Overview

overview

10

Static

static

10

B0F05D80B1...D0.exe

windows7-x64

10

B0F05D80B1...D0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 23:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B0F05D80B12C67DC9D26FE6D4F0DEBD0.exe

  • Size

    3.7MB

  • MD5

    b0f05d80b12c67dc9d26fe6d4f0debd0

  • SHA1

    9bf6fee145f08c3ea7d41e6f6755187e92f11978

  • SHA256

    d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0

  • SHA512

    19632526b95ea7435c05af10ceb74179e902201389c62476c7cd5281a5dea338283921166a2272cbe12caf58b2207b18b58834b5c2b1c17df87b2f83fc3824d9

  • SSDEEP

    98304:UbF26GgA01Iz8pS1m+j/C7N2DXXrbpqto0:U1A6IIAY+j6pG/Yb

Score
10/10
dcratdiscoveryevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 18 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\B0F05D80B12C67DC9D26FE6D4F0DEBD0.exe
    "C:\Users\Admin\AppData\Local\Temp\B0F05D80B12C67DC9D26FE6D4F0DEBD0.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\MssurrogateBrowserDrivermonitor\reviewnet.exe
          "C:\MssurrogateBrowserDrivermonitor\reviewnet.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2680
          • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
            5⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:5072
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\919c7530-e983-41da-b423-17de466efa44.vbs"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4424
              • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                7⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1944
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd8a5dde-224d-4755-bf02-c632980dd1a9.vbs"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4352
                  • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                    "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                    9⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3312
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66a858cd-33ae-415b-86d6-0fe37a078fa6.vbs"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1604
                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                        11⤵
                        • UAC bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:1640
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c4f9d36-22c8-416b-afb6-03d256680851.vbs"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3784
                          • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                            "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                            13⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:2300
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79a1d5aa-f17c-40c1-a6c2-061e63c56421.vbs"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2688
                              • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                15⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                • System policy modification
                                PID:3944
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a838e40c-3401-4aa5-9a41-0d0037fb05a8.vbs"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1524
                                  • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                    "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                    17⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:1448
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40bc4a05-503a-4f6e-81f6-3fe28eae0dc7.vbs"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2468
                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                        19⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:4500
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a253c0a-ce24-4469-b3f3-6296028b7ec6.vbs"
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3808
                                          • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                            "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                            21⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            • System policy modification
                                            PID:5092
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bc1a248-8fd8-4fc9-864c-edd96c12d1e3.vbs"
                                              22⤵
                                                PID:4300
                                                • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                  23⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:4824
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ef54b53-441c-41ba-9b93-23e2396e0ee2.vbs"
                                                    24⤵
                                                      PID:4416
                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                        25⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2008
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50078183-2590-4ffd-893f-5126b2582beb.vbs"
                                                          26⤵
                                                            PID:2076
                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                              27⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:3140
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0468dae0-450d-4939-8163-332c97df2168.vbs"
                                                                28⤵
                                                                  PID:1296
                                                                  • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                                    "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                                    29⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:2124
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7cc34895-9467-4b40-a56f-09b6c9bb9ab1.vbs"
                                                                      30⤵
                                                                        PID:1860
                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                                          31⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:3984
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43777060-73a2-40a8-903f-85b0c8928c45.vbs"
                                                                            32⤵
                                                                              PID:4824
                                                                              • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                                                "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                                                33⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:4644
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3cc550ee-b1a5-409b-86cc-58ce633ee768.vbs"
                                                                                  34⤵
                                                                                    PID:3372
                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
                                                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
                                                                                      35⤵
                                                                                      • UAC bypass
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • System policy modification
                                                                                      PID:2272
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\119527d8-ea79-4dfd-a203-528451765883.vbs"
                                                                                    34⤵
                                                                                      PID:4040
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\105d1a35-a546-4dbc-b35f-2f673f1e014b.vbs"
                                                                                  32⤵
                                                                                    PID:1608
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3512d6c5-ecf7-4b42-9aa2-f6ee7bc94aa7.vbs"
                                                                                30⤵
                                                                                  PID:3632
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3cdffe74-0659-448c-af80-97f1a5dd69b1.vbs"
                                                                              28⤵
                                                                                PID:540
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82135c3f-6f35-4685-9a21-3f635e09e867.vbs"
                                                                            26⤵
                                                                              PID:4976
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\175575ab-01ba-4949-9045-6c8afc9bbd15.vbs"
                                                                          24⤵
                                                                            PID:4848
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d03e34b-fb77-4271-bb5e-c4183d1ac801.vbs"
                                                                        22⤵
                                                                          PID:3772
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4342638f-ac0d-406a-a69e-788473256fec.vbs"
                                                                      20⤵
                                                                        PID:4952
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fb73ec8-50d4-4642-b47b-b146269b28fa.vbs"
                                                                    18⤵
                                                                      PID:3376
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\187273f3-b1e1-40c0-9d47-efaba71c0956.vbs"
                                                                  16⤵
                                                                    PID:656
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9bf4fc0e-32a1-492a-a037-4093b07e189f.vbs"
                                                                14⤵
                                                                  PID:2600
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7db85e6e-cacf-428b-8e8a-0f28b74bc234.vbs"
                                                              12⤵
                                                                PID:884
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6b5ff89-b5e4-432b-a2d0-d3e499c7f13c.vbs"
                                                            10⤵
                                                              PID:4640
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3635210d-6a02-415e-bae4-4a981154e206.vbs"
                                                          8⤵
                                                            PID:1920
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\089ec421-b866-4701-b040-ce4dbeeb67c4.vbs"
                                                        6⤵
                                                          PID:820
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\file.vbs"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1196
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1464
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3836
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4372
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\Idle.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:704
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4996
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2956

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat
                                                Filesize

                                                50B

                                                MD5

                                                934b57a6b87ad62fbf72805fc7ed30d0

                                                SHA1

                                                04111b17e6b836077bca5c092dfd4e59657fbfae

                                                SHA256

                                                25bfd4297df8354c427f96c5569594300935745c03f15aa1e4097cff1be3f70d

                                                SHA512

                                                5737cbaa48b1c5804072681e58e8e9d55aa7d996614dd3ff6501afaea693aca3fe7275a811c7aad1bbb88057fea7a31a393cadf7c2761aeca32e1e1f83940b07

                                                Download Submit

                                              • C:\MssurrogateBrowserDrivermonitor\file.vbs
                                                Filesize

                                                34B

                                                MD5

                                                677cc4360477c72cb0ce00406a949c61

                                                SHA1

                                                b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                                SHA256

                                                f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                                SHA512

                                                7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                                Download Submit

                                              • C:\MssurrogateBrowserDrivermonitor\reviewnet.exe
                                                Filesize

                                                3.4MB

                                                MD5

                                                7d995f38d429ff33eaf4ce89f60585f9

                                                SHA1

                                                160f3163b335110d718e98390add6ca7a110a8ca

                                                SHA256

                                                49877051396a67dc531bb04d9745c78820a04e21ab3a6071906739ef48098b68

                                                SHA512

                                                61cb35e8469cd396b8487ca31542d0f505179283aa7d645344f2de7ffa47cfda0013bdfa2c5b29edd16978bce9a90fe2795a62e3dd4b900d9db5431b2d81f887

                                                Download Submit

                                              • C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe
                                                Filesize

                                                220B

                                                MD5

                                                b7946fc546ca743f534d88dddeee3f00

                                                SHA1

                                                668ed69a0b7a298e08a68e80161f7eeead3128a5

                                                SHA256

                                                8673980ed61a75db17016d3fe892f2c37ddc037f34032e2fd35626ed146d80d2

                                                SHA512

                                                7ee3cec4df1a0b2c5984ccf860a004dcaa3c3fa258370edabb50ccd3f92a8d3ab8daf1af1f5087a67a24bf285a34b040f36d7673f1f8e413dc931a201967712a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
                                                Filesize

                                                1KB

                                                MD5

                                                49b64127208271d8f797256057d0b006

                                                SHA1

                                                b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                                SHA256

                                                2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                                SHA512

                                                f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\0468dae0-450d-4939-8163-332c97df2168.vbs
                                                Filesize

                                                744B

                                                MD5

                                                6f1a9e31a3fc7811f0f794c564fe5f1c

                                                SHA1

                                                f93b6d4c925960f81c44632ae5b92c16fd9edd9d

                                                SHA256

                                                c59dd68b9d1887043fd83c7c818e29e53b5dc7c22369fc5b95dadb40d8b15552

                                                SHA512

                                                a30f0749507ffa23ec20e0b778ae7f310a3376559bf884a991b22a74ed4f6b5dcd1153a279b3953f73954691045127d3c363c62b78c9fb7aa81b61c817dd615f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\089ec421-b866-4701-b040-ce4dbeeb67c4.vbs
                                                Filesize

                                                520B

                                                MD5

                                                ccb9273e3d0bf2acdaedcc2f6d65e7b4

                                                SHA1

                                                eed5b8a9e079074f428b47a9c928bce90e8626e7

                                                SHA256

                                                9e2bd8aefd5372d8b9365bce762415ca409b3783fd8dff9fd255e73db8ad0916

                                                SHA512

                                                f0b9678a017ca313229de50d85ff9dae9d9a861a3109bad4d31dbf60e27b37190f06ac9fbbcca3d01922a786092c4cefc38b48c826f98a72de5460b48e63690b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\0a253c0a-ce24-4469-b3f3-6296028b7ec6.vbs
                                                Filesize

                                                744B

                                                MD5

                                                9e68ca68230ff42e40426a369e5bef0a

                                                SHA1

                                                45d766ef04a3c7f1e60841917f2edbbecdae90dc

                                                SHA256

                                                1708228c8ec4672ee8c8c1669c52c2bb24af96d72b0598cb46482006c92b2a21

                                                SHA512

                                                9063a026ded13666dd24d56a8a3ee7ae4ea3873acc8abe36a1f87576c81b69be3ed3223a5af46f31b00299e5721441a1132e7cca5a89ca81e63bc4acef2917d9

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\0c4f9d36-22c8-416b-afb6-03d256680851.vbs
                                                Filesize

                                                744B

                                                MD5

                                                481799d2804a6fcc1bd63972d5b3194b

                                                SHA1

                                                75b45a705381cde8b9df5c2a6d628b18cdbebd4b

                                                SHA256

                                                4cff17bde50401432e963198661bcf7c65b47dfd65351958ce363ad438641f3b

                                                SHA512

                                                b64824619682d083eb85e5828c60e82dd2a7cbf3400bafe12b9be1c2b665c97c57a4ef4759bc0806f6fb090fb8322ac2827c7a05f4258373491858fca03faefd

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\3ef54b53-441c-41ba-9b93-23e2396e0ee2.vbs
                                                Filesize

                                                744B

                                                MD5

                                                86bdde2a662b9fabe708a16f71888305

                                                SHA1

                                                383b79b52860147800474c12910f874022a1fdf2

                                                SHA256

                                                c50859ebfaaa69248686dd68d1906012381593484f6b6697293f144a436263b7

                                                SHA512

                                                0e20df411ed8a29f4e80d226e5f4528d1e85044d55aec9210cbf52fe0bd4d1e7621a694543696f1b968a17e84bd3bf5c9f37045a51e460c9afea330ea6e26769

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\40bc4a05-503a-4f6e-81f6-3fe28eae0dc7.vbs
                                                Filesize

                                                744B

                                                MD5

                                                9f511dee2e9c5559a318c9c55ef3d920

                                                SHA1

                                                54746f295030291e023db9e346c97cc287005e9b

                                                SHA256

                                                cb6bdb37feca65a04a4d9d3cda44b24741268b2c807adb0ad1c11bf15c2bcd87

                                                SHA512

                                                ff9fd89b51c99423b1acfc19d380af39a5c06216b14580ecbb35460a5f24321e250a6ac34ccd42d8bcb7c2d9e5cc770290d580d994d65559a9a4e51c0d9c5147

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\43777060-73a2-40a8-903f-85b0c8928c45.vbs
                                                Filesize

                                                744B

                                                MD5

                                                91f9b3d56af9f4bec20a1d7b881094c5

                                                SHA1

                                                ed3e6474dd901bf23ceb5e6ed49acecc1c17a2e2

                                                SHA256

                                                e0c73393e8b392753c24593bed9a60a976e05617e363a1ee5c07f83a20040fc9

                                                SHA512

                                                fa9e4afd4a0f1cce73e1490473d23f1a0d7829ff7223c603b1f419878cf9823cf1fbf9e7799b0a858dc0774f3569d1174f59cbd9001fa9838852f7ff1f297771

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\50078183-2590-4ffd-893f-5126b2582beb.vbs
                                                Filesize

                                                744B

                                                MD5

                                                9838b0d685c8a42612eb5da415067373

                                                SHA1

                                                364cc129477409699e032cb8ed376b39de9b82b8

                                                SHA256

                                                c163c16786098e48deb1cec9f3c8aa4c52d840e3a59ecb22ec01e0cbf8c37348

                                                SHA512

                                                a494aad275482ac24a5b1cd68836b07ad77337d684887406e7556f9d2d3a07e437eb6ba688b81421d412fb15480753767442928081e5a16acd717421fa67f3a2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\66a858cd-33ae-415b-86d6-0fe37a078fa6.vbs
                                                Filesize

                                                744B

                                                MD5

                                                ee716af0525842535c2bb7562dd121fd

                                                SHA1

                                                2b22f0938e4c6a58beddc7983e581c08826daa98

                                                SHA256

                                                d407252005602a8581baddae42c11d9fec847e790ce905e59712a55d8a8a6244

                                                SHA512

                                                f0f743241857909fb0498fdd913fbef23144d57867f4f4ebed2a3cb182d40360d3465e9416d87f6a323f0f644b6701effd1c74bc16ea9bd7bba937010e8870f3

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\6bc1a248-8fd8-4fc9-864c-edd96c12d1e3.vbs
                                                Filesize

                                                744B

                                                MD5

                                                2e72d0e27ae6481beba9e51dc88b0a1c

                                                SHA1

                                                7022444f107be412a95eb115749f57ba7a21196f

                                                SHA256

                                                b43e8c78ade3012c8446ff4097abe29932b6182ebe05d7419dd8e448154049fd

                                                SHA512

                                                98e073f9a28f18229f049a9cd266606c3f863b4616d5ead785c18002ec0fe08b031df0ca95c011030746905f7aaf08aaed40783f9bef791ac21dd5e00ad58c45

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\79a1d5aa-f17c-40c1-a6c2-061e63c56421.vbs
                                                Filesize

                                                744B

                                                MD5

                                                fe9e2c460afa43f94152de5340e9ac55

                                                SHA1

                                                284b4acde54764eb6ffa125dd2998ebb20dd6c29

                                                SHA256

                                                923fdcb194f59f0b40113fa559c33fb93ca75b2373605141b8aec14b2848f924

                                                SHA512

                                                7d7b9f777a0179234280cfd4fb67e509c971abd9ac2464bdd1a5d829ec753e42c9cc1093e6cda511bacfd18deccb44f6bb6003f18f7c99772c1db7119783c9d4

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\7cc34895-9467-4b40-a56f-09b6c9bb9ab1.vbs
                                                Filesize

                                                744B

                                                MD5

                                                c0916334b1c425e22df6968508819891

                                                SHA1

                                                b67a5d1da70971619aaf3a5c06a4f56417266fed

                                                SHA256

                                                cd21358671f9e8235778a01b20a5bea2b7bfbc22c5b9ed4e8303707f8f583756

                                                SHA512

                                                3ff141e77d9709b82e2ceea69200bc2c6b58d36c78248313c7774b0730de4522852c3696b156614ee51af11bb04b1442593b8e7d5e12c9e7a403d1c1b0f21d53

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\919c7530-e983-41da-b423-17de466efa44.vbs
                                                Filesize

                                                744B

                                                MD5

                                                21d9d3b180d14e6ad6f48ba5b3bd5209

                                                SHA1

                                                b83e981691840f36b5d55ead275ec3a604909c12

                                                SHA256

                                                ad4090102dfa198e505dfad6ba72284c99e146b8d821d4262c7188fff919f430

                                                SHA512

                                                761806312c830135becb39bf65d884b7039aea761a9ffe4cd5fecec5b875a2be733d404f61e49e3c118e529870b72eb1382f1198cbe3ae67bcff279e017100df

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\a838e40c-3401-4aa5-9a41-0d0037fb05a8.vbs
                                                Filesize

                                                744B

                                                MD5

                                                6b2fe04ead652b5733f5be74ac8fb9f7

                                                SHA1

                                                98cfd552a2b9a2a53ce7452799581cf285964f7a

                                                SHA256

                                                13b2d159007a4035e306029b967d42708ac8d7411dc26657c924929659559ce8

                                                SHA512

                                                166b656db6159d6a440ccf11a868b8ca99bb51a97276c6021bff39132d92d83286ee18351c3b021c5ea015a3c243ab2ed13d0e1962a4c7c251b516c60ef1fbc3

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\cd8a5dde-224d-4755-bf02-c632980dd1a9.vbs
                                                Filesize

                                                744B

                                                MD5

                                                38a20fa435c61efde5c77bc6fa6f3186

                                                SHA1

                                                dd1fa218def7fac1a1cb38df69d61d654ec2d2bc

                                                SHA256

                                                4b6a995bb02e13a1046f4e669c3a3855362a112629b8cb04518cdcc6a1d7fe07

                                                SHA512

                                                9cb35915e1bf730faad3f74a07a7c3470df84bb8ddd5fa9fdec49076d96c79931badfaa84529766befe95b165f31b0abcaa7bcf3f8e06eafc0beee9a8b4748f9

                                                Download Submit

                                              • memory/1448-140-0x000000001C380000-0x000000001C392000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/1640-105-0x000000001B090000-0x000000001B0A2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2008-186-0x0000000003030000-0x0000000003042000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2124-210-0x000000001B6A0000-0x000000001B6B2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2272-241-0x00000000029D0000-0x00000000029E2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2680-29-0x000000001BBC0000-0x000000001BBC8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-35-0x000000001BC70000-0x000000001BC7C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-41-0x000000001C340000-0x000000001C348000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-42-0x000000001C350000-0x000000001C35C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-43-0x000000001C360000-0x000000001C36C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-44-0x000000001C5E0000-0x000000001C5E8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-45-0x000000001C570000-0x000000001C57C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-46-0x000000001C580000-0x000000001C58A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/2680-49-0x000000001C5B0000-0x000000001C5BE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2680-48-0x000000001C5A0000-0x000000001C5A8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-47-0x000000001C590000-0x000000001C59E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2680-50-0x000000001C5C0000-0x000000001C5C8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-51-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-52-0x000000001C5F0000-0x000000001C5F8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-53-0x000000001C700000-0x000000001C70A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/2680-54-0x000000001C600000-0x000000001C60C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-39-0x000000001C320000-0x000000001C32C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-38-0x000000001C850000-0x000000001CD78000-memory.dmp

                                                Filesize

                                                5.2MB

                                                Download

                                              • memory/2680-37-0x000000001C2F0000-0x000000001C302000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2680-36-0x000000001C2E0000-0x000000001C2E8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-17-0x0000000000AA0000-0x0000000000E0A000-memory.dmp

                                                Filesize

                                                3.4MB

                                                Download

                                              • memory/2680-40-0x000000001C330000-0x000000001C33C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-34-0x000000001BC60000-0x000000001BC68000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-33-0x000000001BC50000-0x000000001BC5C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-32-0x000000001C290000-0x000000001C2E6000-memory.dmp

                                                Filesize

                                                344KB

                                                Download

                                              • memory/2680-18-0x0000000003020000-0x000000000302E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2680-31-0x000000001BBF0000-0x000000001BBFA000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/2680-30-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2680-28-0x000000001BBE0000-0x000000001BBEC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2680-19-0x0000000003030000-0x000000000303E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2680-27-0x000000001BBB0000-0x000000001BBC2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2680-26-0x000000001BA90000-0x000000001BA98000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-25-0x0000000003090000-0x00000000030A6000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/2680-23-0x0000000003070000-0x0000000003078000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-24-0x0000000003080000-0x0000000003090000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2680-20-0x0000000003040000-0x0000000003048000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2680-22-0x000000001BC00000-0x000000001BC50000-memory.dmp

                                                Filesize

                                                320KB

                                                Download

                                              • memory/2680-21-0x0000000003050000-0x000000000306C000-memory.dmp

                                                Filesize

                                                112KB

                                                Download

                                              • memory/3140-198-0x000000001B3B0000-0x000000001B3C2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3312-93-0x000000001B630000-0x000000001B642000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3944-128-0x000000001BD50000-0x000000001BD62000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/4500-152-0x000000001B820000-0x000000001B832000-memory.dmp

                                                Filesize

                                                72KB

                                                Download