babadeda | a424d4ad76806d261477a6117dc0fd2b0517357a826f9d0d7da22aac7c0f5ed3

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

output/pentest_sample_15.exe
Size

129.3MB
MD5

9a2949ed34685809e0a23bdfea97271e
SHA1

1ada36a15cea1e1b6c70d155518d2b36a03c4e97
SHA256

f3fef8eac63444e364437305ba947e5b9e098ea15cf7e30458ab67d272fa1fab
SHA512

941486e979b1a9a08e61f3f4bb348224fc9a55c60a3ec6a6eadceb6d8ea0b00b5641f549616dd01b374d8ceaf3e05bc41cecaaca27d8e980232de1a84a8d21ef
SSDEEP

3145728:zR/5KgSAOsWBD4TABLmERk6WFQLnZLmzxPj9MDOC7vadxZA6NnArUwxS846PjsN3:zR/b

Score

10^/10

babadeda remcos sys32 crypter discovery loader rat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

65.108.9.124:4783

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
Sys32-PI9IVT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a4f2-256.dat	family_babadeda

Babadeda family
babadeda
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 3 IoCs

pid	Process
1628	pentest_sample_15.tmp
2228	pentest_sample_15.tmp
2908	Mp3tag.exe

Loads dropped DLL 26 IoCs

pid	Process
2844	pentest_sample_15.exe
2840	pentest_sample_15.exe
2228	pentest_sample_15.tmp
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe
2908	Mp3tag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pentest_sample_15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mp3tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000a05244de15004dd7076f9636d9e84397c79b3126cd7f8981aff2d562a18b8cc9000000000e8000000002000020000000eb36194f8c60484e00031271791ea93c6136d67728ffaab304589cfa366d7fe1900000000f36750bcd1a1948f06fbec72414813261689ed2e7b57f05a030b16c661d8f22ed5e7c6d667f6b5d6e346073239854fa832f3592ff1b719a361d9ae2acb49720d84ef7abbdd6f16cc611b866e430d22e58c91400490f6173911d04a5d06f26c15e4457471e8430dfb0a2f630a569fdb054d9fa197f18ff6ea89b9a6a1e03d8407cce37449a2e2b4e310c3d9b9e0c84ab40000000a4edc9820e71fb7813a48868b57269bee784ee53122c3dd1bb517a5cbac4d4adf6c9fc1869740eca345800054ba99ad76a0caf57cb82881d5329b05a7b018559	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000732cdddebb821a6f47975bd4667cd6140a3cc468b8ceb907169a6eb0d4b4b05f000000000e80000000020000200000001a1af14ecd9a2cc2c9a05594ca4ab37219b2a17ffe0f58e31323ddf91aa0b90f200000000c172a8359820ec9244d5fb41a0daab78d7b442b267fabe4117fde3148c90f104000000028d7c619aba6196e518b3a34fe6d51adf1a8c21f48295060d5a579a1ad906bd4020616d3435bde45ef6e7cb40a44a625509e398ad6b3f0af3f88bd76f021f920	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2035f59cc52fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437002205"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6471E21-9BB8-11EF-A5D6-7E6174361434} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Mp3tag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Mp3tag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	pentest_sample_15.tmp
2228	pentest_sample_15.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2228	pentest_sample_15.tmp
2908	Mp3tag.exe
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2908	Mp3tag.exe
2908	Mp3tag.exe
2224	iexplore.exe
2224	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2908	Mp3tag.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 2844 wrote to memory of 1628	2844	pentest_sample_15.exe	28
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 1628 wrote to memory of 2840	1628	pentest_sample_15.tmp	29
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2840 wrote to memory of 2228	2840	pentest_sample_15.exe	30
PID 2228 wrote to memory of 2908	2228	pentest_sample_15.tmp	31
PID 2228 wrote to memory of 2908	2228	pentest_sample_15.tmp	31
PID 2228 wrote to memory of 2908	2228	pentest_sample_15.tmp	31
PID 2228 wrote to memory of 2908	2228	pentest_sample_15.tmp	31
PID 2908 wrote to memory of 2224	2908	Mp3tag.exe	35
PID 2908 wrote to memory of 2224	2908	Mp3tag.exe	35
PID 2908 wrote to memory of 2224	2908	Mp3tag.exe	35
PID 2908 wrote to memory of 2224	2908	Mp3tag.exe	35
PID 2224 wrote to memory of 2204	2224	iexplore.exe	36
PID 2224 wrote to memory of 2204	2224	iexplore.exe	36
PID 2224 wrote to memory of 2204	2224	iexplore.exe	36
PID 2224 wrote to memory of 2204	2224	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
"C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\is-GEEV2.tmp\pentest_sample_15.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GEEV2.tmp\pentest_sample_15.tmp" /SL5="$50152,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe
    "C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\is-FUK0V.tmp\pentest_sample_15.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FUK0V.tmp\pentest_sample_15.tmp" /SL5="$30144,134703868,908288,C:\Users\Admin\AppData\Local\Temp\output\pentest_sample_15.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe
        
        "C:\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.mp3tag.de/en/download.html
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
368a47a51e9d9df6dcd45643bfac64fd

SHA1
e8b94d12a87d330107e19befe8e5dc24bc802b1a

SHA256
8ae165894a54063dd0e3eb31fdf6015bc2adc758e93296d09525d5c9937d336a

SHA512
2647cbbdb1d3798191d07f50e7f12741b00954abd84eb2d746f6539110cc0bb905cf32ae4d39e058ac470f6108a8f7fc84b7a4964be87607af324676b705a233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d83eabafd96057d1e390a6f9f92576ad

SHA1
ca02592fde89472ada7fb93d53057bd2c01af73b

SHA256
fa338c6cb64b81fb891367a75fcedeb2d38bcdbde2fa39ab61ce9cc815f9f379

SHA512
808463e93991d998689a69cc91e70286c44383ebd9afea29d157c1c89ccde36fc27fb413eee687468c0de7a3ec41125ebc4c859c4e0ff1a1a1b07c2064f171f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d970f3c149e9c136fb70973f9337843e

SHA1
ff35cab1ad17949b835c580c4b4c9c7905559487

SHA256
95ceb6cc8559cb4d8b31ab9157399e1b0d31a04ece4074b42bbaa6d2a546ee83

SHA512
0b38c3f1d4c3131506dbd229e54f0630069f51e108beed87852b5ce7bb230acfc3400a5cdd2af8686df7f87c1d1ff499108f2a092e7a6c826a79b417d288c292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38afe38901fa454d781e9aa626268ed4

SHA1
5b2f1acd4e684ce85c5796e1adf1510735827296

SHA256
43a8449c7d43fdec47a9cfd678d3045c0ede2daa70d1aca21f6791d2cb7f4caa

SHA512
17cd83f31fbe325820c750887f550be05f8728a462b8ed35423e33f6642aa9f2a36587acb915e0988c85288e6829755f2b338fd414ff4997bc7224276ed04c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fceb89de3bba666ce404e72fd2669cd

SHA1
38b42354d7b9cf5835e6218088742add45bc1628

SHA256
c038952e7bcb8684d9843531118b38f256ea6a551febc42a5fbf2cbfc0eb5ff6

SHA512
14d38b19f2b7c27a98fdfcb8dc543072e076baa975e95235d2a4f7116c237a28156f613b9db80e5842aa53acc1141b1b9c2b40d69c7935edaaee8d777e2f5ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d03e4638d09fd54932748ad886003fc8

SHA1
8518f66fbe82d95102a637c7d3abc07a20600878

SHA256
1faf2e51d855b47300ff7ccdc77fe02ceae446f087657c46953692d0a7753cca

SHA512
53677f667786407ab2eba3fe77d2977b49498f7be4384221e1bfe2b7e10cd4a4e6ffb4573f5224c9b464d27dd87abea3658bb220482fa098121a76e879c17fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50169e04e97191c6261c994546f96a94

SHA1
79b5af7bcda145348bafbd6ee4e7eaee21444b76

SHA256
82cf8bfeecebcd1fc863afd95a6283f71239ff36c6cefac2c703a586269f0b7f

SHA512
5903a2799e0a442fe7fb78dbb976ebe7cf6a4b7ede4d94ce41383765e6182f7741ed6d2d44a166b3daf147cb5199e220995d9fdc668d3dcc46df8f991af6066c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72de1f26bb6f969a987b34832a11ea28

SHA1
e1d3509fa36dfe91070cfc7fb317e99d9d665fe8

SHA256
8f2d10857e2dde91b218ccc4122cd277da43730a0cb4fdd056736ac78a1cea5d

SHA512
6db5d1daeb2df40b1460512c3e4351197d825046e077d1db300fef8112b13be71c70f38f9aeb0d6b678b81563eea54efc2296c45b6240d8d06ed059e74533d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc6f4b7d806d38bdbb80ee3be196c5f

SHA1
aca198eb925c41ee2b8e6eb2d27c7179e3fa09dc

SHA256
193e43bc7c5bd2ccefdd2056ffd8dab6a20b426d955b544d517ffe18bfdc4a7b

SHA512
b1665300456777894402a0ad608d0cee2aaf593afadc3885bbd12c926916de9db4528262b9be8eb528ae19987fe041212f6fc12113ae3fb92dcffc3f169656dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cee75e2d0646316d73bd409f8adb6855

SHA1
9251c7d9ec65da5171074cfadd3b02f0e1c02a97

SHA256
38561725b674737d08fff23008c346e0ee649dfc92e8d9c94abc751fcf6c31f0

SHA512
744eea6603bda6f496906806a81739cd1468ca5c49e3bc639aa260c496761704c0358d1fe4cda1a01b1421b4dd51b4bbeb944e2a81be404c67bf6565ae84b32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d36fff80094f9a8b1e40763aede6b01

SHA1
38423d4c2c280e1d200627b84e88ab6f3f8c9cab

SHA256
6a56517b04e4634b153e3b6312e0d6d1593d301b0f13c1e6246668553d479055

SHA512
71f28365956d3bf8f623d383d4e7c5644a175f390c128f281e0535a7e22c641e9ae7fa1535de8b08efbaad52e3137c501343aae389b05ec87b4c40e9efee89ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
275c5d54266a2089bbdcecba8a5cde04

SHA1
49ff798f4612b897db0326b5992ddb6a73844b31

SHA256
683c52da30bc444af062a7a1f15840262fcf840dd1b082bb55c2183e68ff668d

SHA512
08bb079cab7efd733f910a01393576d0bf50260b6964928da5d7e51caaa59119c64ee613e50588e6dfc0d73c7ed6131ebc52794828a0575da809c72a7c5bee63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b686223c6b5ec3f9debdb12f946aa92e

SHA1
8016e27b5e633e4d1783d340b7aca7f872b142af

SHA256
93685e826023dd1b6eca0b8e23bd7921ad27943209c510570306c8ed8215edc9

SHA512
6b0df737099eb0657aa3e8c12849a75aecb2337ee51657153796714ddbc38da57f0d3d385f8453bee2b8dea0b599e3ecf248d876bb106ee79b9a8b4cc8a5028e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f20fbdbed4b1f92f52978559a150c24e

SHA1
495bb31e67271c050a3070d434d801492a2c0d88

SHA256
b18ba3f9d78636bdeab86bbf2102cc52241c3bc021a18b8c21fe66b8f260ac33

SHA512
df358dd608a31e39f3172b44b4d695b00bf333cd4f16de7fb294d5fc76e8261e2ea069de7adc2b7afed4a175a862824015e0dacc70ae0fbd1e8819effa9c6bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba44cf2bbdeb4d9230e844673f5b88b5

SHA1
c5c6edf2c23b5675d417e94e1f69e4958e141cb7

SHA256
8f85dc2a268a013413edda739aebc58d051d2c4b15ec2783873acdbe6b5d7a81

SHA512
2a90bb0130a87f0d895a7bb6b98c4be79c2316e9646f5379cc5161c33fdf1db0f970e06e73be705b52f5fd6896432c9cfe2e3432723ad11e5bc49fc291cd6913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
897a85060882fb7ec059cac3954b22c1

SHA1
05e2aad0c1117abe8305673c9821316f1273194b

SHA256
887d011105f61e040d1b44ddf746730abd02aef75fa4333df80482982e605596

SHA512
56f0fc87043ffb104a57ecf66b3a0b86fc55b6506f61b54de67d8a5e374dc284618627597748774b4fb36414077aa63fcd139eb101ab95f17dddc5f2f56e9ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f18f703afb9036031e9636e50868ff8b

SHA1
c1e9b4b74158fcc42bd74b4d8d55e969d38398bd

SHA256
60faab9b7954e15635c12b3801f629d536409d80615d99354c565ad81cfa5830

SHA512
a23c490dea2d53a9a3a4a1ef63dd79e8fca73a29ea6927636b461f7c75c3deeb6a9eb6a087b559ad9a020345546fd4767b2ce39924ea627caa677ccca9ee272f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
235b203e6be0713337cd9c524f78108f

SHA1
43e784bc2430eb3491c69fc4d4cb3edb00e8ee70

SHA256
dbedf078f51ba9a6238c9b41395e5532fd3688a7603e5ec79eefd6f3d28bc70f

SHA512
949ce17d4c8f2be04fdfab492d1118fc818d75023df934fc0c55a301e577f5aa9269517891619fc0152c151b8120c4e0e7b18ce0e5d2cad5055038f8fe6ba747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5c4f6dbb1e8f47c66478a5830d6829

SHA1
7c61aeb2a32c25ea523868e7d7914d71746df27d

SHA256
209b402e644ba19d22f1f00bca7c5863496bb37f1c7fc8d1f753ac11154defce

SHA512
c0cd2bb7b12cb4e0cff62868350a8bc14e25e0561c151dfb3a2f19ff628d0eaac4c4adcb9298c0cf8909dbd830f6c7a7e96ca9213ee68a49437a5b279cf0b3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
723b17f9087e3c25e553b5f442e81256

SHA1
a9f113c6d05137780fd1b04937ec21b35c337b04

SHA256
6479434559ad9ffb690d6b7700066d7ce85403b61eca37cfbfd239ce372f3a00

SHA512
bb3ac928fcba5aeab6b1ee4b52d3706d655c6d8d928744bc5d5dc1b8389884e34741cc7b0dc80c51cb6ec463fb45b874a2be4258b78f8e8eb0cfdf2506d7d890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52507d2195612719de5e23d1594e10bc

SHA1
278b89f6f29a6a235149418bbc123586bdb1a0da

SHA256
ab2db1afdd5cedd945a6ecd37463070e32a6a7e812bf97aba72d2d5c0f023022

SHA512
2ec7ee5760d9804893d21a59c9cd9a74df5e3ac5573551ebd50117c6e5e3188128d0b4fd207112c388f62548cf415fdcd7f60788fa809064dd122d1089fa0a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26231909d8efca340d5f88fe13860d2b

SHA1
a0f18cc9692ee4f8acc7833e3dc56d71c20fd23a

SHA256
916eb7c6cf2755b6c2acc6f77684ef58238bbaa404f731dc0ea432dff3c0b357

SHA512
ed4a611c02569359542877eba823eba9dcc348fcb30e7dbba727734ced1130f44e5128af1e3e49b36f0fb439343082c3da6612116d41ab490a770548abdb5735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6d71d202994603f9963fa41081eebd6

SHA1
0e8a2de67002c27d989ebb55cbc857bd68c0bc09

SHA256
5dc9076d64c8ca2fc40edc866a41557bb7a137b6d01b9eaa63c01719a09297e4

SHA512
546ac867f4e90d5b7e81fd641df9391e98cd4ab5be2e869ab484eba10fdea88a5fca5b4ff483cb9505470579ac1e9799462cb4ce3b554b568720a6b54278c885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

Filesize
2KB

MD5
d15e47677d062aeff4253a512f3e81a0

SHA1
9880cc5a1c0b847e089a7681b1a8f2615df7e12d

SHA256
61a21843f7b641c5b2a839b3da279000bd53fbef18faf8f3c3f66f1eeb16a1f7

SHA512
27d74c33bbc57133abb9ff6f69e9ed6e71bd1778716878868edacca6e07922413326bbc228ba0a2936d85330b7cc64478fe51362f7bbdd92deea5b6a86f1e702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\favicon-32x32[1].png

Filesize
2KB

MD5
6e91ca8e818f981a1ae3f9166f8047a8

SHA1
cfe29fbd74dab1be961f763a7496e7a5c5dc0ec4

SHA256
1dde4d031564589958a25b6accc410c701917ea8c02780ff268ee8d1aae0fb58

SHA512
2447f3f59fde7cd84c14d1799cee7ea23bf7a5ae71c08fce14b1092f93aff542e41f1fa55419988ce3127c7556170c9847b69456d821a85f3daf48e5fcfc6e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF71E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\logs.dat

Filesize
188B

MD5
d073346dbd7175ca15b24ba0bf6c3abe

SHA1
ec8f6fe0a86f3aa6394273fadd5aea48efe6612f

SHA256
452972a5fab758735dae9b2780546e8e8b88799e7d52ad03948b054f6a5ac6d1

SHA512
a747454de220d52e2b171cac8072fb83229b8508ef3ec59bd5f3d28b1f5de2f354c1b10afd8a5dfc12c4ce43e1a969665d58671d9db17f3c4e01daa44bf0de61

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
c6385b316bb04ca36d76b077eeb9a61e

SHA1
fc376f68798fecd41fb1c936eed1bce3f2ee6bef

SHA256
060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc

SHA512
bddf0f34bedb17ecf1d270a0613f27d174ae04f920192d7d1af6c15245175318b29691e748c36e2ce0a3027495b2f5a0bb688ae16095fad9dcd8c283b6d1b1d4

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
311e582d5d3d8421e883c4a8248eacc8

SHA1
c99e61d1446fce0f883a2aad261af22d77953a59

SHA256
369cc4d3bb05f4160a0bc9683feb1df2e94d02f061e4b23d53c3a6e2230cd5e4

SHA512
050ed1310e667e6bb22bb7952794745df1eee0c78f18240cc2217e748a11213d094b48153964c3da0ad8141da1709ece637315633396c77c035bb0565fa981b4

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
78dfcb76dc8b42411dbc682f78f5c6eb

SHA1
e50f6719fee44c70518cf8442737a688b5f45e62

SHA256
8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f

SHA512
968bb3bc952f4057f74c9c8825fcc2db34b9c56166ee39db3bab3d4ecf51fb65af250a8a65340274a1a0c0eed73b6c8962df5d2fce586c1ef4e19706edd5e6e1

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese-H.ico

Filesize
1KB

MD5
1fc48b93562b46e428a2db1d4ea4a099

SHA1
772bc0d8527c5a0450fc0ff8ce525fca240564a5

SHA256
0b29a27f3d2ab4379cd99e9e7a93f6e40a0fe12cb73d1e6f3d296ec2c7e38a58

SHA512
55634f207c835a4dfd90ea1501a9ea5a0c406940def5f3b690d8b67085da8e61e890b29be679da61e8ce58a6f176b9f8927c02b81dea25a9de5561e1ea054a58

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Chinese.ico

Filesize
1KB

MD5
2ca29c521af17539d17968900ed650a1

SHA1
b508852a5febaa2ebd942229cc9104df4059430f

SHA256
1b8a834029f10ec10d796c8344b990df082a3b3c67e8f480d8ce48c07177d549

SHA512
90ba3bd6431912fa44458675eff9be42d99665b505d5dc4012591f4b018033ff95c6b7adceffe639040aa32ed2ef8c978c249fae9ede5a2db26e9b522d61d11d

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\English-H.ico

Filesize
1KB

MD5
e5e33562181f5549042249668092b0db

SHA1
7103748dd38ec44a3dea582a9aea2123870a6937

SHA256
1dff252a4f45c471b8fc81d5d1c94ac1ca918a2ec0725b875f088cb75b53a938

SHA512
9cdf1a067383086d7ea79fe145e84ae6be8b1e476dcc357416941c8839c46eafd496f865aa8c553df6ad61ea1afe00004cc3df22a395cbbd53f4b45423468b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Polish.ico

Filesize
1KB

MD5
ad8bbac74c6010604a7bbd9e4df43688

SHA1
eb18b66c38b2a5ad5fe98177b677b4ed36c898aa

SHA256
5a98fc48378b8772579632706747d35d3f16c542fa5f0493b44100a0104eb559

SHA512
6df720edc81ce9af7e26028073219fcf3d8a503285bac95e9bbf2f6e7dd51e05624d72d9cd7bf670bc9c081ebf25dcde728ff7d21386d5a1d8330b1988527c56

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian-H.ico

Filesize
1KB

MD5
ee464ce2c72dc4a01afccf12b318ea23

SHA1
9cebc61498162ca4847519cdd0739f97399cd396

SHA256
596b46cdafb26774740466a73d4031813511db5840d2fe5c4d90284278a08d99

SHA512
0645f8d741feea1debe9b7ee484922499d44270783ba3d4d65232d7b6f2bb113cf4adb8278b78fb8dc725228fe21e912a2b8b228cb08d58015a537d4774e7a62

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Russian.ico

Filesize
1KB

MD5
ed0fa2d2cd41dbb442b010b4bd2cca9f

SHA1
783d3843a976bd91829398f9ccbfa5b98150023e

SHA256
7c24485ad1023a46521ed10a38ea762cd9c185aeed7dfd32a717d274606d8074

SHA512
4b2134844bfb56b9ba266f6687359117d5f0c0d5040213c025d906fab5ac8711a09673bdac342c59bfd1bb0fc8294c5a4f97cbc29567bd2c52b90dbabddc1d3b

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish-H.ico

Filesize
1KB

MD5
959a045dcfc52077692f0d091db9054d

SHA1
ecd119a1e382f059bb9b04e37222ac3257272994

SHA256
73fca4e5f38e65f21b2b7251231178e64ce8cb288044d064e176965a1b4dc699

SHA512
022939b3cf3bc0555b190ea61b7594fe24f87cce44ce371f081d67202fe085e19a550898a4372bf8cca0d492a9ec837ff3a9d680998d2d5b35c26a5b0f042a98

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\language\Spanish.ico

Filesize
1KB

MD5
603afd32d12ed4bdc1bdfbb11040f271

SHA1
ac68f01be1f873330333ccacebd8079e2a72adfc

SHA256
9eb18c0dacb6e60abdf315b853fd6c9db8968ced959b7d31d1dcbc80b561bfb6

SHA512
b93869f43ae9cd0c1cac0d21b588527a3f93eeaf972ecf1f6d167f36d5f8e3d677daee6db0e1d409294e939cc8f2be2c65f4c0fbd5ca5918a09b01571a630c33

Download Submit
C:\Users\Admin\AppData\Roaming\Strong Recovery Master\page

Filesize
1.3MB

MD5
bc23ffe164676054ce5e5314abeaf11a

SHA1
eebc94229ce1b1a51d4dc96399d1ebda0b52b075

SHA256
dc36a03e536fbc03b4a89caa83435ec57fd021386341b53e23b56b359d988ab0

SHA512
78262e6a18988981e8a4f82fbf84e00d9058480912947851c5491a822f8f3c27a3345acf37bc2aeff514251024a1304fba087cf63f699b99af0299e9b0b26cdf

Download Submit
\Users\Admin\AppData\Local\Temp\is-GEEV2.tmp\pentest_sample_15.tmp

Filesize
3.1MB

MD5
7388fff746d0ccae6e5610e87ff63b7d

SHA1
3ac665008fed3810141cf530627afa365df6dbf9

SHA256
85431ef6910699233ecd80d08c13f5507990b9d5d668f589768416c4a25b8494

SHA512
9a5002a93c0b53854af4c55c26ec65709f4080e6940b22729a399f844a2513a55e37cca1df960992996da8976ab8a918baa7b970afbc04e25b0f511bec7b4d00

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\Mp3tag.exe

Filesize
8.6MB

MD5
92c1655770e49b1dc19359ea1f02e780

SHA1
16b459328f086dd988bfb2b45288d32652400301

SHA256
bf9a506f8c9409fe9609c9590477fdb5cbd185c7b76344260a2494ec064feb28

SHA512
b5e7d6eb435411449402840161d47ec17a6d7f24853e3536d0619dfec5b5fead9de9336560a434735c343e2d96f22d97b9be6c5a52e708c97ced6999808946f6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
86279521328398e87699d248628eb13a

SHA1
e4d4c39bda90635f1f5c2fc58b1304e2daac9caf

SHA256
3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337

SHA512
2cc328955611ad8369ff9facf9c1aabe99a20c3ded2977ad86c69e0f54acd78fa6f572ed688625c8c63016826a10b3578e3c186ef2b39c4bf393ab5e399913a6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
422adad24e8da100f85bf3de86b5f302

SHA1
7004b3ed8663b5890cd25e1a7899a766be912728

SHA256
e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956

SHA512
e689ecb1a1cb1e7735cb6a961fd054d87bcad01acf76950b14a3bf4e08ddb7a8d31805c203374ee081a4ec13c40b25b3dc83b3895b9bfbd9c135673e98e6ee63

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
602a35b140d9d68d7b3e488896158365

SHA1
f1ba615abb54ff786ddbc74dffffd56394bfc892

SHA256
43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52

SHA512
4388947f90838cae8b5f8137c9ed2a099028b4341da8c574d536c6ad096bad0e217e105f0367750c70e3d3ca4857255b674955c71ecff0fda9c47a4b1951b8b6

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
a07afa26ab56a8d3b8b16591a1962005

SHA1
2b6f3143487f747911ee20f039f1ffb1381858ac

SHA256
6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b

SHA512
b77b277d10cf6b8d209679684ead55b4347caef3213acdccdee35b5d4fe0e3fc136daf057830512c5473c4653a8d66357927c4b7d204c07d7508f792299d7fe9

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
ed215daa7493bf93c5eadef178a261e0

SHA1
b20c8dc7ba00f98a326f5f4fd55329b72f8e5699

SHA256
8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26

SHA512
3ed052eada11c3dc44f81f330bd2a2526170515bc6a90281872a93ee49f9add8c9ad36b9a9e9185e251d664c1694d06625e0148e113addc32e53d705d2655f03

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
a9c7db516186c8e367fed757e238c61a

SHA1
1318d6496e7146e773aca85be6d0e9b87a09e284

SHA256
ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659

SHA512
6aad003287afe86abccf34f6b15338c0c7380f4837805d919064a26380d2f3f7698515f927c148e618c12f0943d3621184bebc70a8b07eed64ad88689fbcc5cb

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
10731d3320c12abb62d3866d7e728cce

SHA1
df4e131c825d1ca5cd14e00e5c04785d6ca508f7

SHA256
9f3eb90963916194f167e98e049707b14fa84a3f11cb8cc7b940d95956601700

SHA512
7eeef98682872fd95a38a03435546349c8488607e59870086b486b807e8b53893603175d9ad0f3b80c1924381daca8d14868a6079988a944b005783b4e2e358e

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
cf5f256e8cd76ba85e6c3047f078814a

SHA1
b7cde77313ceaae76a46c1111b33b3d8f47c4214

SHA256
9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1

SHA512
856eff4fff1d11a725af9c3e5ceac6d02a89297a16e97edec171839aa12c468fc37d60ec5df06d507cee695f71b7fbd4bc0ba51b7934d886e66a43b249e62da5

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
60ffdc3ef20b127e3fd14a0719328c34

SHA1
b510833350328f79a79fa464ea9d5e9455643659

SHA256
43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9

SHA512
caef6ee08c9f6fabecef1f0be37ab34e2d4dc22f15a775b2f0dcacda1f0fcdf2259399e6fbab85f0f00e8e4b03d77fe88b85b901a9ba2f775a50f2da724da26e

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
8bd7a27e6ca969d3eb46086d411ce05d

SHA1
3bbf6f55853b1487debca58d7cb5c877d0abd517

SHA256
8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c

SHA512
fee8359398efe6a995a214d4e47de43aba12d33bb9cb1de18659d332d94ef83a4a77618b6caa9f455b0c6da4c10ab459209d483b9e778d9b522771ca692ca454

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
f681a45c47ebb2c56c1465677ec33ff3

SHA1
06bf7798c51325cf1806e14dea56ff98b05b7846

SHA256
3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af

SHA512
eeb05f1af7e1c714c658e9aa06e8c6dbeeb5f2e8dcf3fdb7b9b408018e41402d83893472114e0cf6d3a9a3bf54ec45c4f7a4840a09570d190277aa3514681ab8

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
00446e48d60abf044acc72b46d5c3afb

SHA1
0ccc0c5034ac063e1d4af851b0de1f4ea99aff97

SHA256
82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a

SHA512
69114f0efb3c853bffb55c15e5ad1b7919057a676056d57634a6a39916e232cde2dcdc49ea0f9751ddea6550ffa58f84b1f8918b3c9fd7e88c8b8f7eb4afeaf2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
376b4a7a02f20ed3aede05039ec3daf0

SHA1
c9149b37f85cfc724bedc0ecd543d95280055de1

SHA256
b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c

SHA512
ff7fba7cd8c9b55c1c87104d7d9074ef0eed524b02480ecf2c80e5cd489c568e1ed63bc62699a03272cab3dcbf20e6437e1f47ce112bcb3336d27ed2790430c5

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
6376bf5bac3f0208f0a5d11415ccd444

SHA1
c3fe96e51c3f3e622dcedd2ddf8d23f9442361b8

SHA256
e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e

SHA512
9614e423c850bdb584f18555825214d42106966b1ee71e75ba7407591aa5de407b43909ce972e1923df82e9a0e953597fe19646296962194ebeb1579493d91c2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\libwlp-20.dll

Filesize
19KB

MD5
fa847fa54c646c39fcf8e58c6fdcb46f

SHA1
d052ac0346c77be6d87c2da668543c63d3307036

SHA256
a15614de6f933f1941dbbb57641900439c02b3a90c40e409e32cae5c04426378

SHA512
3dca61429b7572d3106d095cea128b8b0bb8c685f0251b5920c8d69d828d33f90d507ba62033ab29cb8bb2d46e8574d0b52c7dba8181c2fa98ed304a8ed80cb2

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\msvcp140.dll

Filesize
428KB

MD5
fdd04dbbcf321eee5f4dd67266f476b0

SHA1
65ffdfe2664a29a41fcf5039229ccecad5b825b9

SHA256
21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

SHA512
04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\tak_deco_lib.dll

Filesize
127KB

MD5
f0bf722006ebf17f9a194e892ba2bf37

SHA1
a483e46857f29e98535a992438006c962e0404e5

SHA256
a737f6f613c161938ef4c795fb0cf1a0a7bf7e1539cefebc030fc36ac37bf0af

SHA512
47e4113ef649539db6b7ba52106477ac415fafcc0fad5b9a92575d18d110d1fd21e906cecf2546ddc20ef554e09f3da418a5066b70b31dc1360e555eb2cbd0e4

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\ucrtbase.dll

Filesize
880KB

MD5
5dafe0bfb955e780b3d50da4524b752f

SHA1
91c0d9fabe748d373215ba21b90278671b5f8957

SHA256
6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9

SHA512
37fd37f3ad87838f596d1e8e497fe66d1a1c4128625ab456ec850179dd1e1f33cf4945d0faaf6cdbd1ed586ecfb7ff3e7cf10a88a823cc5eb06c2fc4fa16bff3

Download Submit
\Users\Admin\AppData\Roaming\Strong Recovery Master\vcruntime140.dll

Filesize
77KB

MD5
ba65db6bfef78a96aee7e29f1449bf8a

SHA1
06c7beb9fd1f33051b0e77087350903c652f4b77

SHA256
141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

SHA512
ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

Download Submit
memory/1628-8-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/1628-14-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/2228-258-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/2840-12-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2840-260-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2844-255-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2844-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2844-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2908-384-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-678-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-399-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-398-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-831-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-832-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-833-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-834-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-836-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-837-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-838-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-839-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-840-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-842-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-843-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-844-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-845-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-397-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-847-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-848-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-849-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-850-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-851-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-853-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-854-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-855-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-856-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-858-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-859-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-860-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-861-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-863-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-385-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-386-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-387-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-392-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-396-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-395-0x000000000AC20000-0x000000000AC97000-memory.dmp

Filesize
476KB

Download
memory/2908-390-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-379-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-366-0x0000000005270000-0x0000000005309000-memory.dmp

Filesize
612KB

Download
memory/2908-210-0x00000000002B0000-0x00000000002D5000-memory.dmp

Filesize
148KB

Download