Windows\system32\ddodiag.exe
1⤵
PID:1800

C:\Users\Admin\AppData\Local\Df85nZ1M\ddodiag.exe
C:\Users\Admin\AppData\Local\Df85nZ1M\ddodiag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3784

C:\Windows\system32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
1⤵
PID:3980

C:\Users\Admin\AppData\Local\w8dRDms\DmNotificationBroker.exe
C:\Users\Admin\AppData\Local\w8dRDms\DmNotificationBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaaa999758,0x7ffaaa999768,0x7ffaaa999778
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:2
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4676 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5356 --field-trial-handle=1984,i,17020836030232812850,13040472275594038482,131072 /prefetch:1
  2⤵
  PID:2840

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Df85nZ1M\XmlLite.dll

Filesize
182KB

MD5
ecade74a181eeb52f0be1f95bb8dce81

SHA1
65cd061e9971e0c4a4b286287252def5fd1e9ff8

SHA256
d9fe020edf2c4898d03ddc75a54df5c0f5ae32441be0dcba6bd2eef6d19d7764

SHA512
351fa1eccb103cd39346514778cc2283ab8caad84d56702b165ee84e69cf3d3528f2b81978e276192c85f8d4e787aaa1d406bf973a56497246a0a34dcc44ceae

Download Submit
C:\Users\Admin\AppData\Local\Df85nZ1M\XmlLite.dll

Filesize
231KB

MD5
5fee977203290d52e66ff4964727b50b

SHA1
15cdccb7d22b11c4f83e6c41fc3b4ee7e5313ab6

SHA256
33fc6ab842de6ca253b9d1d9462e6e857be9a06c19f79a9ad8eaa759260de465

SHA512
73ebe84e01118c827baca0f9538d076043f21844244a9ddfbc9d7c8e14743777ed2e7a4cad5356d5b9e266383ba26efcc39c3700aa49807fb0031db01c72ca4f

Download Submit
C:\Users\Admin\AppData\Local\Df85nZ1M\ddodiag.exe

Filesize
39KB

MD5
85feee634a6aee90f0108e26d3d9bc1f

SHA1
a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2

SHA256
99c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6

SHA512
b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff

Download Submit
C:\Users\Admin\AppData\Local\EDCzKNRt4\SLC.dll

Filesize
360KB

MD5
f8120f27e1f21b42a023902c09865476

SHA1
2ad81c4408f81268c7c6670cbb71043ba1320f88

SHA256
4ceef0cbc0716556c15fdf6fab533614aa261486c71f6c4d16f251f5258036d9

SHA512
a64a2f6f0a658f7f0552c591f66cb11297705925b5f2b0da82ba9733a4ef55c4bb033be4b47934d3f370e176717a944deba67fcbb4e589bfd798685825d4d361

Download Submit
C:\Users\Admin\AppData\Local\EDCzKNRt4\SLC.dll

Filesize
272KB

MD5
10dcb558fbd2331bb8f5cf21dc1474e1

SHA1
c3b07b9559b6080066803ee06d73b21f8a90b7ea

SHA256
3250dd49e4aee161557188fee82f3f8b86cd48fc36301cd5e3af824493c8f4e9

SHA512
303d601d22ddaccc1d45b76523e41c7c920bf741288d8c7919e06e5e48121fd61ad1b49efb1e608c3efe17db2ce13172c16677bb75271290275c58d64493e8a1

Download Submit
C:\Users\Admin\AppData\Local\EDCzKNRt4\msinfo32.exe

Filesize
264KB

MD5
d715cda90b0a54fc93b726e98aee6289

SHA1
86bbd261efb58d9384f6a90a2f2bf37f0945515e

SHA256
f39282dbf1aa593bab9a77e295d8fc072f3c6db120fa0ae184522a8ea728f447

SHA512
d705cefaba24c029712055156957c9ae9367de8fff88ba9505d267a58596333142bf4eff362882ca38b3f1b697b58be2e67cc15d33229d740ce9073590e27cf7

Download Submit
C:\Users\Admin\AppData\Local\EDCzKNRt4\msinfo32.exe

Filesize
274KB

MD5
6271eee550d89e8d3d9ccba53864a5f3

SHA1
057b5921df57a13657e05dbff6ac2024b456196e

SHA256
02c2ca4ffa06cb4cd5abf6a460110e1b933380ff13f78382aa72f1f4843e34b5

SHA512
b1e97ba4f3ec068ed4e735caa7f6028517067f133d82f5c08d8c0db7212331e86889f7db855fbd15d9f77d29b7a5661f3aa682100fc51b71cf2e41675c99225b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache0\Cache_Data\data_0

Filesize
44KB

MD5
2a9e3893621dca7996cb3e45d828f593

SHA1
db11adb446f72c13943084620923a4682d127e73

SHA256
606703bb8886c616db3a33bc88657624851bf0ad98091ee62f3cb0f2b5b96e0e

SHA512
9f9b3b407bf623d3ae2571cbbc3e7e23b94b636235fa83753e266c06ca207e12dd883bd205731489c3870805a864fdfdd8e648933b8bf7677faec7a92226e4b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache0\Cache_Data\data_1

Filesize
264KB

MD5
a0c9a87e19c1892b177c56487b7d716e

SHA1
1cb37a6857367237c6ace6ad6b96a3802bb46e57

SHA256
e1e9baaa90dbfe4444f2c29575c0fe389bcd45b290565de44a6d706f26a994b3

SHA512
42b86598cfabd5d02c25d4841e5bc70fe31bb8a8e0c4b144bbba6d49161296301d0f855dce6c88a17312dced8eea29e1ad51dd158504689f0b8f22a7dd5b5ca1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache0\Cache_Data\data_3

Filesize
4.0MB

MD5
ffe27858711d0ee09fd2c9d0fbafcae3

SHA1
0b18ecdfdb53ca4bfbffd898b5e51304112d28cd

SHA256
9232e1cf5284f738158065cbcac267a722df8bc005a968c700a2be3e787cc77d

SHA512
9beb2f8d0cf6794abb572fee1113ef833dbf20b78c2d51f997a449438d2b81545d8c04938aae933f13b4bb27c617bf84c4821c6ac0ed35b6893016144f040b80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
74375e036c832d770e8dc73cb92644d4

SHA1
df488a3aaece267c41eade817300ee6463c79a78

SHA256
998adedb2596909214f178f83332cda9f45395a543e6754967c035e6f0141404

SHA512
45d7634a54a8eeb43005d11a428d26d2d0f684425cfdb686b8491676b20dd7aee398eeffef261e90d61db80c6c2293b6f9ee5db8f8efb73e04371a0922bce160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d8f6c910dded20bb5883d5602a56728c

SHA1
008a9dce7a77ad0f2205c0b69bf553fd1b0b9bab

SHA256
b35bc748c7f3c2d0fe47002f739b306049567c4958eeae71d7847b697af87679

SHA512
0ce3aea461192fd0c8e7b130e5ff5e78d83398f0da10c1806dccff0dcf6230e41251acc7b54101611753e1908b2ad3b5d4baad9cdfa94a7dbc2eec30fd9c6fcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e4799de13898e292a0dcc0c403422e8c

SHA1
c96b78461ca06edc59df42eeef6409bdbd5e47b6

SHA256
30a1450e9186d6b0ba51dbabd88459592ab0fe196f48b4460888c46f8f096be9

SHA512
d0ce2cd7ba25c19512fdd9386cee9222e4a7e18066da64135477ed30377d20a74569736e2d38cd35ff22397461bc8bf63fdca6071ee6f07f69f8570f3e74e721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
b2502ce6f52a9a3e642463aa4c8f459a

SHA1
691915a6f1877ac92bd45f5160dcb80fd6923966

SHA256
dc5837b0334fb7cc77a24a2a77cf43af98d1ce24d51746ee0648eb14f25ab68d

SHA512
465910b74099b6e8bc7815b25242a7433c43ed735de092290dc9767dad896e94b6e3fee6e50331d1fb56490cd6c4bcf48aaa75c539d0779cc21eb0e60ecf1da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\w8dRDms\DUI70.dll

Filesize
544KB

MD5
e4f7249d7a0b96e94ce4b60786d09975

SHA1
e0325fc7a79726be45de0f6d1be9ffa4fb518c5e

SHA256
93b9ea50d86db548c43e26099d73e3687b9d6642e3ff9d92707d00d33351dabe

SHA512
70e122f44ce2b3f238f2e976a748145b9b3d0c4560675fb3d8330fa43bfedef479e14d3ebbfd46a221e6001cd6f51a47c59e873df0e36c49c5c57855e5fe0321

Download Submit
C:\Users\Admin\AppData\Local\w8dRDms\DUI70.dll

Filesize
501KB

MD5
9b0b2be0f469d36ba9898b32a6bd031f

SHA1
0143fca2c3294bacfea5b769057519659d072873

SHA256
fa366c8d4cbed46d641e2e24bc82c7658b8b0127adb83bdc175323f2a17f7da1

SHA512
f84a215395b00f12c8764edb7f0b53f73192160035052d62c8a1fe7b8b698a8a2f1df95fb92b345ca3216c43c377605452accb2dbb7181ad4a304347f2bfacce

Download Submit
C:\Users\Admin\AppData\Local\w8dRDms\DmNotificationBroker.exe

Filesize
32KB

MD5
f0bdc20540d314a2aad951c7e2c88420

SHA1
4ab344595a4a81ab5f31ed96d72f217b4cee790b

SHA256
f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5

SHA512
cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\OrxGzUFciq\DUI70.dll

Filesize
1.6MB

MD5
2a219bc6b17824e109429971d686f828

SHA1
a63c7c72ae8143c7d36d0f98f95911dd3ac3c1ea

SHA256
4fa5233f042d6738d903dc54492c140ca487f05c56fa8dc95d0398f7b4c311de

SHA512
61474b4dc4f871e54b69a30968a37b712c3f0a70918d719b5aafa750dc5b8a7f1bccdb81aad0c1e52190e08facf2f190cfe2cc12c6497fe00bdc3603126cf7ed

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zleyjbxoi.lnk

Filesize
1KB

MD5
f6df99fc6c5885f076893dfdd817a74a

SHA1
87d808a6cf45c9abe8a560adfde9c63af139af78

SHA256
bf2dbacd57e02d57a16d34b73a9472b0067b0decf32d87a38b91b87d7e4c6c48

SHA512
293b4534a284e06b841ce389e80e69ca82c749a877950c2ae0c28809f1a8a5df4a211aa709c63c2c01a42b021e4122fe8df99a4afb0a840904373c52c11b9d6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\69Iv9YwXxoK\XmlLite.dll

Filesize
2.1MB

MD5
129cc6a81900ca5e92a4c4656343e39c

SHA1
0936a095a211130172852e2f094ab52520932109

SHA256
dcab1304ac82b4e1a8c9f81b382ea2fe2552f07aa3dda4fd3da0de347283e101

SHA512
275b6bab3afe65116c98d3a2794163a84e7ad5aea2cb821f22634b71945a96c8033aa1dac135aa4c1d85793b7f5fb45584a9cd04ff7fe759780de952a393c716

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\TB0rApSrNC\SLC.dll

Filesize
2.1MB

MD5
761898f1fdb848883eef6b20c180ca1d

SHA1
27eeb2ad97c1d2b5ca8b0e6ba760ac4d741de190

SHA256
96b4d2ade63d71e6cf3ff4695fa26b03d1521123c730590885fc1e3031889ea4

SHA512
cd0cb6a3f9671c701f894df2c2a1dbb8a5b1cae3faecfea1b9f9c77fad0c6d5267657baf62b423d3b94fb12644c4041cc81eb316efcc82fe582425cb4e13f928

Download Submit
memory/336-79-0x00000181E1FE0000-0x00000181E1FE7000-memory.dmp

Filesize
28KB

Download
memory/336-80-0x0000000140000000-0x0000000140212000-memory.dmp

Filesize
2.1MB

Download
memory/2796-1-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/2796-8-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/2796-0-0x0000014B05380000-0x0000014B05387000-memory.dmp

Filesize
28KB

Download
memory/3396-23-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-28-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-34-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-33-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-35-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-36-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-37-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-38-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-39-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-40-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-41-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-43-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-42-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-45-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-49-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-51-0x00000000010E0000-0x00000000010E7000-memory.dmp

Filesize
28KB

Download
memory/3396-50-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-48-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-47-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-46-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-44-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-58-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-59-0x00007FFAC8B40000-0x00007FFAC8B50000-memory.dmp

Filesize
64KB

Download
memory/3396-68-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-70-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-32-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-31-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-30-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-29-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-27-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-26-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-25-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-24-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-22-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-4-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/3396-21-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-20-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-19-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-7-0x00007FFAC8A4A000-0x00007FFAC8A4B000-memory.dmp

Filesize
4KB

Download
memory/3396-18-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-17-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-16-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-15-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-14-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-13-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-12-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-11-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-10-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-9-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3396-6-0x0000000140000000-0x0000000140211000-memory.dmp

Filesize
2.1MB

Download
memory/3784-97-0x00000229B7BE0000-0x00000229B7BE7000-memory.dmp

Filesize
28KB

Download
memory/3868-113-0x00000174A7610000-0x00000174A7617000-memory.dmp

Filesize
28KB

Download