dcrat | f9e0afec65e6aeb4af35617e7967b028a77e6b5c10de2b7b064e9337d8f1ef4d

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Size

1.7MB
MD5

1d98bb52c2eeac75f2e83e8b0b88459f
SHA1

ab0db0eca10717ad295b4c015db9d51c20bda41d
SHA256

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d
SHA512

bb05cf51b6b7b4318bf81b9cc5831e558018d7f2347429ca4513454f06ff3ba5c77b90f82fe533dd5ca60139b059daf65d752b5648c702d2ff4af6e648421e26
SSDEEP

24576:1v/SzhQO98aL85esKGpBAYMygXEO9rjZfyfs9o+cayR4k4m2WVux/Egw/u:1v/ScA8oGAv5/c14rvuZx

Score

10^/10

dcrat credential_access discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\3c6609c2-3a8b-11ef-9675-d685e2345d05\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\3c6609c2-3a8b-11ef-9675-d685e2345d05\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\3c6609c2-3a8b-11ef-9675-d685e2345d05\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2708	schtasks.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/844-1-0x0000000000350000-0x0000000000508000-memory.dmp	dcrat
C:\Recovery\3c6609c2-3a8b-11ef-9675-d685e2345d05\WmiPrvSE.exe	dcrat
C:\Users\Public\Pictures\Sample Pictures\RCX2D3D.tmp	dcrat
behavioral1/memory/108-74-0x00000000000A0000-0x0000000000258000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

smss.exe

pid process

108 smss.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
108	smss.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\3c6609c2-3a8b-11ef-9675-d685e2345d05\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\3c6609c2-3a8b-11ef-9675-d685e2345d05\\WmiPrvSE.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipinfo.io
8 ipinfo.io
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

flow	ioc
7	ipinfo.io
8	ipinfo.io

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60666E61-6735-11EF-B1C8-F296DB73ED53} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431228309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f36454c6e22ff62e8b0a4230318c82f6dedddca88d192aa05e0ae764cd02a95f000000000e80000000020000200000002cadc9a813cec9b844d1c31d3b2c59bdf6a85a763884a8f70020eb87104937639000000001ec8ac1089f23309286302ed1a0b2dc598ca8fb5ec3a067b111bdbde2c098d55b35ce33d577d7b406dc7049aa439bb1ef2c710eccfe5ea3266dd7ab11e47300a5d287be482272f7f6f5e6af723fd5c0fc7787c9b765a5600f160967d167a2a134c80ab7557478158d1981be5a272a5f0347ef93791af6f9330054e07ffc1ee7da8aaad5540b14b7792464732349b1f240000000861bac77d5a794d8a200f2aa123e4bb167b71af15e645846363958083b7908103756c93d29b7cc901b4fd0b80286f1fe11e41aee2fe924000a05fa99087794f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000916a9dfff552e09d1044a238c7886c1a1e1219c0a06a94497dd272395ada1fb8000000000e8000000002000020000000535740e7d403b982d9f06d43e603f7ed4cc232dd2184adf8619dc0153380269520000000968f740b1c3eedaddbe8b1c7bc8356f1831287ec97f0266c460cd441969dd650400000006736bec7417855e56f677ab666fde6e623fa5c990a60240f9aa8da76828f517f1e7d7048704f72efde14bedf13167277b99f96d3d2cb967875fcd89e15459971	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d8fc3442fbda01	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	smss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	smss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2156	schtasks.exe
588	schtasks.exe
1676	schtasks.exe
2604	schtasks.exe
2568	schtasks.exe
2184	schtasks.exe
2816	schtasks.exe
2620	schtasks.exe
3048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exesmss.exe

pid	process
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe
108	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

smss.exe

pid process

108 smss.exe

pid	process
108	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exesmss.exe

description	pid	process
Token: SeDebugPrivilege	844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Token: SeDebugPrivilege	108	smss.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1528 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1528 iexplore.exe
1528 iexplore.exe
1700 IEXPLORE.EXE
1700 IEXPLORE.EXE
1700 IEXPLORE.EXE
1700 IEXPLORE.EXE

pid	process
1528	iexplore.exe

pid	process
1528	iexplore.exe
1528	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.execmd.exesmss.exeiexplore.exe

description	pid	process	target process
PID 844 wrote to memory of 1184	844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe	cmd.exe
PID 844 wrote to memory of 1184	844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe	cmd.exe
PID 844 wrote to memory of 1184	844	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe	cmd.exe
PID 1184 wrote to memory of 444	1184	cmd.exe	w32tm.exe
PID 1184 wrote to memory of 444	1184	cmd.exe	w32tm.exe
PID 1184 wrote to memory of 444	1184	cmd.exe	w32tm.exe
PID 1184 wrote to memory of 108	1184	cmd.exe	smss.exe
PID 1184 wrote to memory of 108	1184	cmd.exe	smss.exe
PID 1184 wrote to memory of 108	1184	cmd.exe	smss.exe
PID 108 wrote to memory of 2196	108	smss.exe	WScript.exe
PID 108 wrote to memory of 2196	108	smss.exe	WScript.exe
PID 108 wrote to memory of 2196	108	smss.exe	WScript.exe
PID 108 wrote to memory of 2380	108	smss.exe	WScript.exe
PID 108 wrote to memory of 2380	108	smss.exe	WScript.exe
PID 108 wrote to memory of 2380	108	smss.exe	WScript.exe
PID 108 wrote to memory of 1528	108	smss.exe	iexplore.exe
PID 108 wrote to memory of 1528	108	smss.exe	iexplore.exe
PID 108 wrote to memory of 1528	108	smss.exe	iexplore.exe
PID 1528 wrote to memory of 1700	1528	iexplore.exe	IEXPLORE.EXE
PID 1528 wrote to memory of 1700	1528	iexplore.exe	IEXPLORE.EXE
PID 1528 wrote to memory of 1700	1528	iexplore.exe	IEXPLORE.EXE
PID 1528 wrote to memory of 1700	1528	iexplore.exe	IEXPLORE.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
"C:\Users\Admin\AppData\Local\Temp\6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c4V3lt5QzV.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:444
- - C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe
    "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76b057a9-4801-4c3e-8725-f801a005b202.vbs"
      4⤵
      PID:2196
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45d364d0-fee7-43df-a11c-c1273336b17c.vbs"
      4⤵
      PID:2380
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12128/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\3c6609c2-3a8b-11ef-9675-d685e2345d05\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\3c6609c2-3a8b-11ef-9675-d685e2345d05\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\3c6609c2-3a8b-11ef-9675-d685e2345d05\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Sample Pictures\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Sample Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\3c6609c2-3a8b-11ef-9675-d685e2345d05\WmiPrvSE.exe

Filesize
1.7MB

MD5
1d98bb52c2eeac75f2e83e8b0b88459f

SHA1
ab0db0eca10717ad295b4c015db9d51c20bda41d

SHA256
6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d

SHA512
bb05cf51b6b7b4318bf81b9cc5831e558018d7f2347429ca4513454f06ff3ba5c77b90f82fe533dd5ca60139b059daf65d752b5648c702d2ff4af6e648421e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c051ef8034717af6e49b1379c7257c50

SHA1
0d6a9ad1f93093593c997c1bda684854c4bf4ccb

SHA256
fcc5723d43c0eb4017a63183979d65c32a77db8d8b04ce0f4f5591be49a7d175

SHA512
e89418ece626ab39d470209ef2a39862db639377ae82afb51f1abb899576fff8862a0fa233a45ea5e17fd4a1ecc2bd8e6cf791b3f5b678f3754ff743b1de64b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb53d28fec67111f9ee1b97821b3b17

SHA1
df29e74fafd270c0de6c6047ad7b81ed1e0cf7fd

SHA256
40bc0102d0477d9ffacfa0dd24bf53082fb6d540282a324e59e40aac4a4395ff

SHA512
5579901fe462124d22487acf0bbd7d2014bda975b30ba53e0d9d5cf1cbb62927888dc622ef8a326c08ffcdfd2552428c477d746b97548172b93764bbace8ea5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e5a69157994fe1f2c6de8b1ff29f2f

SHA1
44ca0a79eb5b0909a38131e6d371735c4b4f531e

SHA256
14a7c1d202ae2ad5d8e52fdbe19ba768149fea6f6e446f7e64b039b615d2b21e

SHA512
8aaeb2dec5de2eaacda22e3bb61b32139a269d64ab6394be815ec4a589d19837396d07512f3b48092d99998059580a10c488e012b70fe8577d87c217dc8fc1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3377dcccd80e36c0b8841cbba8096d

SHA1
7e3f063f6f546517614c1824d9a7e703d02f4ca9

SHA256
87b4f47ff4ceb43354ae456d8e8b29fa98d886ed3c671c75b967c21d00becf4c

SHA512
e8f66aae40c6a63953337884d5c4b2965621fc5950abc727145d46a680f6ab0d7b2641baaaea122256d2407b32ac60d52c02d17aa5cefc52849e2ebb16fad5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e0af214d6d98d2f5b74f247c03e79e

SHA1
ec09d5cbec3f1bdb3032a1421c9c07bd4c46c6d5

SHA256
2a87b0ce0ae5c9e047038bd927635773b984cdbbc24e58739ad251ee89e6a2b0

SHA512
506d43f62d88e2ae86f0e4cb12bfaa221ee70ae539c1caa3d9e35a3062acb6db649bf1b61d9eaa0b14dfee2b2a8f3a8ca21cc274b95f59cc02f6af2637e53214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
701830a096de5543e7574a3ef8a4bea3

SHA1
02b4ef8d8e9952866b2d74e39ba2e34e88195fa6

SHA256
47333cf34e70e2507ac55f11ceeef91b93fa6d27fb23762f085cf8dddc61cebb

SHA512
2448c7b0ab1b7213fdf5e24816a96b408ef968416f955b71cb7f96e995381eb8590c918dc06a272d63983a3380957a3874321563d39bd221d5976a38898d1c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3c688a90074f6ec034418f57df1b68

SHA1
6da414249497327111b016440259fd96b15e1ba1

SHA256
a41b37ae08f3f9477ec043804bc8eb66f68746d671640e3ed861c58118a02ba7

SHA512
6a4efab95b7843fd8c788d4d572d47aa592f1f9c921290e2fee61de9847b4229df7e86aa6b7491c82fc014f9435e386797b7956e96353dd8037d7c9350e40a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e5b4ca297052d474dd3ff3ac4fab15b

SHA1
78ee7dbd0c296ca9e4d027957f166387792bf39e

SHA256
149053cdf7fd9e41292eab49f55ce48c0bc26b0addca630a99742315b6405582

SHA512
f957f0b0195bf63a2491a9801b849d05800ddc8a8592f590dec37b3e4b58ec0657aff786cd1597e628b1a76a849473bf70926b7407641c94102febbc38e92a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74147e09c1c7ddb38c486d9a2280ef0e

SHA1
208fb6b78e3543da9f4c3197317d52063f621aad

SHA256
5de435eb11fac7aea78b6648e97b1291101c7a21608e7bdc370c0434de3d8ec1

SHA512
2aaf2724bed6e808d2c6e0a63ef6233fff38c7e237fde69d7374a5d6518c46dbc24ec35ef33129ec891fedb98cb05cac84aa0f158d2e6da0dc667276e1bbc806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caf58816f726cadbcb5f8c47056f50b7

SHA1
9aaed60c1dac6f0bb681a5b4518380a7a45dc5d4

SHA256
a24427ca0b1ceae224813366f9ae00537a28c4147769815d337ec312c2fd0f02

SHA512
858b556e60467ba0a09d06dd55b62873352ffab0a636aa150371c6e9bbbb5cd5c4c6f157a896164ea1874922bdc9b81f18b8b764901819a453c0175aa904fd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f889988945a473798563c862a9de0cd4

SHA1
dc0f9a3dc140cd70ae4a7c2117c701dd3280713e

SHA256
ee1738d8e659e0c23e0f9353b01083c75960c754ca0fe8568d803d9bf9dbf31c

SHA512
bdd3e5d21482cc0db0b59152b763c8dd23bab35db15bec6e946c595e74657465acf82579a87f1875c3cb2f97439bcee57db2a1e29af7c6b874768ff0d24686e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9ca774965557c93b6a6a6f7889b9882

SHA1
f1e59d31add8320f9f39ac766d7be29917eb15ff

SHA256
86637e9d08fa4247c518a86bd7d56e0b855538715433f879af0e836363117621

SHA512
8630e04393df916faaa755829b1e3a66c480a9ec5556258dd9c94c7258eadaf395f6164c1306f3a9f124b5970e35ec175e4be732224207c85b617d2c33b8c306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5ee4d8f14ad5d4c3862e0cd2843cff

SHA1
e4a2a8a90d7834f913d3436e6f32be67a085d41d

SHA256
90dbf4f0efb6521492d3b946c386f55c7e9fd0aa1a8b51fbb39ab3165c0d2c88

SHA512
ad19a1fe426a46e133a6aa2e7c627be6e3219c2ce43d9401d7be443d0dc608881456d736af51c3724facd434187f28b8006b6555dfd37c3c0550ce0751f8c05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d064a1681d4a3c381a3c1e730f1ffd1e

SHA1
38ead02afc8747e70eea05dc87c8cee9ce62f6b9

SHA256
d284f1f7969400a7a4c6714da36fc71e2caa443002cf325059ef83151e92968c

SHA512
8c78dcdc11743624d0f2c1921a0468d936e4affc275fd579809f995c01bf29bbf4b497388caa5c5305e6799290e06d0af5177c1c4e5d230a20a4ff09bdb2c25c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b581ba1e4f0a9bba75016e36d7731da2

SHA1
037cfa1ad546ccae93499421a6e3134f2e9f0cf5

SHA256
298d27dd4d5ee2d5f3d05fceb1a5c567614fb19f9c32c4a64de9ebb3d46cdf6f

SHA512
8fdd6376462ab4a33354c831e35c3ad4184f77ea84a7c9029708ae75b5de0b24cb64522320f5129c7b5c9006868fb6ac084b20db9a5871902f192c4058f4c838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cce03b0158bfc5a5fb70bb250dd69d44

SHA1
7df15d250f301dd93000499e24d64f353502c55a

SHA256
13f23326e8d97233490e0196d317816a77d0844250deb91b8f410c6fa2f3480a

SHA512
30c29779f47d5ba46a1c006dfb160457c2957568a4ea793ce87d60026ea8b4ae63a1a0dbf8b74c6136ecfc3267c4a0a3a3c67df218109c4d34f69197b71fe42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f69ffc8aa08a62dd86b0b4a9d01456

SHA1
59b0d6a11a39a759cbca706c44f9886ddb8a661f

SHA256
55848df8cb5044c0b3541010582df1e3c0d60b81515c450baa756c0dfb90ef72

SHA512
2e0554b5030678f56ef8289a985c8507395acc8d108fe38ca097e081a1c32b6eceb11264c90ba7baccde900a4003f349cad9b9f572bd892624d9915eb9d5f55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17f4a2d43bf227019d6fbc2f71c2dae7

SHA1
748ccfbb367230ff15a2e83d81bea9d6f7e4aeb4

SHA256
4e86bd7d3af8c1cd850a55ab55d6a7eae8e0c186cc00c3bed9c7dab50a248aca

SHA512
f356a8a3c8604e7f6c0f1369043eb78ef66bb31c122e8e0affb026087c3fdb55006fb6594cf96a0e77365abc85ec16317b3e44e2bf35251f7845e306178f0f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd4e668c40d5271eb2da19940a58864

SHA1
cdb45bab2761e2e1137153b1687752de83fca6ae

SHA256
c95442e515719d136b0256a784bc07cc2b5a02b5381e5fded099358aa179fcd3

SHA512
03dcd53726085c7d7e7f3ac346c95fc98f6f18c10114df347b4dbbfc865d013938c8fad61cc8f9562dc9059578467a27855ed5933d7e40fbddde650b84297054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
661ff082fdca347a006167a9ac9a88ae

SHA1
e2c9d714e32177d2424ea6f9eee228e641a310a6

SHA256
72e694540ed7d4a881362a4c00e6e6604cdcabdec6f5a6178f10779e2b38866a

SHA512
0a3920e8680704db0798fde5e3f273c1b5e70c15394d83ad1ed3b9ce57959cbc505e28053fd212a41b7c5fc2d69702737caaf83bcd420676fe267cb961bcb10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\45d364d0-fee7-43df-a11c-c1273336b17c.vbs

Filesize
523B

MD5
296e17553404fc4a098d179a71366371

SHA1
1a3893b91be42fce11dd2f43c933e5ee7e33a5d6

SHA256
10d0a0f652c3f8235f61486a3b823cb2c703593fa496eeba5536a80013bff474

SHA512
e48bf5d77697e8bde298d888acb05a210a1de16a864430ec54a9c05a20c3155782380c1bc5f38deb0de47c43f42df63af8787fa13dd4d0524b36754bd8923aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\76b057a9-4801-4c3e-8725-f801a005b202.vbs

Filesize
746B

MD5
46119df602473af0d0bf4b749f1dd9d6

SHA1
31fb3e3be23646386502d2293ce58ffe0a473db3

SHA256
cea4901c4bf293a91d9f40eb0cd7583f89d937fc8c8d9f3de7d028ae2b7178a7

SHA512
862b2a75cb7f0fc837b7091c9cb562829adbde32362788cb627e843492748a51f5091720088a70f9a06a5d4beb6ec0f40eb5243b80f2ce2e63806315f3ada7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A61.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AD1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c4V3lt5QzV.bat

Filesize
236B

MD5
af1882a3582484bd38720007ec4cf175

SHA1
3abd2216bc32e544336795fb5a606058ce3f027a

SHA256
c0cc180684ebd7f0e082c165060170b055fcb3ea30b89680ea4f8d357d5ecc31

SHA512
c3444f6b9dd92ff10ae5e821a8dfdd574a93e4b3bc2c1d3c4f4c3bf9eeabe040fcc5b3e0dca7b2596e46c02873a360e264ed443cd86e0d776bb77a9b4965aebb

Download Submit
C:\Users\Public\Pictures\Sample Pictures\RCX2D3D.tmp

Filesize
1.7MB

MD5
274aec1dc6b1373db8691f5ebee16129

SHA1
46b6476c005cacd0585473d9ffdc64584d4903ea

SHA256
127d3aaf0e2c58393e4faf95ab608ea0153366e54fc6060a7f651af0e89636bc

SHA512
7fba986a6ffae4d5b8f426fd5f3eb02878199fbca2edb7b8e586c1faca13517daee3712d763f78c455fe990cbcf1b9bbffc2ea7075cf48f6e1e4605d0d5ea116

Download Submit
memory/108-74-0x00000000000A0000-0x0000000000258000-memory.dmp

Filesize
1.7MB

Download
memory/844-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/844-70-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/844-17-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/844-16-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/844-15-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/844-14-0x0000000000860000-0x000000000086C000-memory.dmp

Filesize
48KB

Download
memory/844-13-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/844-12-0x0000000000840000-0x000000000084E000-memory.dmp

Filesize
56KB

Download
memory/844-11-0x0000000000830000-0x000000000083A000-memory.dmp

Filesize
40KB

Download
memory/844-10-0x0000000000820000-0x0000000000828000-memory.dmp

Filesize
32KB

Download
memory/844-9-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/844-7-0x00000000007F0000-0x00000000007FC000-memory.dmp

Filesize
48KB

Download
memory/844-8-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/844-6-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/844-5-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/844-4-0x0000000000580000-0x000000000059C000-memory.dmp

Filesize
112KB

Download
memory/844-3-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/844-2-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/844-1-0x0000000000350000-0x0000000000508000-memory.dmp

Filesize
1.7MB

Download