babadeda | a424d4ad76806d261477a6117dc0fd2b0517357a826f9d0d7da22aac7c0f5ed3

Analysis

max time kernel
151s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

output/pentest_sample_15.exe
Size

129.3MB
MD5

9a2949ed34685809e0a23bdfea97271e
SHA1

1ada36a15cea1e1b6c70d155518d2b36a03c4e97
SHA256

f3fef8eac63444e364437305ba947e5b9e098ea15cf7e30458ab67d272fa1fab
SHA512

941486e979b1a9a08e61f3f4bb348224fc9a55c60a3ec6a6eadceb6d8ea0b00b5641f549616dd01b374d8ceaf3e05bc41cecaaca27d8e980232de1a84a8d21ef
SSDEEP

3145728:zR/5KgSAOsWBD4TABLmERk6WFQLnZLmzxPj9MDOC7vadxZA6NnArUwxS846PjsN3:zR/b

Score

10^/10

babadeda remcos sys32 crypter discovery loader rat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

65.108.9.124:4783

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
Sys32-PI9IVT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001c752-256.dat	family_babadeda

Babadeda family
babadeda
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 3 IoCs

pid	Process
1736	pentest_sample_15.tmp
2992	pentest_sample_15.tmp
2064	Mp3tag.exe

Loads dropped DLL 26 IoCs

pid	Process
2520	pentest_sample_15.exe
2400	pentest_sample_15.exe
2992	pentest_sample_15.tmp
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mp3tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436927637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{289A19A1-9B0B-11EF-8E0F-52DE62627832} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000e4443a5546b437b6c5b2b78c0abb78bebd8771fcc483456ea8c87e94894a4525000000000e80000000020000200000005e2f00c79ea8e7e363163d1c091bd13a3dbf0589361a024d92db8b55456b79d8200000009ef5a6771f39580c56bd55064cd2e4d77808a733d515fe1ca6d7c6fe58630db540000000a8ea135d5ce54f7380af49c69d142caf1f6683afe08af8e734f4fbbded3b991a2fdd0ac78ac9fdeb282a97cab56158dbfd06cd92780c16a45a91c07a366a3599	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06f7cff172fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000000cbcde1014611aa21cb8e878fffef676fbab7387e969359cf6595d2b0648290f000000000e800000000200002000000070bd04462c63bdfe0a2ba5cc42cf516f6306980d239d1f632b7701e30be772c2900000001b03b472a10743a682bff197072a525625371f09b8972efed160a1d40fcf791b3026151bd208d269dbd63335d483b101e480b5da079b929943ec75be9762dceaeb7e0724223ff44f695cfd966fe9718f9bdccbe9f4af7b9869d7276819453d2e915a3594d1afadc7cd913cc2468ce749611ec1e3d88f65e162318971a089d55736379ef0863181f7c8146054e54bbece40000000dd79d5d84d2f6f0c334b06ea544cd126999dbecc1fce2472427a11a10007b3cf53724f550df800eb627367fe4bd7517fc17e2876efd007e876dcab40d15dd666	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Mp3tag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Mp3tag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	pentest_sample_15.tmp
2992	pentest_sample_15.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2992	pentest_sample_15.tmp
2064	Mp3tag.exe
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2064	Mp3tag.exe
2064	Mp3tag.exe
2392	iexplore.exe
2392	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
2064	Mp3tag.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 2520 wrote to memory of 1736	2520	pentest_sample_15.exe	30
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 1736 wrote to memory of 2400	1736	pentest_sample_15.tmp	31
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2400 wrote to memory of 2992	2400	pentest_sample_15.exe	32
PID 2992 wrote to memory of 2064	2992	pentest_sample_15.tmp	33
PID 2992 wrote to memory of 2064	2992	pentest_sample_15.tmp	33
PID 2992 wrote to memory of 2064	2992	pentest_sample_15.tmp	33
PID 2992 wrote to memory of 2064	2992	pentest_sample_15.tmp	33
PID 2064 wrote to memory of 2392	2064	Mp3tag.exe	36
PID 2064 wrote to memory of 2392	2064	Mp3tag.exe	36
PID 2064 wrote to memory of 2392	2064	Mp3tag.exe	36
PID 2064 wrote to memory of 2392	2064	Mp3tag.exe	36
PID 2392 wrote to memory of 1708	2392	iexplore.exe	37
PID 2392 wrote to memory of 1708	2392	iexplore.exe	37
PID 2392 wrote to memory of 1708	2392	iexplore.exe	37
PID 2392 wrote to memory of 1708	2392	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
"C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\is-14HV6.tmp\pentest_sample_15.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-14HV6.tmp\pentest_sample_15.tmp" /SL5="$5014E,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
    "C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\is-CAVLM.tmp\pentest_sample_15.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CAVLM.tmp\pentest_sample_15.tmp" /SL5="$50150,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe
        
        "C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.mp3tag.de/en/download.html
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e768d99c32655b4036a688b57d226c8

SHA1
8104138551710be8d19837f50c8b58fa7f4bb675

SHA256
92545f867fd1f4146649544dc076189933ef82c8e361d701acef94662372b522

SHA512
887be18c31615ebe59d7a8cfeefc1b22af65842ea9bdb5517b14ecd4904ef01a8067926da0bac733c469f181b191b736cc429505b272c64de797b7f66aa9862e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9279c725de2e6f6fb378f4d808ae8c76

SHA1
7c5927f24be50494ce663ff88b5196bb7f7a3873

SHA256
8ffded8dcb43cf3a395ef1a9bb52c9f570e61f9b4ba67ec4ccbf003d3eca993a

SHA512
4ed531f6aec0091adf3a4e6de7f23e462f997b58fb8f9b126fc70c18811f6c60b0ab56b25ba77be2ed17b191b66453489a6bfdcc6ce219553f80317836b689c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1180977cc37f1f8538135cbf526f7df1

SHA1
5c60604311577abb5ff3c17b8812a23fa4adb948

SHA256
dfd8afc7bf5e2ccb33f96a961dd7addceec92d4fe5f4838ad07e4147ea07da2c

SHA512
1c4efa2d24e114fecd870a75786d992262699ddf29907e7d9deec64389b55c21eba700ce267d3a21d28de485559e2736fef953b83179e9b909442f2d875b89b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d318278342772019709aa79ffdb24b37

SHA1
950757b4aec40f9360309115e1136e55fbec26a5

SHA256
4ba523b756579a80df12afb46efff7b11c33d3c2313f4000902f2c2bae1a030f

SHA512
3434af886de83803b9f85fd442bf4aa5f707269a7ecaecfb8373a69f1bffe84d9d50d6543bcb1b28264d60cb1d8ac9a1a0f13097d2089cdd8b47c1f89d25b28b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8295d1d4587ad4cd0537c333efbb7e7

SHA1
7e5b1660c3e38c2b4932f41c4de99b1de404c458

SHA256
4798703221450e8eaa369a8c3e8855586091006c148fe8856b2d97837e64e92e

SHA512
249e578b816d67cb481eaa1677fde00fb16fc9ec335bf28821d0ca2c93f985c4221399d89120c9f5b39a8f65b79b93939889b02b7e3559246ad4c0c98ae4f726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f523352d99e44020e60479488e61f37e

SHA1
8a7ab9649e01936b3dd12c47804a4ce310c65b03

SHA256
23ca3cdaedc085be383dc90ec8093e6948d3192f012d66a9b5dff0ec410c898e

SHA512
393ea9209981b92bc11398298ed1ba39c9423fc380873c5e349aff7616aa85db9b1e7e15c90b4e1e62ae45527120607b36f27b3f27b2860c4a15b879e8f07978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c7de5cc6330f4727e9b55872e3edf55

SHA1
14756c29e7d26cd68b066ee3afeb5df3f7c002fa

SHA256
86699ca1cd2de501fced57ee72aa9a741227c69413aa3656ab59b9d453407f65

SHA512
0f8b00a03442f705ac2af8af5d4ba7c9ce6438bf9c21dfe6a5f8bf63d116fac861d47205dc66464d2d5d21d9fc2b3156b261136b8c1bd3b15fb21c5e64b0a0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa0a9d5e816e8bd6eb5c999d6afdc59

SHA1
1de82ae4ab8236305d2f8d8fbb8270cb9214c25c

SHA256
85f02e82a2a2c9986fd8fc52596efca02f68dabbfc679699403a7fd8e962422a

SHA512
eac7fe913aec140b7a66ef241de949bbab2fd5641d5e1b31c804a2c72fe078409c8d5baf6e7571fc6c632e94fca339e41ff80f8d21657c4df2f79700b476b989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c598f983983e303c8227e24c63a82f

SHA1
a21b16f120cd61bd66e91361e39944dee3ea4853

SHA256
789ac6291a3653990d3bf600ce9a876fda02e466ae9b2b70efb435f93fa26df9

SHA512
1b924bfd331fb2f76b2bb5a9cf44500916366a0caf209f1993ad755577eac2c4f3967e6c601057bec290c09b2dbfd8d9b903c6a91ba3e1f591ca6572b53c449b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b0a23c975d34218922c78234e5ecac8

SHA1
9a3b3141060bfb122c32f2ab1241bdc1f5e0137e

SHA256
6de2925a7d9788c24e9563b3d1affdb9a9a71d2e54df9f70bd5dadbf0427b2a9

SHA512
ec96eb327cf0e83a0ba3523c9739a7954bb753505593bae40d860d4110acb1e403b99e7491a796fe64f83a7aa674043cebcd13117ad288e27558ff37942af73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
457869a9ca1d55312c6bbaeb6e4e025c

SHA1
dcdfc1a7fb7dc948a7d4b387d45063ccc83a3238

SHA256
518c945274cce050235f10d49449a78eca920748ca2bcd4e5ffabd8f27676b2a

SHA512
d3d35e586e70130b4411c8f02395cf7d87ec260e89ea9603488c656470bcde1404143d5279d2d23c8d472767e19280a78470e786aa737e7395bd6ec3c6030262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4fb59d339184dbf20d0524746871b5

SHA1
9335ec4be044d0cff0ce2b5d34a8dcef2abce00b

SHA256
6596268d9776c73e2a561693fcd4c8f71563e3eb1c3056a160a04f51b9eb0fe5

SHA512
e905a01a0be3eff148c9527cff9afe0a491f5f249436b6698cb45194b9a9060e676a70bb6db5b380710d8c7407c693f98d14fbc37a33a8f6c1db9184ec60a1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b39cb51211fca6a3a3e9560b295fba2b

SHA1
b9b70143e6a9fb966d00d4610edc4daff7db9f55

SHA256
585d930e3b6559c77ea1990a7e209410917d3731b1e9bad198f2d419a22e2370

SHA512
6dc2f2a988a55bc2943e2fd4ebcc761bbcb964ea0052da99ffc6ef13fe54d08eee94f26164226ebe7c088871a86a52610ce4b839f68396a9ef4128ffe4e49df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d52c5006663a7381426bb4b4be4b143

SHA1
072a42d043f4a1405d6795a540969065297f1663

SHA256
9e16b6b0f9275c4c7f4780cc80a6bbf86462a7b25668d9d4405e9ef1cbeb57db

SHA512
60a91ae619a404c9258fa6f56258ae85de1a2a8bdd617e3d39c2b7e57bc40fd2dd39c372f44721043201922f2f7c82ffcbdb33af1214549032adf1eef02eda70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfea345076bf4c084437fdc014b24321

SHA1
d5f8b5659f8942513ac179ddabe50a1c85f8e622

SHA256
4fdd69891503ede6bf9e423d00c0e7ef250a39f98cbf184a2a18310d781493bb

SHA512
6e73fe8260fa5f654b04c1c1a563b16f563edc252b298d0dc86f58f32a8c24c317ce26c8d3aa837f53d9be9a202f9a765b2aa54e01ff23d384fbdfc7ca0410bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e42a5ca8a803ad18d82938a9d152482

SHA1
ecb098d117174b272158ebf268d5bfe376803f9c

SHA256
7cc0bd2089cb9dbf8daf3ba2633f2512e3df6265273ae8f2d9d727cb088e4962

SHA512
96979ab3f01535292ec71dd33edf6bc6d89455bea11c6397dfbed7df07cad5cca7a474aaedef9433bea68216a4200aaa6cad234d8157ae9225013644643375b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a176dae96bcabd8a06b12ea39d60d41

SHA1
d161bc14f33953d88bef9daec2300ef0251b8d30

SHA256
a4774ce287f302febd4441f6977ee741f27b6c39886dfaa57b51a203deaa6e92

SHA512
fbe5fcf09afe384f8079154f56ed0efbb710d5e2924ef8eb1d249a38a09a3de4cc9eef3ab2abedfefab9e995b3d21a50271396ff76e84e965a55bbdd9ec474d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfda3cb12e57a3d263a230686f824807

SHA1
321dc7dd9b6a87c22664a6091fc74d853270dc2b

SHA256
8836fd2ebf4247e49a5d691989d5946659f1ad8331c243c6b2d71aa9ad44def4

SHA512
0fd78ac359c3a400379790775b0bb630e4483003cbd368390046d1014b9fee8ebaea1613c70c1e59dd0293db4163cd543c90b1833d5ca697a2021765c9cfdf97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb09b5c1dd492ce17ca7a0411be27b4

SHA1
d38b4d97d51884b7419f7a9ef30093af0581283b

SHA256
b614bec87ffe50744062c0da177bdaed04479ceb2b57c6f16d5808822f31d45e

SHA512
609869ec1b8e6595af0e39056d356a3d931b91156ed6c984d6e417b5b83f954df069056471e514bffb5e885a9ddec9e9d9fef925d352add4b5990ab4fb9ad7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\favicon-32x32[1].png

Filesize
2KB

MD5
6e91ca8e818f981a1ae3f9166f8047a8

SHA1
cfe29fbd74dab1be961f763a7496e7a5c5dc0ec4

SHA256
1dde4d031564589958a25b6accc410c701917ea8c02780ff268ee8d1aae0fb58

SHA512
2447f3f59fde7cd84c14d1799cee7ea23bf7a5ae71c08fce14b1092f93aff542e41f1fa55419988ce3127c7556170c9847b69456d821a85f3daf48e5fcfc6e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6BE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\logs.dat

Filesize
148B

MD5
0d1b4e919caa6f578c903243c87a769f

SHA1
9aaa3deaa3354ee2a07a7bd05510cd9601cc97b2

SHA256
91f090eadc738a17b4c87b21b77b3409bc48209d474a4f4599098d2aab6f42c8

SHA512
72af6efa06ad30cd875fdde82623d63528cba9d53d03674fceb076eb4556836f0d53409ae6958e0d49e202972e8f738a744295ca9dd22e53b710673517425f29

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
422adad24e8da100f85bf3de86b5f302

SHA1
7004b3ed8663b5890cd25e1a7899a766be912728

SHA256
e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956

SHA512
e689ecb1a1cb1e7735cb6a961fd054d87bcad01acf76950b14a3bf4e08ddb7a8d31805c203374ee081a4ec13c40b25b3dc83b3895b9bfbd9c135673e98e6ee63

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
ed215daa7493bf93c5eadef178a261e0

SHA1
b20c8dc7ba00f98a326f5f4fd55329b72f8e5699

SHA256
8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26

SHA512
3ed052eada11c3dc44f81f330bd2a2526170515bc6a90281872a93ee49f9add8c9ad36b9a9e9185e251d664c1694d06625e0148e113addc32e53d705d2655f03

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
10731d3320c12abb62d3866d7e728cce

SHA1
df4e131c825d1ca5cd14e00e5c04785d6ca508f7

SHA256
9f3eb90963916194f167e98e049707b14fa84a3f11cb8cc7b940d95956601700

SHA512
7eeef98682872fd95a38a03435546349c8488607e59870086b486b807e8b53893603175d9ad0f3b80c1924381daca8d14868a6079988a944b005783b4e2e358e

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
cf5f256e8cd76ba85e6c3047f078814a

SHA1
b7cde77313ceaae76a46c1111b33b3d8f47c4214

SHA256
9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1

SHA512
856eff4fff1d11a725af9c3e5ceac6d02a89297a16e97edec171839aa12c468fc37d60ec5df06d507cee695f71b7fbd4bc0ba51b7934d886e66a43b249e62da5

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
60ffdc3ef20b127e3fd14a0719328c34

SHA1
b510833350328f79a79fa464ea9d5e9455643659

SHA256
43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9

SHA512
caef6ee08c9f6fabecef1f0be37ab34e2d4dc22f15a775b2f0dcacda1f0fcdf2259399e6fbab85f0f00e8e4b03d77fe88b85b901a9ba2f775a50f2da724da26e

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
f681a45c47ebb2c56c1465677ec33ff3

SHA1
06bf7798c51325cf1806e14dea56ff98b05b7846

SHA256
3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af

SHA512
eeb05f1af7e1c714c658e9aa06e8c6dbeeb5f2e8dcf3fdb7b9b408018e41402d83893472114e0cf6d3a9a3bf54ec45c4f7a4840a09570d190277aa3514681ab8

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
376b4a7a02f20ed3aede05039ec3daf0

SHA1
c9149b37f85cfc724bedc0ecd543d95280055de1

SHA256
b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c

SHA512
ff7fba7cd8c9b55c1c87104d7d9074ef0eed524b02480ecf2c80e5cd489c568e1ed63bc62699a03272cab3dcbf20e6437e1f47ce112bcb3336d27ed2790430c5

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
6376bf5bac3f0208f0a5d11415ccd444

SHA1
c3fe96e51c3f3e622dcedd2ddf8d23f9442361b8

SHA256
e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e

SHA512
9614e423c850bdb584f18555825214d42106966b1ee71e75ba7407591aa5de407b43909ce972e1923df82e9a0e953597fe19646296962194ebeb1579493d91c2

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese-H.ico

Filesize
1KB

MD5
1fc48b93562b46e428a2db1d4ea4a099

SHA1
772bc0d8527c5a0450fc0ff8ce525fca240564a5

SHA256
0b29a27f3d2ab4379cd99e9e7a93f6e40a0fe12cb73d1e6f3d296ec2c7e38a58

SHA512
55634f207c835a4dfd90ea1501a9ea5a0c406940def5f3b690d8b67085da8e61e890b29be679da61e8ce58a6f176b9f8927c02b81dea25a9de5561e1ea054a58

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese.ico

Filesize
1KB

MD5
2ca29c521af17539d17968900ed650a1

SHA1
b508852a5febaa2ebd942229cc9104df4059430f

SHA256
1b8a834029f10ec10d796c8344b990df082a3b3c67e8f480d8ce48c07177d549

SHA512
90ba3bd6431912fa44458675eff9be42d99665b505d5dc4012591f4b018033ff95c6b7adceffe639040aa32ed2ef8c978c249fae9ede5a2db26e9b522d61d11d

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\English-H.ico

Filesize
1KB

MD5
e5e33562181f5549042249668092b0db

SHA1
7103748dd38ec44a3dea582a9aea2123870a6937

SHA256
1dff252a4f45c471b8fc81d5d1c94ac1ca918a2ec0725b875f088cb75b53a938

SHA512
9cdf1a067383086d7ea79fe145e84ae6be8b1e476dcc357416941c8839c46eafd496f865aa8c553df6ad61ea1afe00004cc3df22a395cbbd53f4b45423468b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\English.ico

Filesize
1KB

MD5
1a25e199fb242d852a2bd217fd038bc1

SHA1
9276090831fb29e65b781624ccef3c2390014c5e

SHA256
668c3afced3f33fa016a3b1ff65715acb80823172493ded605633e937000b235

SHA512
347d5b00be749330f173b8566f6a80d905342c099d6e41afc856ea5f5837342e40a3a0e376bb50f62fe7f841a53aa04e93161d6053159324c51e7ff89decedbc

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\French-H.ico

Filesize
1KB

MD5
76872d444ab4c1719b42cf5417f1105f

SHA1
a6a1a7e596dd4068e9960d30525e4589b79bd4f8

SHA256
82ea4ec8fbfe3cbd3cae19132d23455ee2bea3ab65f2eba353359f0a45183257

SHA512
4415de96db7510a01369d8357522e41676d0be3249f3f35c03553d100714ea2bb4181ce9c8c5fa0d87700060574cbed56c9e8867023716beb8aa23ba67b6ff5e

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\French.ico

Filesize
1KB

MD5
31593b847d0959e8cf06ce0d6e55a95f

SHA1
e9a160d5c941b64d4f27f563410e5974d8f4adeb

SHA256
86486cb827bc98405ccc888170a08eb0772a82a88c3408060c5d271358f27a00

SHA512
9c75add56ca25c473b00f4c4c87c2e12ddc3ab1c95eaf969ae3dedb81c3c5804a9a445d7507f7698833cf3b22f734b50091d1b47b7d8d3062d27d58924dc20ea

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Polish.ico

Filesize
1KB

MD5
ad8bbac74c6010604a7bbd9e4df43688

SHA1
eb18b66c38b2a5ad5fe98177b677b4ed36c898aa

SHA256
5a98fc48378b8772579632706747d35d3f16c542fa5f0493b44100a0104eb559

SHA512
6df720edc81ce9af7e26028073219fcf3d8a503285bac95e9bbf2f6e7dd51e05624d72d9cd7bf670bc9c081ebf25dcde728ff7d21386d5a1d8330b1988527c56

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian-H.ico

Filesize
1KB

MD5
ee464ce2c72dc4a01afccf12b318ea23

SHA1
9cebc61498162ca4847519cdd0739f97399cd396

SHA256
596b46cdafb26774740466a73d4031813511db5840d2fe5c4d90284278a08d99

SHA512
0645f8d741feea1debe9b7ee484922499d44270783ba3d4d65232d7b6f2bb113cf4adb8278b78fb8dc725228fe21e912a2b8b228cb08d58015a537d4774e7a62

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian.ico

Filesize
1KB

MD5
ed0fa2d2cd41dbb442b010b4bd2cca9f

SHA1
783d3843a976bd91829398f9ccbfa5b98150023e

SHA256
7c24485ad1023a46521ed10a38ea762cd9c185aeed7dfd32a717d274606d8074

SHA512
4b2134844bfb56b9ba266f6687359117d5f0c0d5040213c025d906fab5ac8711a09673bdac342c59bfd1bb0fc8294c5a4f97cbc29567bd2c52b90dbabddc1d3b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish-H.ico

Filesize
1KB

MD5
959a045dcfc52077692f0d091db9054d

SHA1
ecd119a1e382f059bb9b04e37222ac3257272994

SHA256
73fca4e5f38e65f21b2b7251231178e64ce8cb288044d064e176965a1b4dc699

SHA512
022939b3cf3bc0555b190ea61b7594fe24f87cce44ce371f081d67202fe085e19a550898a4372bf8cca0d492a9ec837ff3a9d680998d2d5b35c26a5b0f042a98

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish.ico

Filesize
1KB

MD5
603afd32d12ed4bdc1bdfbb11040f271

SHA1
ac68f01be1f873330333ccacebd8079e2a72adfc

SHA256
9eb18c0dacb6e60abdf315b853fd6c9db8968ced959b7d31d1dcbc80b561bfb6

SHA512
b93869f43ae9cd0c1cac0d21b588527a3f93eeaf972ecf1f6d167f36d5f8e3d677daee6db0e1d409294e939cc8f2be2c65f4c0fbd5ca5918a09b01571a630c33

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\page

Filesize
1.3MB

MD5
bc23ffe164676054ce5e5314abeaf11a

SHA1
eebc94229ce1b1a51d4dc96399d1ebda0b52b075

SHA256
dc36a03e536fbc03b4a89caa83435ec57fd021386341b53e23b56b359d988ab0

SHA512
78262e6a18988981e8a4f82fbf84e00d9058480912947851c5491a822f8f3c27a3345acf37bc2aeff514251024a1304fba087cf63f699b99af0299e9b0b26cdf

Download Submit
\Users\Admin\AppData\Local\Temp\is-14HV6.tmp\pentest_sample_15.tmp

Filesize
3.1MB

MD5
7388fff746d0ccae6e5610e87ff63b7d

SHA1
3ac665008fed3810141cf530627afa365df6dbf9

SHA256
85431ef6910699233ecd80d08c13f5507990b9d5d668f589768416c4a25b8494

SHA512
9a5002a93c0b53854af4c55c26ec65709f4080e6940b22729a399f844a2513a55e37cca1df960992996da8976ab8a918baa7b970afbc04e25b0f511bec7b4d00

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe

Filesize
8.6MB

MD5
92c1655770e49b1dc19359ea1f02e780

SHA1
16b459328f086dd988bfb2b45288d32652400301

SHA256
bf9a506f8c9409fe9609c9590477fdb5cbd185c7b76344260a2494ec064feb28

SHA512
b5e7d6eb435411449402840161d47ec17a6d7f24853e3536d0619dfec5b5fead9de9336560a434735c343e2d96f22d97b9be6c5a52e708c97ced6999808946f6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
86279521328398e87699d248628eb13a

SHA1
e4d4c39bda90635f1f5c2fc58b1304e2daac9caf

SHA256
3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337

SHA512
2cc328955611ad8369ff9facf9c1aabe99a20c3ded2977ad86c69e0f54acd78fa6f572ed688625c8c63016826a10b3578e3c186ef2b39c4bf393ab5e399913a6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
602a35b140d9d68d7b3e488896158365

SHA1
f1ba615abb54ff786ddbc74dffffd56394bfc892

SHA256
43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52

SHA512
4388947f90838cae8b5f8137c9ed2a099028b4341da8c574d536c6ad096bad0e217e105f0367750c70e3d3ca4857255b674955c71ecff0fda9c47a4b1951b8b6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
a07afa26ab56a8d3b8b16591a1962005

SHA1
2b6f3143487f747911ee20f039f1ffb1381858ac

SHA256
6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b

SHA512
b77b277d10cf6b8d209679684ead55b4347caef3213acdccdee35b5d4fe0e3fc136daf057830512c5473c4653a8d66357927c4b7d204c07d7508f792299d7fe9

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
a9c7db516186c8e367fed757e238c61a

SHA1
1318d6496e7146e773aca85be6d0e9b87a09e284

SHA256
ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659

SHA512
6aad003287afe86abccf34f6b15338c0c7380f4837805d919064a26380d2f3f7698515f927c148e618c12f0943d3621184bebc70a8b07eed64ad88689fbcc5cb

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
c6385b316bb04ca36d76b077eeb9a61e

SHA1
fc376f68798fecd41fb1c936eed1bce3f2ee6bef

SHA256
060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc

SHA512
bddf0f34bedb17ecf1d270a0613f27d174ae04f920192d7d1af6c15245175318b29691e748c36e2ce0a3027495b2f5a0bb688ae16095fad9dcd8c283b6d1b1d4

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
311e582d5d3d8421e883c4a8248eacc8

SHA1
c99e61d1446fce0f883a2aad261af22d77953a59

SHA256
369cc4d3bb05f4160a0bc9683feb1df2e94d02f061e4b23d53c3a6e2230cd5e4

SHA512
050ed1310e667e6bb22bb7952794745df1eee0c78f18240cc2217e748a11213d094b48153964c3da0ad8141da1709ece637315633396c77c035bb0565fa981b4

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
78dfcb76dc8b42411dbc682f78f5c6eb

SHA1
e50f6719fee44c70518cf8442737a688b5f45e62

SHA256
8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f

SHA512
968bb3bc952f4057f74c9c8825fcc2db34b9c56166ee39db3bab3d4ecf51fb65af250a8a65340274a1a0c0eed73b6c8962df5d2fce586c1ef4e19706edd5e6e1

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
8bd7a27e6ca969d3eb46086d411ce05d

SHA1
3bbf6f55853b1487debca58d7cb5c877d0abd517

SHA256
8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c

SHA512
fee8359398efe6a995a214d4e47de43aba12d33bb9cb1de18659d332d94ef83a4a77618b6caa9f455b0c6da4c10ab459209d483b9e778d9b522771ca692ca454

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
00446e48d60abf044acc72b46d5c3afb

SHA1
0ccc0c5034ac063e1d4af851b0de1f4ea99aff97

SHA256
82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a

SHA512
69114f0efb3c853bffb55c15e5ad1b7919057a676056d57634a6a39916e232cde2dcdc49ea0f9751ddea6550ffa58f84b1f8918b3c9fd7e88c8b8f7eb4afeaf2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\libwlp-20.dll

Filesize
19KB

MD5
fa847fa54c646c39fcf8e58c6fdcb46f

SHA1
d052ac0346c77be6d87c2da668543c63d3307036

SHA256
a15614de6f933f1941dbbb57641900439c02b3a90c40e409e32cae5c04426378

SHA512
3dca61429b7572d3106d095cea128b8b0bb8c685f0251b5920c8d69d828d33f90d507ba62033ab29cb8bb2d46e8574d0b52c7dba8181c2fa98ed304a8ed80cb2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\msvcp140.dll

Filesize
428KB

MD5
fdd04dbbcf321eee5f4dd67266f476b0

SHA1
65ffdfe2664a29a41fcf5039229ccecad5b825b9

SHA256
21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

SHA512
04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\tak_deco_lib.dll

Filesize
127KB

MD5
f0bf722006ebf17f9a194e892ba2bf37

SHA1
a483e46857f29e98535a992438006c962e0404e5

SHA256
a737f6f613c161938ef4c795fb0cf1a0a7bf7e1539cefebc030fc36ac37bf0af

SHA512
47e4113ef649539db6b7ba52106477ac415fafcc0fad5b9a92575d18d110d1fd21e906cecf2546ddc20ef554e09f3da418a5066b70b31dc1360e555eb2cbd0e4

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\ucrtbase.dll

Filesize
880KB

MD5
5dafe0bfb955e780b3d50da4524b752f

SHA1
91c0d9fabe748d373215ba21b90278671b5f8957

SHA256
6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9

SHA512
37fd37f3ad87838f596d1e8e497fe66d1a1c4128625ab456ec850179dd1e1f33cf4945d0faaf6cdbd1ed586ecfb7ff3e7cf10a88a823cc5eb06c2fc4fa16bff3

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\vcruntime140.dll

Filesize
77KB

MD5
ba65db6bfef78a96aee7e29f1449bf8a

SHA1
06c7beb9fd1f33051b0e77087350903c652f4b77

SHA256
141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

SHA512
ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

Download Submit
memory/1736-14-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/1736-8-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/2064-298-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-306-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-403-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-404-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-399-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-437-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-356-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-312-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-294-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-295-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-212-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/2064-301-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-303-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-304-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-305-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-710-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-836-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-837-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-838-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-839-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-840-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-842-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-843-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-844-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-845-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-400-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-847-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-848-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-849-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-850-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-851-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-853-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-854-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-858-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-859-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-860-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-861-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-862-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-865-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-866-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-310-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-309-0x000000000AF60000-0x000000000AFD7000-memory.dmp

Filesize
476KB

Download
memory/2064-302-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2064-278-0x0000000005200000-0x0000000005299000-memory.dmp

Filesize
612KB

Download
memory/2400-260-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2400-11-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2520-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2520-17-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2520-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2992-258-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download