babadeda | a424d4ad76806d261477a6117dc0fd2b0517357a826f9d0d7da22aac7c0f5ed3

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

output/pentest_sample_15.exe
Size

129.3MB
MD5

9a2949ed34685809e0a23bdfea97271e
SHA1

1ada36a15cea1e1b6c70d155518d2b36a03c4e97
SHA256

f3fef8eac63444e364437305ba947e5b9e098ea15cf7e30458ab67d272fa1fab
SHA512

941486e979b1a9a08e61f3f4bb348224fc9a55c60a3ec6a6eadceb6d8ea0b00b5641f549616dd01b374d8ceaf3e05bc41cecaaca27d8e980232de1a84a8d21ef
SSDEEP

3145728:zR/5KgSAOsWBD4TABLmERk6WFQLnZLmzxPj9MDOC7vadxZA6NnArUwxS846PjsN3:zR/b

Score

10^/10

babadeda remcos sys32 crypter discovery loader rat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

65.108.9.124:4783

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
Sys32-PI9IVT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a4e0-260.dat	family_babadeda

Babadeda family
babadeda
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 3 IoCs

pid	Process
2352	pentest_sample_15.tmp
3064	pentest_sample_15.tmp
2428	Mp3tag.exe

Loads dropped DLL 26 IoCs

pid	Process
2956	pentest_sample_15.exe
2976	pentest_sample_15.exe
3064	pentest_sample_15.tmp
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe
2428	Mp3tag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mp3tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000005d1ea799e281009b0675684bd79c71ee2b4d2dfec79d44df9e8d6ac3f60b0c23000000000e800000000200002000000036f74cf32bf16fcae9e3f9aeee63dcc42bdaee43fd79e32d7b9897a0fcb49173900000003dd8df867acee02316beb7f297ba1544f1a5b6945bb3c7b5c5ace53dfc74e0d13077e35e20bd4e8b0cd69129ce6e58b459fa58d4890fadad448d30ac0297e7410d6582902bfd6ed283e723a78c35cf9034685aa4c9d7d11753462391dd5551241cf62b45d8f15c1bd8e063a34dd5f8a4c850bb59ab9d56856e3f859dce0edde31494dcf10896064554e8df6ac1b6d8664000000003d134a5c7a1903cf38f0134eb51a0f0dbd49972f555271ce1f932bea979e814098b70b7f694c65a57021b2fe8b530c3c6578d012dcafb24ef920246498c3c96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437001837"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAE32591-9BB7-11EF-9107-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000e2b0d582ee17febc02650a11778a902a78178bab53ea31810cf367a4c0f7aa92000000000e8000000002000020000000010831c37a7ded346f91094c04570e1d76699be580edef5298b346f15f79b6b32000000089870a7833bdeefafed971d47b540bb3ef3f332281ad54332da359413c64711c4000000010309e53a83ad977deeefca77690095a4e54f575756d368a5551f1379b158a7d98a8126196e45320d76bb4cc43750504ede72ca0aecb20bf87e3cc2004894184	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ba9ac1c42fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Mp3tag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Mp3tag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	pentest_sample_15.tmp
3064	pentest_sample_15.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3064	pentest_sample_15.tmp
2428	Mp3tag.exe
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2428	Mp3tag.exe
2428	Mp3tag.exe
2128	iexplore.exe
2128	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
2428	Mp3tag.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2956 wrote to memory of 2352	2956	pentest_sample_15.exe	30
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2352 wrote to memory of 2976	2352	pentest_sample_15.tmp	31
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 2976 wrote to memory of 3064	2976	pentest_sample_15.exe	32
PID 3064 wrote to memory of 2428	3064	pentest_sample_15.tmp	34
PID 3064 wrote to memory of 2428	3064	pentest_sample_15.tmp	34
PID 3064 wrote to memory of 2428	3064	pentest_sample_15.tmp	34
PID 3064 wrote to memory of 2428	3064	pentest_sample_15.tmp	34
PID 2428 wrote to memory of 2128	2428	Mp3tag.exe	36
PID 2428 wrote to memory of 2128	2428	Mp3tag.exe	36
PID 2428 wrote to memory of 2128	2428	Mp3tag.exe	36
PID 2428 wrote to memory of 2128	2428	Mp3tag.exe	36
PID 2128 wrote to memory of 3016	2128	iexplore.exe	37
PID 2128 wrote to memory of 3016	2128	iexplore.exe	37
PID 2128 wrote to memory of 3016	2128	iexplore.exe	37
PID 2128 wrote to memory of 3016	2128	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
"C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\is-5J1PE.tmp\pentest_sample_15.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5J1PE.tmp\pentest_sample_15.tmp" /SL5="$30144,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
    "C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\is-2P8PA.tmp\pentest_sample_15.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2P8PA.tmp\pentest_sample_15.tmp" /SL5="$40144,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe
        
        "C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.mp3tag.de/en/download.html
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
1628f7f6690705a5de3143ff14f74385

SHA1
b6f6f75249a326e8dfbb6d8e44f8cd830d630091

SHA256
62862d8611fb2ee7cdb9e36ac2b87748197ac9f14cfca7b2f4523186340b10d2

SHA512
c949591f161f8d128a70d3a8e0c62caf35e4bb57b42980a1dc23a087c834208dab12b436d3c8809d7c443227033eeaeef1d74b9d8fff7cb974ffbd2646598e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4ee7c2fdfcfd965f2dd6f1f252f9da08

SHA1
8b264decd7769e0ac3b71493c7073e029afb2577

SHA256
2b303d87287f3e42b9c5e28b40e38b84e7ae3be45772497997513805835b0b25

SHA512
e6e49fd8b26a0e2e90963dbddc810fffdb0f6ad134b6c7e029361cb592eca7bb6f80a7f0b16df4d18edc55147745762c34ac21894ecb530de84435693b761f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5269101eb3457a0923fe0c20a7f0739

SHA1
f6239e7131ac7422db2269e6ba49c52227386147

SHA256
ee70cf02e5476a60e91d0491971448567deb27f7068751f1bfe74f20ba40f2af

SHA512
2c681ca217f24aa3554015701e4dd006e05c7113687d59c230d3902f17d2f86c6051ad8c320ad2ee1f4d145f19d86e905070645bc0f7c5e6f68b560dcdf0fa29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f00856ce17eb83fe8bacbd23cdb97cb

SHA1
bd6390e97823484d0fcca8447adc4ba6048ff1cf

SHA256
f17a2630df5706844e3a60fbdf7d7122e5e4ede011355d49d0d1bb089963bca8

SHA512
780d87af58f7ef4c68b0051bd8d8b12255be84512468c004903175f096c3375201c6f5b730b0ad7200b1729ba66d4429c87f209bc45e1f1206a75c0511dd183d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5aa561cdabafd8681395fd325ae9a5f

SHA1
0a26c1a52778db8efdbad6ccfdc88ee107e4a66d

SHA256
a8d0be15454699173d6ff05d7f99fd9ad8e70d9f1d6384738c179f8c2a8bc3bd

SHA512
117f4ba4f7d777639f147c13b044a4d78e198173f7e2a974362cf6210b14095c7abadfabb4ace7592a68d8fc6f986db37738184f60e886ac2f84c433b8e11ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f33cf39d0ac4669dad2724cd3fd1720b

SHA1
47273c1bb9339480e7dbdda55da52f202c529e73

SHA256
49927c7646974be2f8f697fdee3195c036f72686d1a023387042b30329b3ae81

SHA512
c241d475457580d1f58d41e38ea13605da27055c96a1225f6ebb0347c3283835b6b58e540d87aa5ce3053ce6b85e38116b5b5efe34b088986a5492e6ddca2927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2476003d440722f5901409841d3f47f

SHA1
fe1f50d6d8bd8f9309856960b4a95a0d78fc7e4b

SHA256
45207bd818c00a28136fb13c72a3b7f8f9a666d0ea2ff51782a2635a5b4b057e

SHA512
262b52fd5b34b881cccf2a982296fbb4a905fee82998b316be0178afe9474a37e37fd221dddc19cddf413116f62c1ccdc808c5d8207c1047c4d09a5b4137bf5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c6395c4457a3e9ad15b2e0acc5a9d9

SHA1
9fc43705da68a59d7ea36311c8f08f0da25996fa

SHA256
6dadbe164ea90aae13c09a254c813b8047c2b975a3f0fc625b8c3c7c6446b3a1

SHA512
97a76e704a9c005602018cbf3404f32795f58674eaece7bb846a2323b6ea1071be70dca65c2e7528708627ca8a4192b38abe63193360171ee26e0062759f7a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8dc5292145766ca74cbe147a13a4bf

SHA1
f6604cb3c8430ef6c10ea2d619c584f849730fb8

SHA256
be8288490e985f19501ef728421b0463c5332cc387a7ee8b17ec960b8b1b8af7

SHA512
5efe4ab9cc71fc187e09041930708038a835a18fa205a56e056983779882e05088f624b73f5fe2f0682179d65e28d28c1a11306e7bbad8efffa5b0ade2542e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e383f2312d32200c73f69580b18d2dfb

SHA1
393a3f0a5d70b30bec32ca4756e0ee8fded0928b

SHA256
58cb7e2daf0c6a22a00d54bf49f8293d6f2a598237c72984fae1381dbda5cc3a

SHA512
671aab334eef05d6ab2b59e1e2dc70053819aac7ddfab0b3fa8643bfa8fe93e1005e21c6f28f63cfea213eb4882496186889f274d089d1e0269702f4fcacc298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a18a3e8c32da4700c6ee46a58fb08243

SHA1
dae03af85f5a6c8f3c2557ca5545d9dd5caafef4

SHA256
0ebdbf7f0c51b5aee140ebc68b6dce86262bd98699f43ec01becb3baf49b9bb5

SHA512
105217eb132b171b6d26d756d44e9b612cc9b354feddeea0205288a503115b5cbec67a3833d197261ed1923f6efca28a412bed56c17c782dfccf01aae0bfdba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6a101f27ea6a08746a73eba11de0da

SHA1
815ca2e155a77389e7e6f18e20cd65c40ba508ce

SHA256
2ad3599838d48618a3bde97c2b6d0f732c992be7063397972ece8337611ee776

SHA512
676940e6ac21fafb93b4cc092bf2840031bc6e2e19482aeb2e620d020166aab7ae4b6ae98f7549b38ea89be9fd93e22af70546db9d3ab091cbc6b70a2614877b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f199b2a24210b0d407b09a09cae79623

SHA1
4ee9c6062d97fccfba4ceff6fae405a1abefae28

SHA256
680caa64bccec57b22147d95bd78417e6059c36d2db19ca4f7dba5c4bc2a52de

SHA512
1356d753dc9cb780ab9d41293e7acbec77fee0fa4daf52fcac22fdd701b1b9937775c7c8f8d4d6424d3a13aee015119b8e623a27e352ecc54cad52b94c6097ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
762f8854031719e14f6a39ca2f236f41

SHA1
3cb4b9dd0f399c32e22f5b62c7e4d71c65050e79

SHA256
32af551b1c50410c2c69a2fc2c03735e521734801778b34d1d3ec0f49d3bb15a

SHA512
e939ba9e813dfec63aa8a1f72b58f04e3f1b544dc9193c1484eca5cf8dcd33172b11f8219b5c0eaedad748fe268d3e044ce6279d24fe8126e55167fe76bec90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
331575e3a151dc83cc22cad6695d2f64

SHA1
9377a31ba0be54a48fc7d5937356a3c5efb70372

SHA256
39999578179f0e5962f590f725d40443186bbb5598d9293533a7dd57b89be6e5

SHA512
955e9b488811861f1329dd124a1880e1873a58c3dd3956e631ffd51f1ba73bc18f6d2ddbb4de691575ac66c2189c1d30c5905e4c37b2ee817d45829564780e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
273d08fbf29df680a7eb77493c57fa52

SHA1
bcc7a21d00d58997eb39146ef2c5461e42ff7965

SHA256
5d565dcbd895109d7da2013ec0059565717428458684ba38c6c2b7b32fa81cbf

SHA512
88a1277ab50c69b1a41cd582edb6f155b68a5ba7edcd4c3f7cb5f624fc0dcbc6d8794a90cd2fcc21eb85b0bf8f8328eeff7916a22ac9dfe8f4ba870e495d1079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d70204a3294d6c75c08fc08d8ddde8

SHA1
3a73a2a26e25a1934697e9c2a5b292c4775d947a

SHA256
5689b0f0cec45a51435e89470784295496bc5091a81fb1746f009556674c7524

SHA512
2aa7a61c8940590448dc8bc19f960e3465d5c7eaf2b54fd8f220cbeb837ec9f0a05013ee8a0c92b94b38638edc028a6ec326a93a4a52306f4a4c25059098ea40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9349d7a44e75197ecf2fb140a3c9a505

SHA1
4f1e5f80f245b79c87549c76f7b2841717a230ca

SHA256
a737ce10db530a5c6d3b2f2c084aa98cef8fd3b03268e4eebeaaf78c5e601a18

SHA512
0d1c6b83c29bfaf19c7323972be8a6d7e67af479a979cc2eda12dc21aafdb3389a17142bf83cb8bd2e5dddcfdfb39360e853778397f0107da028dd0952966e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70fc81f70357ce2f2411b8956f8a57ac

SHA1
5b719322861ed405eda1fb718d4854a09406ad67

SHA256
a050032fdb04b0d0110e27f3fed4ee3559c52617669178227726d8c118d4e8cf

SHA512
d2a9d2cd4d7c5af49f963a1ba82394d2874295275f6240e243ef6d2abd14be2d9bcab87e773a0f2164f214124d1b74d2f84dc9f917f2ed216fa454f166228b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1989c169f72f1b34c626a90270ea092e

SHA1
5f76b693be291a0464945ff0817ffacec1a9d0bd

SHA256
b9d0b2b8b0e989332a73e952728dcc95eeea914d7439f258ec08351c39b7414a

SHA512
07b386329bfc4e3701e94604e694bbdab1f63cca523ce04d45f19d998afbc46d65f213e474166ffe1ef33fdf595a8b531fa61cdb66022278bb5908943694695a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a5cbfe7a49481b607f2901158807d92

SHA1
0e0012c51cf578a1e257dd22ef418df8b2026a1e

SHA256
7653e5cf58f295699891162e31c237ef76027d8bf3c82600e77a7ecc60f253cc

SHA512
1d2b73fb65a7b7646b8f8e3510a5f796eb574d28d9367155ee31cb90d302e8fc75e027e4c1db77163943cf8367224160c28b9137f2a398bec56715f242552e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0bdf953ba5d28f22cbb2932b46310f1

SHA1
2bc48112babf5cf1118c40787ddb9eafb73f5ac4

SHA256
203fd4cc2cb53b06f897775c2702ebd1941e270036db8ed3600c5af16433d9ea

SHA512
15787f0cf714fcd307ae5d87459cb033cb3e7e6a42f91870439739fe9c6862c12735f6d1095b9fc37cd26264349a7f5cae2989cf50b91d032d1600e95d2e7aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aa2bce06833469516c133641a3050e7

SHA1
ed2d05d865607dea2c9d5a7ebe518f54225de72a

SHA256
1980c54075b39f8dc7027d563bdd9ad8a8877d0baa64bbd38441beada3fbac81

SHA512
6c07edd84ccfd8e75d2bf751e204e9b6001763ad4d36987a7faebd07193f664a4fac63e67a4638c55d263537dfc41695ed1415a9a8cd48d540db855f382b9f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0b8268f188a07eaa843022266d5ecfc2

SHA1
98819badad0ea3df53627139c8d54f3f514ac14e

SHA256
340b6c044d5466d3cf6ad70bd661118e91ecfd36495b68d9c4b32fa9f8454e7a

SHA512
f2c347ab7dd6dd502049223dd5c058b642bafe9916acc37297c13be8d618c4f39fe8a874a5d25a1a4f6f8f0ca7ce3cacb0a7ca52cbef4fadd4844488b959707a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9fajjbh\imagestore.dat

Filesize
2KB

MD5
a51bb2fff738f81ff148fd3237b60502

SHA1
07bea2e223b43a7ecf4a99046cea3a8c3a3c3482

SHA256
4f6fea88ebaea3b17d66e7877501784a6c5cb38576205e0687fabd4cf62dfba7

SHA512
4031e6eca8b234a22ea016a2b3f2b04a2bc20ea15da8418a4f3569006887f9f0c2b822eccf50b6b1747c258da3aa03e02390dd9b8c1069a9c6c15fe2ffe8ad29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\favicon-32x32[1].png

Filesize
2KB

MD5
6e91ca8e818f981a1ae3f9166f8047a8

SHA1
cfe29fbd74dab1be961f763a7496e7a5c5dc0ec4

SHA256
1dde4d031564589958a25b6accc410c701917ea8c02780ff268ee8d1aae0fb58

SHA512
2447f3f59fde7cd84c14d1799cee7ea23bf7a5ae71c08fce14b1092f93aff542e41f1fa55419988ce3127c7556170c9847b69456d821a85f3daf48e5fcfc6e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab464.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\logs.dat

Filesize
188B

MD5
9b14e1dadc18e2b3a79a01069c5cbc8c

SHA1
650a7a4114d155e598aab2350f932bffe8a66f0f

SHA256
9d252cd795d716dfb07e43842ef00d785bc4874025ed5d32aad7afafff7dd823

SHA512
eb90ec3fa4d152268decbbf61a0e46ba71b48d42be17f3077687ad2b5fd0a10aa758b122d60093115ba575ff7e946ef8736a2b1559f131e2e639b664587c24c5

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\MSVCP140.dll

Filesize
428KB

MD5
fdd04dbbcf321eee5f4dd67266f476b0

SHA1
65ffdfe2664a29a41fcf5039229ccecad5b825b9

SHA256
21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

SHA512
04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\VCRUNTIME140.dll

Filesize
77KB

MD5
ba65db6bfef78a96aee7e29f1449bf8a

SHA1
06c7beb9fd1f33051b0e77087350903c652f4b77

SHA256
141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

SHA512
ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
86279521328398e87699d248628eb13a

SHA1
e4d4c39bda90635f1f5c2fc58b1304e2daac9caf

SHA256
3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337

SHA512
2cc328955611ad8369ff9facf9c1aabe99a20c3ded2977ad86c69e0f54acd78fa6f572ed688625c8c63016826a10b3578e3c186ef2b39c4bf393ab5e399913a6

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
422adad24e8da100f85bf3de86b5f302

SHA1
7004b3ed8663b5890cd25e1a7899a766be912728

SHA256
e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956

SHA512
e689ecb1a1cb1e7735cb6a961fd054d87bcad01acf76950b14a3bf4e08ddb7a8d31805c203374ee081a4ec13c40b25b3dc83b3895b9bfbd9c135673e98e6ee63

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
a07afa26ab56a8d3b8b16591a1962005

SHA1
2b6f3143487f747911ee20f039f1ffb1381858ac

SHA256
6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b

SHA512
b77b277d10cf6b8d209679684ead55b4347caef3213acdccdee35b5d4fe0e3fc136daf057830512c5473c4653a8d66357927c4b7d204c07d7508f792299d7fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
ed215daa7493bf93c5eadef178a261e0

SHA1
b20c8dc7ba00f98a326f5f4fd55329b72f8e5699

SHA256
8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26

SHA512
3ed052eada11c3dc44f81f330bd2a2526170515bc6a90281872a93ee49f9add8c9ad36b9a9e9185e251d664c1694d06625e0148e113addc32e53d705d2655f03

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
a9c7db516186c8e367fed757e238c61a

SHA1
1318d6496e7146e773aca85be6d0e9b87a09e284

SHA256
ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659

SHA512
6aad003287afe86abccf34f6b15338c0c7380f4837805d919064a26380d2f3f7698515f927c148e618c12f0943d3621184bebc70a8b07eed64ad88689fbcc5cb

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
c6385b316bb04ca36d76b077eeb9a61e

SHA1
fc376f68798fecd41fb1c936eed1bce3f2ee6bef

SHA256
060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc

SHA512
bddf0f34bedb17ecf1d270a0613f27d174ae04f920192d7d1af6c15245175318b29691e748c36e2ce0a3027495b2f5a0bb688ae16095fad9dcd8c283b6d1b1d4

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
311e582d5d3d8421e883c4a8248eacc8

SHA1
c99e61d1446fce0f883a2aad261af22d77953a59

SHA256
369cc4d3bb05f4160a0bc9683feb1df2e94d02f061e4b23d53c3a6e2230cd5e4

SHA512
050ed1310e667e6bb22bb7952794745df1eee0c78f18240cc2217e748a11213d094b48153964c3da0ad8141da1709ece637315633396c77c035bb0565fa981b4

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
60ffdc3ef20b127e3fd14a0719328c34

SHA1
b510833350328f79a79fa464ea9d5e9455643659

SHA256
43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9

SHA512
caef6ee08c9f6fabecef1f0be37ab34e2d4dc22f15a775b2f0dcacda1f0fcdf2259399e6fbab85f0f00e8e4b03d77fe88b85b901a9ba2f775a50f2da724da26e

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
78dfcb76dc8b42411dbc682f78f5c6eb

SHA1
e50f6719fee44c70518cf8442737a688b5f45e62

SHA256
8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f

SHA512
968bb3bc952f4057f74c9c8825fcc2db34b9c56166ee39db3bab3d4ecf51fb65af250a8a65340274a1a0c0eed73b6c8962df5d2fce586c1ef4e19706edd5e6e1

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
8bd7a27e6ca969d3eb46086d411ce05d

SHA1
3bbf6f55853b1487debca58d7cb5c877d0abd517

SHA256
8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c

SHA512
fee8359398efe6a995a214d4e47de43aba12d33bb9cb1de18659d332d94ef83a4a77618b6caa9f455b0c6da4c10ab459209d483b9e778d9b522771ca692ca454

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
00446e48d60abf044acc72b46d5c3afb

SHA1
0ccc0c5034ac063e1d4af851b0de1f4ea99aff97

SHA256
82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a

SHA512
69114f0efb3c853bffb55c15e5ad1b7919057a676056d57634a6a39916e232cde2dcdc49ea0f9751ddea6550ffa58f84b1f8918b3c9fd7e88c8b8f7eb4afeaf2

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
376b4a7a02f20ed3aede05039ec3daf0

SHA1
c9149b37f85cfc724bedc0ecd543d95280055de1

SHA256
b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c

SHA512
ff7fba7cd8c9b55c1c87104d7d9074ef0eed524b02480ecf2c80e5cd489c568e1ed63bc62699a03272cab3dcbf20e6437e1f47ce112bcb3336d27ed2790430c5

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese-H.ico

Filesize
1KB

MD5
1fc48b93562b46e428a2db1d4ea4a099

SHA1
772bc0d8527c5a0450fc0ff8ce525fca240564a5

SHA256
0b29a27f3d2ab4379cd99e9e7a93f6e40a0fe12cb73d1e6f3d296ec2c7e38a58

SHA512
55634f207c835a4dfd90ea1501a9ea5a0c406940def5f3b690d8b67085da8e61e890b29be679da61e8ce58a6f176b9f8927c02b81dea25a9de5561e1ea054a58

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese.ico

Filesize
1KB

MD5
2ca29c521af17539d17968900ed650a1

SHA1
b508852a5febaa2ebd942229cc9104df4059430f

SHA256
1b8a834029f10ec10d796c8344b990df082a3b3c67e8f480d8ce48c07177d549

SHA512
90ba3bd6431912fa44458675eff9be42d99665b505d5dc4012591f4b018033ff95c6b7adceffe639040aa32ed2ef8c978c249fae9ede5a2db26e9b522d61d11d

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\English-H.ico

Filesize
1KB

MD5
e5e33562181f5549042249668092b0db

SHA1
7103748dd38ec44a3dea582a9aea2123870a6937

SHA256
1dff252a4f45c471b8fc81d5d1c94ac1ca918a2ec0725b875f088cb75b53a938

SHA512
9cdf1a067383086d7ea79fe145e84ae6be8b1e476dcc357416941c8839c46eafd496f865aa8c553df6ad61ea1afe00004cc3df22a395cbbd53f4b45423468b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Polish.ico

Filesize
1KB

MD5
ad8bbac74c6010604a7bbd9e4df43688

SHA1
eb18b66c38b2a5ad5fe98177b677b4ed36c898aa

SHA256
5a98fc48378b8772579632706747d35d3f16c542fa5f0493b44100a0104eb559

SHA512
6df720edc81ce9af7e26028073219fcf3d8a503285bac95e9bbf2f6e7dd51e05624d72d9cd7bf670bc9c081ebf25dcde728ff7d21386d5a1d8330b1988527c56

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian-H.ico

Filesize
1KB

MD5
ee464ce2c72dc4a01afccf12b318ea23

SHA1
9cebc61498162ca4847519cdd0739f97399cd396

SHA256
596b46cdafb26774740466a73d4031813511db5840d2fe5c4d90284278a08d99

SHA512
0645f8d741feea1debe9b7ee484922499d44270783ba3d4d65232d7b6f2bb113cf4adb8278b78fb8dc725228fe21e912a2b8b228cb08d58015a537d4774e7a62

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian.ico

Filesize
1KB

MD5
ed0fa2d2cd41dbb442b010b4bd2cca9f

SHA1
783d3843a976bd91829398f9ccbfa5b98150023e

SHA256
7c24485ad1023a46521ed10a38ea762cd9c185aeed7dfd32a717d274606d8074

SHA512
4b2134844bfb56b9ba266f6687359117d5f0c0d5040213c025d906fab5ac8711a09673bdac342c59bfd1bb0fc8294c5a4f97cbc29567bd2c52b90dbabddc1d3b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish-H.ico

Filesize
1KB

MD5
959a045dcfc52077692f0d091db9054d

SHA1
ecd119a1e382f059bb9b04e37222ac3257272994

SHA256
73fca4e5f38e65f21b2b7251231178e64ce8cb288044d064e176965a1b4dc699

SHA512
022939b3cf3bc0555b190ea61b7594fe24f87cce44ce371f081d67202fe085e19a550898a4372bf8cca0d492a9ec837ff3a9d680998d2d5b35c26a5b0f042a98

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish.ico

Filesize
1KB

MD5
603afd32d12ed4bdc1bdfbb11040f271

SHA1
ac68f01be1f873330333ccacebd8079e2a72adfc

SHA256
9eb18c0dacb6e60abdf315b853fd6c9db8968ced959b7d31d1dcbc80b561bfb6

SHA512
b93869f43ae9cd0c1cac0d21b588527a3f93eeaf972ecf1f6d167f36d5f8e3d677daee6db0e1d409294e939cc8f2be2c65f4c0fbd5ca5918a09b01571a630c33

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\libwlp-20.dll

Filesize
19KB

MD5
fa847fa54c646c39fcf8e58c6fdcb46f

SHA1
d052ac0346c77be6d87c2da668543c63d3307036

SHA256
a15614de6f933f1941dbbb57641900439c02b3a90c40e409e32cae5c04426378

SHA512
3dca61429b7572d3106d095cea128b8b0bb8c685f0251b5920c8d69d828d33f90d507ba62033ab29cb8bb2d46e8574d0b52c7dba8181c2fa98ed304a8ed80cb2

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\page

Filesize
1.3MB

MD5
bc23ffe164676054ce5e5314abeaf11a

SHA1
eebc94229ce1b1a51d4dc96399d1ebda0b52b075

SHA256
dc36a03e536fbc03b4a89caa83435ec57fd021386341b53e23b56b359d988ab0

SHA512
78262e6a18988981e8a4f82fbf84e00d9058480912947851c5491a822f8f3c27a3345acf37bc2aeff514251024a1304fba087cf63f699b99af0299e9b0b26cdf

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\tak_deco_lib.dll

Filesize
127KB

MD5
f0bf722006ebf17f9a194e892ba2bf37

SHA1
a483e46857f29e98535a992438006c962e0404e5

SHA256
a737f6f613c161938ef4c795fb0cf1a0a7bf7e1539cefebc030fc36ac37bf0af

SHA512
47e4113ef649539db6b7ba52106477ac415fafcc0fad5b9a92575d18d110d1fd21e906cecf2546ddc20ef554e09f3da418a5066b70b31dc1360e555eb2cbd0e4

Download Submit
\Users\Admin\AppData\Local\Temp\is-5J1PE.tmp\pentest_sample_15.tmp

Filesize
3.1MB

MD5
7388fff746d0ccae6e5610e87ff63b7d

SHA1
3ac665008fed3810141cf530627afa365df6dbf9

SHA256
85431ef6910699233ecd80d08c13f5507990b9d5d668f589768416c4a25b8494

SHA512
9a5002a93c0b53854af4c55c26ec65709f4080e6940b22729a399f844a2513a55e37cca1df960992996da8976ab8a918baa7b970afbc04e25b0f511bec7b4d00

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe

Filesize
8.6MB

MD5
92c1655770e49b1dc19359ea1f02e780

SHA1
16b459328f086dd988bfb2b45288d32652400301

SHA256
bf9a506f8c9409fe9609c9590477fdb5cbd185c7b76344260a2494ec064feb28

SHA512
b5e7d6eb435411449402840161d47ec17a6d7f24853e3536d0619dfec5b5fead9de9336560a434735c343e2d96f22d97b9be6c5a52e708c97ced6999808946f6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
602a35b140d9d68d7b3e488896158365

SHA1
f1ba615abb54ff786ddbc74dffffd56394bfc892

SHA256
43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52

SHA512
4388947f90838cae8b5f8137c9ed2a099028b4341da8c574d536c6ad096bad0e217e105f0367750c70e3d3ca4857255b674955c71ecff0fda9c47a4b1951b8b6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
10731d3320c12abb62d3866d7e728cce

SHA1
df4e131c825d1ca5cd14e00e5c04785d6ca508f7

SHA256
9f3eb90963916194f167e98e049707b14fa84a3f11cb8cc7b940d95956601700

SHA512
7eeef98682872fd95a38a03435546349c8488607e59870086b486b807e8b53893603175d9ad0f3b80c1924381daca8d14868a6079988a944b005783b4e2e358e

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
cf5f256e8cd76ba85e6c3047f078814a

SHA1
b7cde77313ceaae76a46c1111b33b3d8f47c4214

SHA256
9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1

SHA512
856eff4fff1d11a725af9c3e5ceac6d02a89297a16e97edec171839aa12c468fc37d60ec5df06d507cee695f71b7fbd4bc0ba51b7934d886e66a43b249e62da5

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
f681a45c47ebb2c56c1465677ec33ff3

SHA1
06bf7798c51325cf1806e14dea56ff98b05b7846

SHA256
3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af

SHA512
eeb05f1af7e1c714c658e9aa06e8c6dbeeb5f2e8dcf3fdb7b9b408018e41402d83893472114e0cf6d3a9a3bf54ec45c4f7a4840a09570d190277aa3514681ab8

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
6376bf5bac3f0208f0a5d11415ccd444

SHA1
c3fe96e51c3f3e622dcedd2ddf8d23f9442361b8

SHA256
e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e

SHA512
9614e423c850bdb584f18555825214d42106966b1ee71e75ba7407591aa5de407b43909ce972e1923df82e9a0e953597fe19646296962194ebeb1579493d91c2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\ucrtbase.dll

Filesize
880KB

MD5
5dafe0bfb955e780b3d50da4524b752f

SHA1
91c0d9fabe748d373215ba21b90278671b5f8957

SHA256
6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9

SHA512
37fd37f3ad87838f596d1e8e497fe66d1a1c4128625ab456ec850179dd1e1f33cf4945d0faaf6cdbd1ed586ecfb7ff3e7cf10a88a823cc5eb06c2fc4fa16bff3

Download Submit
memory/2352-14-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/2352-9-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/2428-394-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-853-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-397-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-212-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/2428-395-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-396-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-827-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-828-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-831-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-832-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-833-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-834-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-836-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-837-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-838-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-839-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-840-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-842-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-379-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-845-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-846-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-848-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-849-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-850-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-851-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-626-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-854-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-855-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-856-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-857-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-859-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-860-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-861-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-862-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-864-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-865-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-385-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-389-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-392-0x000000000AA20000-0x000000000AA97000-memory.dmp

Filesize
476KB

Download
memory/2428-390-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-388-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-382-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-383-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2428-366-0x00000000051B0000-0x0000000005249000-memory.dmp

Filesize
612KB

Download
memory/2956-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2956-16-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2956-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2976-259-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2976-11-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3064-257-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download