3ba782f1ddf9b091232171b072b30dd145090d02cbb16f6ed816e14e35885285

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ratka.exe
Size

37KB
MD5

f82ab1b6c91dbfc8a1fc643f3c10922b
SHA1

5088dc1515bf6cedfbea693bdf0d897e25345775
SHA256

3ba782f1ddf9b091232171b072b30dd145090d02cbb16f6ed816e14e35885285
SHA512

def496bca5a0cc7957d726d02409372885292690618ae5a13c44e6921fb7de72e5ec8e1855a2cb1de9d4cc1d77be01f3e7d65889b17bf41f00cea12d6b6f805e
SSDEEP

384:VmOq0IiejvCVLO309QmykrtG+dA+Vd7wvOSiKrAF+rMRTyN/0L+EcoinblneHQMi:XLdGdkrgYH7wWS9rM+rMRa8Nu9+Ot

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1840	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	0.tcp.eu.ngrok.io
46	0.tcp.eu.ngrok.io
58	0.tcp.eu.ngrok.io
88	0.tcp.eu.ngrok.io

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EA5F241-2882-11EF-86AF-C63262D56B5F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424334454"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = c0c5d25b8fbcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://workupload/file/G7pdsGf8Y6Z"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe
772	Ratka.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
772	Ratka.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe
Token: 33	772	Ratka.exe
Token: SeIncBasePriorityPrivilege	772	Ratka.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3004	iexplore.exe
3000	msdt.exe
620	msdt.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
3004	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
3004	iexplore.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1840	772	Ratka.exe	28
PID 772 wrote to memory of 1840	772	Ratka.exe	28
PID 772 wrote to memory of 1840	772	Ratka.exe	28
PID 772 wrote to memory of 1840	772	Ratka.exe	28
PID 3004 wrote to memory of 2732	3004	iexplore.exe	33
PID 3004 wrote to memory of 2732	3004	iexplore.exe	33
PID 3004 wrote to memory of 2732	3004	iexplore.exe	33
PID 3004 wrote to memory of 2732	3004	iexplore.exe	33
PID 2732 wrote to memory of 3000	2732	IEXPLORE.EXE	37
PID 2732 wrote to memory of 3000	2732	IEXPLORE.EXE	37
PID 2732 wrote to memory of 3000	2732	IEXPLORE.EXE	37
PID 2732 wrote to memory of 3000	2732	IEXPLORE.EXE	37
PID 2732 wrote to memory of 620	2732	IEXPLORE.EXE	43
PID 2732 wrote to memory of 620	2732	IEXPLORE.EXE	43
PID 2732 wrote to memory of 620	2732	IEXPLORE.EXE	43
PID 2732 wrote to memory of 620	2732	IEXPLORE.EXE	43

C:\Users\Admin\AppData\Local\Temp\Ratka.exe
"C:\Users\Admin\AppData\Local\Temp\Ratka.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Ratka.exe" "Ratka.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:1840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\msdt.exe
    -modal 393500 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF5BB.tmp -ep NetworkDiagnosticsWeb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3000
- - C:\Windows\SysWOW64\msdt.exe
    -modal 393500 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF1BCB.tmp -ep NetworkDiagnosticsWeb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:620

C:\Windows\SysWOW64\sdiagnhost.exe
C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
1⤵
PID:1208

C:\Windows\SysWOW64\sdiagnhost.exe
C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
1⤵
PID:2536

C:\Windows\SysWOW64\sdiagnhost.exe
C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38676523f9866cd30bcc354d17136404

SHA1
f7cb51eebcd667b4fc34e015698299f9fe569182

SHA256
eb34f88f816765ec74ed94c5079d1b7ab10efba26fcf80fd7853e322eae5452a

SHA512
fe1b2655aeae625ae804162bfe9ba920285586ea02a80f54c43e5907eb63743c91a95827b5099421d226202adfe9ad6d63c6fccd2e3d7be5e3f420d3ebe8d971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee97494a3e69adc87436f01430e64fcb

SHA1
895d0f57577ebe0d37be6853a1cbe07a202c4b43

SHA256
8644e1ed92676aebfc1d5df208c981199456008ae44e7820b5da7bd54fb293a4

SHA512
cac1f199527e9c20023409e05ec1938333ec2164ec9f2d6288f78672337147667e28e9a6cc5502e125b2672bb71081e4ed05b6402ab13c37ef82f088e19b4228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8e14609295ebe05c2bc63d5767bcb42

SHA1
3e80a0a38a5bb27281bd11abeff30cbe453a43cb

SHA256
601bbc10157bdcfa20ecdcd62f7704e68a38efe6a756868df84d94ab537a04a3

SHA512
61ab9a217caf0681146ecaa755f08e80dec387c3727a1d7768a214ec31d2035aaa6ec533b98bdaf170dcece39ee2fcd255ae5a1da3a297c73bf9769f31f61f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b046ba13bd71c1890339ffbb4160b63

SHA1
75ef4193b4f5f61bce192d075566811f71408648

SHA256
0afb6db079f7e1088d0c9fcc5eb34c0fb0e51790eba591ce8066d80b670fa835

SHA512
771cb782df458170f63c44387c538a610ec5de1d7914ceb28d97cc3cc3734d75be52682cb8b08a26f7c14d1bbd7bee86b74415fc7a49fc28b4bce453c030ba66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d820c6837a26dc37601f6540ca36419b

SHA1
d883fa948aaf4027c89167dd34d75d9397ad2071

SHA256
723e682ff17a4522ae4e78dfd4afa419b8245dbc5ad7b543f768701a3e4f2dd4

SHA512
4a03d15a8c666fcc5a25e90342a09c8a83c839981c0c9b06cf604c24abc30183ccdb68cd99193249bfe65e67f809e74999b4831c02566167e075ac3f850b4fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32c53fe54d4b9b7ee1217ab7897455d2

SHA1
862504ed28d4bec88dab1b38f93706dda8dec371

SHA256
3f311a3b3a9bee74fa91ff54b1cb57bb3504a55e7521628c28fd5f8d9fab72fc

SHA512
3af2f24959b23bc3ec1b9f60c48c58052f563ccb5eb386cf6e152b2d47709b8f771755cdebb2beefc21995b6b79361cb959691f02d5aa11c3158beebf451b834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f57587f4f0660f0b5f7f8946d103ace8

SHA1
0002a9233844de733c4256e0128e30c6b64eb3a9

SHA256
57aed82fe88e06926f0c5c57a827580cf58832d5a550c48a7878416ba993b16e

SHA512
0ceff1300502344ddb7681e25caeb5a80d62d7fc77d35682ee07c8c690a65f065bf8460030b5ae4516616582acfadf1ccab13f06638319f5fdaa5235581189d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1af95fe0416e72df621e9bfd94a2203d

SHA1
39122d84171b8fcec3bdef9f01f3af9237aa8482

SHA256
dd34c9197325d6863c18a83ad10e1fd252436cbad311a937931619f6b84079a0

SHA512
71729f95d4579b24530a0eefd1fb14fc04e40c6e214690630e88fd851adede106da90deee4e58d26825549b3f2f6e558699f0e3b46f4150eb1f62c937745b0ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe7ab0c89c14cade516bdb969e4ed8ff

SHA1
54f5f50e08ed9715be82f4044616d6af60bf882b

SHA256
3b221cd9df8dac4a654097035905b0a37bb4427322c023b550c147e31082225c

SHA512
588df79be0ed38bb1e57fc9abfb672d707497b888c8e61935651310f1632f375deb2735b7fe27148d13ddc4b03e518b654bf0c412c08b0c72188cb8699e8c549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2730363a136fbf1e71157cbd86a2d421

SHA1
32a47f9c7f9011284c4eb4bf75d8d01f4c97a210

SHA256
1d2456ba66952a04a537348be80e5ffd6ef2c141725ebbd14ccbeb33dfea4d7f

SHA512
7be38b7444119ec39308ad8c7e8d644d1a4643b4e5ab9ffa9b4c37181648ae3a2faa778dd04e0d71060b719670765e9a1af9cbcc06eb245ff6e98a2345fbfab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcc6db97c2ce9f77b733a4116d86cbd6

SHA1
0deca1f097cc4947e0e2adf2c3f0d559590050b6

SHA256
40fc1ba261c435c4b67e26a3492ff0bea949ce58fca1adff9503f10f771265a5

SHA512
dd30a0652efc72696dda727417ce2a31ef722bb3530dd6b2251688c584bdbdceff220ecb7e91c2fcd6e0e896bd8b12ddb12ff29b00e71be2e8784824c821813d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
154aed74d2db0567aebb25a606ee87d9

SHA1
460c87d3354dce757e5f0f57a1d94426595ac12c

SHA256
dbbc594dc25bedbb4250102e5531c126ce429b40a2b84d79b33bfa8da1765d1c

SHA512
45dc087c6e98801922baecdeaf530367e965936289a4a6016ba75c158a529636f7aa40f193adf1c1a50902a308fb017985d06f9893d96d72c51fec9e45cf5152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c59d423183edd517f825c7aecbf5dd

SHA1
e07edfcbe9222374827528ac4bf89cf5955c368d

SHA256
fc67701af8901fc91266a6fc78717eb46da0fdbac7e62013de2246a56ec6cd55

SHA512
e4e37921d6e851535d5335b1a5bc9a75bdc068637bc0609af4801ae913814012c6fa5a1b94ba8bcee71fdb6f833a44b2eb7e5c4b3d9c755520713f72926ab18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
350bd243b234bd7c4407111c313bf023

SHA1
f00ff20e60cbd0a79738b6e38ed6fb2b91ffe023

SHA256
d9b8e28b0010f462bb819c6659c28dc1055d74b4c982320b936f402ee638e2d4

SHA512
061ef4148d9c690b9437f4b8e57d1e06d3ced05a84f2f08e5fd3300d335a59d334a3596ca642f4bae283b8068a66ffcefde25feb085221c6b34a618e2893dfde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
349480e685366564691d9a55feda408c

SHA1
fb11141e073859dabf0350589a4b32232fb8360a

SHA256
d7ef88d9f6e8b893694844c23aa007808290bd62140f48dd345b4684b8f81eb8

SHA512
8a4c494d6bd2ce37ea40f1f3ac11524f1d5b48570db9dec8d6c7c91248468f478078d1d5d3557560dc6f2e320e6247e6f12799727ef991af3a7a487ac835b725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54c2a319e83b7ce8a36c98338d4d8f52

SHA1
f5b6e6d3c78a75b9f1b86db860f81fa5058fd117

SHA256
346d5d20d4fa4f1a957a69e1f662d120c5c56526a0b9dba04beb4ecdf7994192

SHA512
6e6a3e7bc9b67f02c2b6dfa9356362d0e209ca6363621f653082e69635be351232735a72bf50dee48356bc974e4a91bcea3da3f3332b38f09c330d1ea0fad706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c7ed6dbd5c1481faf7477c03d746034

SHA1
ee46bb4c152dd5d2b50773f5b421b8d739d6c675

SHA256
5483a73c979a45962cab47cffafa31f4249d291f3db2cee3c50038beaeb02e70

SHA512
48492c6f66783a1509b568e472f75540f8f001d0553b0e2d2487a32eee0338aaef3d76ad0eed40c85e8be5688cfce8ea58f380d512e12f818e97a8428b61b4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff801d2435a50b8b96866164fceff33c

SHA1
598757c4b900fe954f4ac5141e3bc5d85a008383

SHA256
425873f8271faa11236f16fa317976c68ee13cfa3c8edf894f3d1f0c03bb77fb

SHA512
88bab274c1eeb3eae6430bc49f902f04c11617dfab08cb5841fab1a12f336ad8ce7a0d08d4fb6c7211d207f4d4feaa43aec19fba0e8b51212da129d2a8369cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6788e217a0fa2df0fc3786c3c8a74a2

SHA1
8d92ce0ea8e39b2c6d8c4bbb1442899eed0f7bb2

SHA256
a0a5b20b3bc1fd471017ca91b2ddf5831ccfd9321c4c347d6efa6a2aad4a5004

SHA512
d1a9e26401fd0b2ceb12ff427d175c871efc222fb18382dbad580f162cbad2972bb6334c150b76d615975093828bc55adc72519e1fa320c22a68ff2ef31e0456

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061206.000\NetworkDiagnostics.0.debugreport.xml

Filesize
65KB

MD5
bf4434066e556b52fd4dc5cb6c73e5b4

SHA1
7cec5f36804f3a21a84dfac21c2e8dab82a3e2bb

SHA256
d7e7e17b7a61beec455d7d3912c1ec6c915b66e0cf2ccf1ab74d1c485be5016f

SHA512
73fadb9899d5ff542b65c0bf021ff95299a6e3abef62282dca4e9a1dfee1d66b44b7d413fd429be4cdb497d084f8c18c64d52156aed0ce34379e0a55ab4c6f68

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061206.000\NetworkDiagnostics.1.debugreport.xml

Filesize
7KB

MD5
4ac8e46a4d39be386261c47ee58aeca1

SHA1
0c0701390a6a93b6c764c536ef637d8d999d6079

SHA256
09fb287dff249360e9cfc8d34141689887564670f379f55a0bc2970b22eee971

SHA512
b4656b98a9ce1d486882d56845dd72bfcd6b68490ae39460de741a038389d1b43d1afac08671ca772f9b8abe72c0683b28aa71e67457102bff3071d3e5b2fdab

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061206.001\NetworkDiagnostics.0.debugreport.xml

Filesize
7KB

MD5
255d5eb3184b806128af4ac8d335399f

SHA1
e76b52d95911a1d62695dc5ac03cb6dc087eacf8

SHA256
edb7ca94522232bdd440b17f021bbd83aff6bce8dc91e02c262a8347012a50ed

SHA512
04efdaa79e0e2ee40bfcb8883aa45f22e40c41b60f776c8222ed2285cc22f61f2a77d1b61cfd9298f54222fe0d34f49155eda1787a6c6e5fa626d2478cb7fa8b

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061206.001\ResultReport.xml

Filesize
34KB

MD5
31d10a2d313dd021f183bde2a8a0b444

SHA1
6ee6bc0b89dd3452be5c161e768af96d973e1431

SHA256
44dfe0696d317083d1f8e5b6556feeefdbdc047cce2eb981c5213e2d130c236a

SHA512
cb46e2ca9659dce6f7a88b9d41c82e2e6a4402ab321ca63c8455ea3ec50b247727dccc3ead794ff9a5837a960ac2341a30912a61d841983d4eda84a4478ad49b

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061206.001\results.xml

Filesize
253B

MD5
840b413cbf5e57a93deecff7e76cf260

SHA1
cdcb54b73ea2acbfaa16e9355b347c2548411026

SHA256
de5825ee63dd98ca86f86652ff81ac75380b3ac4d880ab44d8984b8bf531ffae

SHA512
2130c9f55a3b28492c698def50cf92d805ccee1334c95ca8f9f776f6ceeee91884e751fac42510088a262dd82de01dcd6aaac5186db4a97a221bd8289a72c3a1

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\latest.cab

Filesize
16KB

MD5
85902cd2a028f31efa743b1eb7ac38d6

SHA1
d1ba4609ff9b979e779b30721f6c1571e8444761

SHA256
26579d0e4d2a4ee55126a9394ac1682134ac9b1b73e365208ca72011ad36bf65

SHA512
bcb82543e629c0a58f8340f269563c25074b15322c3cc29d6961903467f9cb7d4def5a6c8e1e2d410c8cb813802bf08780454bf5c91b347ffd0bb186a07aeace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[1].xml

Filesize
564B

MD5
14b5dfb65816f42af8474c2b9bad8e11

SHA1
75f2c940799db503d899c3deeede7ed2b427b126

SHA256
8e8f83de5f400da5e7298e899bd0be271f5031df10654380e8a937039782caa9

SHA512
ff8d555a9659709fe8f213c25d6bafc9cf5998691b7f0477b76e99cf4efa2bfdb075e08a3e42d6443d120da50b0c41d5c1fae232e7aacc26671c9f4bb1cd1096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[2].xml

Filesize
580B

MD5
bb31b3c260bdec2fc3ad8b5183034d30

SHA1
78d3c8394f8bdd381598a92e799dcebd57a18f79

SHA256
ece5b808cdcbe4c190c5f3868bce371170e403ed33dede8554c51002f5fdf057

SHA512
158fe7774d170eea91f22f122626bb93c157599eb009623e0cd88e453357ff32b5a828672d44c515fcb60eec081845153e600f5012af8ec81b70918c698b52e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[3].xml

Filesize
591B

MD5
f7be8045b83c8a0fdf6d4762931ea10b

SHA1
c2951221e16177622805599c0437f4e9e9586867

SHA256
187b21c1fd7083fbe46cba074d7a2601ee8b0609224abc7ae2ff3702bc0b47eb

SHA512
20ed37f3577156ae5774cc3fbd7d2e40b7142b3095aea5b67229e53d85b53027f2f3713f1fa40f60bce92934df6abd388815de5f8d253a95c8882dbfed30d890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[4].xml

Filesize
610B

MD5
3cbe546e199a3aafa2567bd6807efe3a

SHA1
d82150ceae0558045236bfda365711e997696cc7

SHA256
af0463c25e7f460619f0e59265d1ac4fd3e94fdcb39e599008d6f903fc2895dd

SHA512
060a951cf6d0d86df268ad6dcd6a418d345deec6fa299571d974d42a479bafcb5f2e5fd02daf926c0cd42051a3b598a6e1267347ac1f125639dbeb9c89c2e304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[5].xml

Filesize
612B

MD5
5b7e987af1ba135ab3c46fb15c1ffd33

SHA1
95cac00f0908967c995425c3f735be3144e9c5a9

SHA256
7bd4906465c8ada2e56abf38dc0355b6971c6854c32a1b6496873c0289eb185f

SHA512
47f06b9074e8539929ae77850912edb48621e4d7b4ac27dbe53296c0de0d371db96b3e1d6777ebb35575ace8169da7c388d23fc0119869e0a25e09076028c629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\qsml[6].xml

Filesize
608B

MD5
b82ead795341d4a46f8a930fc10000af

SHA1
8c27acc98eb34cd4f5b06152e2e2a1f96a747edf

SHA256
e3b5d4fd8dddbfa33a2ee0c337d89dcc2388232813fa95cb555d9b5daa056d54

SHA512
91fc18b4222afb4c4b61615c113edf9ada166573d89d35f26f31d25f8cd66d91c8b3574baab14fadb2ae8d808fa916658ad985132f889c86354dd22f9051ad7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90FC.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDF5BB.tmp

Filesize
3KB

MD5
258a55ef9407a43689da7ec0809e2b99

SHA1
809a65926d40ea863a52f664aabe921c496b70d3

SHA256
7422d692e0b1a3720221fb3e834a5b7e0668510a43c9d0a883cbdf3d7dec9c8c

SHA512
083df3c7c141d950452937beee2dffc6dc96739bd6c7434df28b9a6aa8268ff0e2846c54e08e74d2ee4bb4851e4f3baca934774f9f92aaa26e8b57880f47f7a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91AF.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
C:\Windows\TEMP\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\NetworkDiagnosticsTroubleshoot.ps1

Filesize
23KB

MD5
1d192ce36953dbb7dc7ee0d04c57ad8d

SHA1
7008e759cb47bf74a4ea4cd911de158ef00ace84

SHA256
935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

SHA512
e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

Download Submit
C:\Windows\TEMP\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\StartDPSService.ps1

Filesize
567B

MD5
a660422059d953c6d681b53a6977100e

SHA1
0c95dd05514d062354c0eecc9ae8d437123305bb

SHA256
d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

SHA512
26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

Download Submit
C:\Windows\TEMP\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\UtilityFunctions.ps1

Filesize
52KB

MD5
2f7c3db0c268cf1cf506fe6e8aecb8a0

SHA1
fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

SHA256
886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

SHA512
322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

Download Submit
C:\Windows\TEMP\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\en-US\LocalizationData.psd1

Filesize
5KB

MD5
dc9be0fdf9a4e01693cfb7d8a0d49054

SHA1
74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

SHA256
944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

SHA512
92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

Download Submit
C:\Windows\Temp\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\DiagPackage.dll

Filesize
478KB

MD5
4dae3266ab0bdb38766836008bf2c408

SHA1
1748737e777752491b2a147b7e5360eda4276364

SHA256
d2ff079b3f9a577f22856d1be0217376f140fcf156e3adf27ebe6149c9fd225a

SHA512
91fb8abd1832d785cd5a20da42c5143cd87a8ef49196c06cfb57a7a8de607f39543e8a36be9207842a992769b1c3c55d557519e59063f1f263b499f01887b01b

Download Submit
C:\Windows\Temp\SDIAG_1f12ce8f-5e09-4dd3-a871-b984874279b2\en-US\DiagPackage.dll.mui

Filesize
13KB

MD5
1ccc67c44ae56a3b45cc256374e75ee1

SHA1
bbfc04c4b0220ae38fa3f3e2ea52b7370436ed1f

SHA256
030191d10ffb98cecd3f09ebdc606c768aaf566872f718303592fff06ba51367

SHA512
b67241f4ad582e50a32f0ecf53c11796aef9e5b125c4be02511e310b85bdfa3796579bbf3f0c8fe5f106a5591ec85e66d89e062b792ea38ca29cb3b03802f6c6

Download Submit
C:\Windows\Temp\SDIAG_6c283dbb-0358-47c5-a07e-4654ec188a94\result\ResultReport.xml

Filesize
34KB

MD5
a04c6318bf56cd5ff080190e0def6be6

SHA1
968938f67c70738f523ab8da29304d2e0e195be7

SHA256
f191e76d148338fe2eee5a8ea8db9e2723dc39655a8f4dce0cd0f54ef1ca5705

SHA512
ce2cea0f2aebbd7a96c5b897d7eefc6095fe2fcd9921c314670163150324df7398cbe01ee5811863429bac2a478b9170e4e6766d4b8cf60e488a473b5ab086a7

Download Submit
C:\Windows\Temp\SDIAG_c1098648-d52c-4ac2-9222-a8cec6e13e74\DiagPackage.diagpkg

Filesize
152KB

MD5
c9fb87fa3460fae6d5d599236cfd77e2

SHA1
a5bf8241156e8a9d6f34d70d467a9b5055e087e7

SHA256
cde728c08a4e50a02fcff35c90ee2b3b33ab24c8b858f180b6a67bfa94def35f

SHA512
f4f0cb1b1c823dcd91f6cfe8d473c41343ebf7ed0e43690eecc290e37cee10c20a03612440f1169eef08cc8059aaa23580aa76dd86c1704c4569e8139f9781b3

Download Submit
C:\Windows\Temp\SDIAG_c1098648-d52c-4ac2-9222-a8cec6e13e74\result\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
memory/772-3-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/772-0-0x0000000074A21000-0x0000000074A22000-memory.dmp

Filesize
4KB

Download
memory/772-4-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/772-2-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/772-1-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/3000-1168-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download