dcrat | 01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Size

1.8MB
MD5

f3d2bbf94502d252041c35316a3437be
SHA1

337394ddba850c7e6c937087f93d1fa2dfcad0a2
SHA256

01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83
SHA512

e56b5f191ade12a301d249e17c3d933fcf11e18a591734b503ee8d106480d2bed92af277aded9c1e4b09b6665fdd1c3bf8069329949a24645b8bc229a8caca3e
SSDEEP

49152:5WqKKPZ1snfJ+rqDPuQDLME5MT4rDQNpfh5:jKKZ1sRD2Q3N5MT4rO

Score

10^/10

dcrat discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2748	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2748	schtasks.exe	31

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1904-1-0x0000000000DC0000-0x0000000000F8C000-memory.dmp	dcrat
behavioral1/files/0x00060000000191d1-30.dat	dcrat
behavioral1/files/0x000600000001948d-47.dat	dcrat
behavioral1/files/0x000b0000000120f9-58.dat	dcrat
behavioral1/memory/2896-153-0x0000000000FC0000-0x000000000118C000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe
616	powershell.exe
464	powershell.exe
960	powershell.exe
1380	powershell.exe
1892	powershell.exe
1916	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2896	smss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\it-IT\69ddcba757bf72	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\RCXFCAF.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\RCX126.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\56085415360792	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\RCXFEB4.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\smss.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\56085415360792	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\smss.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXF887.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\RCXFEB5.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\RCX127.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Uninstall Information\winlogon.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXF819.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Uninstall Information\winlogon.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\RCXFCB0.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\addins\sppsvc.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Windows\addins\0a1fd5f707cd16	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Windows\addins\RCXF5A7.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Windows\addins\RCXF615.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Windows\addins\sppsvc.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d7418446816de4e9eb468f3576a11a600000000020000000000106600000001000020000000c9c9da53718137668a71b049cd388795911e2cf34c70265d5138d27098457e05000000000e8000000002000020000000721ed5740560958989201dd96efa9ef36b629bf6cce2cd80050bbe55efc9b790900000003af7cf2f46076fd464f4427aa68f9346b83c05a512f6d15bddbe288be068ae48c59635ad3b615a0eee02f5a28d44db68d917c1c8a3b8a9305e1667170d5d19bdb55942157cbcb4bdb1a2949cfcc3f82d4cf2f46279edccf5f3975de705d2d7932a24931280f2097c23746e9e468b519d513e00f7b574ef01081b246b15d1e02bf9eb64fb3ed6485d3a86a1f0544ed2d3400000004701230dff858e772b93c09614e5a0da541caf3ab1002f15a679a6bdaca848b593a647d56c7539e8b977bfee15e7bcb950a3194d771305406706d899b0fb1dfb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49DEC6E1-B08E-11EF-80FE-5E235017FF15} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439292932"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d7418446816de4e9eb468f3576a11a600000000020000000000106600000001000020000000ae931cd14a138a3382b5a33a4a0295890c238f3ac977e8d766702f26711c4620000000000e8000000002000020000000dd8c1c905c197fc34dcd564092918a6c9e320c7ddfc51765c7d46e1e612b9fb020000000c4cfd758369beef67f4d17ec951fea3ee3ce4d46173d3707d8ec0caf49b5a60940000000a254428a16c6d54ca0b8d3150b4f596db0efcb7936e106ab41104a18b4bd83b45bd7711e7f4e92be975feaa2c041b6b483af654c2546171d295a2dce8b322736	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09dd7219b44db01	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe
3052	schtasks.exe
1392	schtasks.exe
528	schtasks.exe
2544	schtasks.exe
2828	schtasks.exe
2920	schtasks.exe
2356	schtasks.exe
2628	schtasks.exe
2604	schtasks.exe
2616	schtasks.exe
1664	schtasks.exe
264	schtasks.exe
2860	schtasks.exe
636	schtasks.exe
2660	schtasks.exe
3044	schtasks.exe
2012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
2516	powershell.exe
464	powershell.exe
616	powershell.exe
960	powershell.exe
1380	powershell.exe
1916	powershell.exe
1892	powershell.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe
2896	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	smss.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2896	smss.exe
Token: SeBackupPrivilege	1472	vssvc.exe
Token: SeRestorePrivilege	1472	vssvc.exe
Token: SeAuditPrivilege	1472	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 616	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	50
PID 1904 wrote to memory of 616	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	50
PID 1904 wrote to memory of 616	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	50
PID 1904 wrote to memory of 464	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	51
PID 1904 wrote to memory of 464	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	51
PID 1904 wrote to memory of 464	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	51
PID 1904 wrote to memory of 960	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	52
PID 1904 wrote to memory of 960	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	52
PID 1904 wrote to memory of 960	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	52
PID 1904 wrote to memory of 1380	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	53
PID 1904 wrote to memory of 1380	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	53
PID 1904 wrote to memory of 1380	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	53
PID 1904 wrote to memory of 1892	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	54
PID 1904 wrote to memory of 1892	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	54
PID 1904 wrote to memory of 1892	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	54
PID 1904 wrote to memory of 1916	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	55
PID 1904 wrote to memory of 1916	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	55
PID 1904 wrote to memory of 1916	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	55
PID 1904 wrote to memory of 2516	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	56
PID 1904 wrote to memory of 2516	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	56
PID 1904 wrote to memory of 2516	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	56
PID 1904 wrote to memory of 1544	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	64
PID 1904 wrote to memory of 1544	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	64
PID 1904 wrote to memory of 1544	1904	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	64
PID 1544 wrote to memory of 2772	1544	cmd.exe	66
PID 1544 wrote to memory of 2772	1544	cmd.exe	66
PID 1544 wrote to memory of 2772	1544	cmd.exe	66
PID 1544 wrote to memory of 2896	1544	cmd.exe	67
PID 1544 wrote to memory of 2896	1544	cmd.exe	67
PID 1544 wrote to memory of 2896	1544	cmd.exe	67
PID 2896 wrote to memory of 2864	2896	smss.exe	68
PID 2896 wrote to memory of 2864	2896	smss.exe	68
PID 2896 wrote to memory of 2864	2896	smss.exe	68
PID 2896 wrote to memory of 1980	2896	smss.exe	69
PID 2896 wrote to memory of 1980	2896	smss.exe	69
PID 2896 wrote to memory of 1980	2896	smss.exe	69
PID 2896 wrote to memory of 2332	2896	smss.exe	74
PID 2896 wrote to memory of 2332	2896	smss.exe	74
PID 2896 wrote to memory of 2332	2896	smss.exe	74
PID 2332 wrote to memory of 1200	2332	iexplore.exe	75
PID 2332 wrote to memory of 1200	2332	iexplore.exe	75
PID 2332 wrote to memory of 1200	2332	iexplore.exe	75
PID 2332 wrote to memory of 1200	2332	iexplore.exe	75

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
"C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\it-IT\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fwAG7KGXHJ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2772
- - C:\Program Files (x86)\Windows Mail\it-IT\smss.exe
    "C:\Program Files (x86)\Windows Mail\it-IT\smss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2896
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6f309e7-b147-4995-94ec-ebd4fef6f306.vbs"
      4⤵
      PID:2864
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd525d6f-4f5d-4029-ba77-99614bfffd48.vbs"
      4⤵
      PID:1980
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:13385/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\addins\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\wininit.exe

Filesize
1.8MB

MD5
f3d2bbf94502d252041c35316a3437be

SHA1
337394ddba850c7e6c937087f93d1fa2dfcad0a2

SHA256
01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83

SHA512
e56b5f191ade12a301d249e17c3d933fcf11e18a591734b503ee8d106480d2bed92af277aded9c1e4b09b6665fdd1c3bf8069329949a24645b8bc229a8caca3e

Download Submit
C:\Program Files\Uninstall Information\winlogon.exe

Filesize
1.8MB

MD5
0d629d521038c6e55f07bba212f19069

SHA1
1529399893c23d3675e2bf7bc5b549d803d7cf71

SHA256
1bd10975a3560f4c0b1dc11163d799e58422cc0d895050fb0376cb74138da391

SHA512
b5fe498e81dd782e8f1b5e5ebcb25b1778630c477fe655ebf5e1ebc4dc49dfb3b12461e9cc309e09c52fce3d7bbf5bffc59e873603df2d0bb88191199ac397e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de8962ba51e27e7d4bdc422c9d420623

SHA1
9e38bb2e2eee534c78fe723c97e21aa270989d3d

SHA256
2d0cca91ef792d8865ef2ed9c0e6e28ef09492343166e378d8f932f64d808832

SHA512
687dea679f0a3c4519cb5724c1dbd9e4b6d5e0879c8a30c2f4971a991adf21675c5cb53e62f69482982f5fbffcb686de67a27b4d0566d855021c6d087264ad83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9898d4f940b95e399c1c12cedbddb4d5

SHA1
9e88c918b7dea5d268bcdc56704131d1b3a29473

SHA256
db71e7121295ae1ed5e9faefcf102f527a29093b41ce2aa84aa94f151dbdaf5c

SHA512
22a9e0f20b6016a8f0b59671e8b32b8f932264bf8c18507dfb6a5c5bd052de1bbab376d1e2c80f39433e35fcd410d05917b93803f94b93575d5820d9b4a67b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9bd8c53965400b9a2fa78bb75563ca3

SHA1
5c2fc602282fdf9e22024b05665c2c157651edda

SHA256
5ec0c73038963491148ce05d75b75d66d44595809c3db062317e7e27adc1c136

SHA512
ee3b280ede80fdabd7b8363a1b82ca81937079588c0a4037ab335991b13b3e81e79bc8c3a45044dbf045b16103af8f1b2245aa6e2d38603019c2fe130e5f9f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d087aff4dff6e506105ded49e311ef21

SHA1
706e03e8b5aa605f839fe8c95b083214b5200f47

SHA256
cab18b738607b0dcad9d855e339fc18ae70c5683d72f005259e93c6fdedc29bc

SHA512
8dd6b88e68ba144c90209c23555cd5fa91933cdc203a860272320fa100e60324a0a3abb6322a1e78e2bab179ae8d33f39941a1957693eae16fb621b03ea7e586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bfe4ceac04b31295419986e53149bd

SHA1
e6cb17036378afc6c15bd1cb6ce6dce5646cef74

SHA256
c649119a1fd533c662c3824e89b53790069eb52f7f58b0cd020dbcff8a86c533

SHA512
f0f73fbbde35745f8d44541b3cea4ffb4f8fb33f9209463ae97aae0b3dc44adb6f5d9831c472775b4596d8674eb6b1dd572172e74521e7d5edc22e2a1576cd9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fd897dd78398482d73b0f8f2144776

SHA1
cef7da43e0cc891de44ce496ba1af78fb780480f

SHA256
7295a701808c685ed8063a9d1cea4ebd8320649282c0bc48dc36830ce456f6f8

SHA512
8a99a6752d84d8b41c98c1c098ec559f2b005e7ee61344be0405d4371fce997b0c37500b80e6100353944c209d0c4a9fc9edd45fb66279f671d38c7ba0641327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96d8b0b534390317c074e0aa5e3956ee

SHA1
64d8e4b9047f3fe4d14ca0cdf36902e1f8257e00

SHA256
cb8431ca82a8fd70ed69c460394a90faee7f584783b163154825101606b87720

SHA512
304b19297e6a7a6db8afd4219f621c5613f7b2f6504bab3a26664ff64f176a78d4e4cac3e96179b52c66f64339fdb24466fddd534d4c0b77570358eb237e418f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba743cc496cab9f4c3f332ddb0218d52

SHA1
278af5df20f4045f9a8431f5e1e5c2aa8c45243c

SHA256
df302269627056377a4bd6338c15f1563e43da167a2a7da70eaea573c2954697

SHA512
f62686f5b2e897b6571c1d370fda588f8a1b89e5d9c58ba325a803b03aadf52726cddfd4f84b93df833e0b4ff05e97ff02bc3bb506f1f2a52f3e06206e0b7ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c462ea718fe5c0f0005aa3450268c6b5

SHA1
77ae669b3aee8eb96dd9ba07fda717b682573f31

SHA256
f63effccb83c9c01239a9d8db3e7a0230815e33276285bac65a3d51dea2d0a6f

SHA512
76ea962e307f3854d8082d650595f87da56c193b5ba939be29429070646bcd476da8d65d17788b5c9b9024a62bde224294c3ea6c4fa2476bc716244a656d8102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6a46c8a22677075d8e04d92a05bcf0f

SHA1
0533c8fd1092fca079d2bde5a73dc0bbe6f40c03

SHA256
f54628c75881adfce951861438df81e9b00f40117eeb96236a24966d372df000

SHA512
1fd65a6fab0880d26560d0dda66e5ed56c8ae999a61e598b23dad6c935c1d61da6e4f2f7861849532b69f5f66ac2817d5e7de393bddaad302bc294521745ed70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebf98c4fa8c4cd0a91cb9de272d4b79

SHA1
f79083c974f1d849b619d264c013d8b03051e0ec

SHA256
44a411e9a47e89f037bc9e5c55d4f64e5f5ba0fc8ab2940b6525cc6aca3fb24a

SHA512
715207b10f15221ec03b294fd999aa3d397e19ea7576d1db9a1089128bad8386857352cceeb9194b80387778b4141023d94410134c3b5524b6d9713d8b32e6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19b127eef0407bacd01833f3a9850b9b

SHA1
ac2baf03bf5f001081f0da60d685248a12d1bb8e

SHA256
752d77e510e3dcd890ce9f20858b535eb855cfeeac2dcbe8981fb653737c3ffa

SHA512
bad320116f49009562c834c87b0734485e987f44ed1b4744fd7badeb9e6c5da76e54136455b4a4abed222004afef0bd52f7358ede30c52e8a8315c37475d7736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df9066905032ce1ff88735dce0bc62f

SHA1
93e9727cfef55fa592df4b94b37734c4815f7311

SHA256
0ba7534a8c45d335d4c9092342b629fd47df550abf5a1831aa11fac84bb587a3

SHA512
c9cdf0303e16cd040360f2bdca1aed681caf4ff511f788300f70227606f036d10c645dcb8b0bfd959802eda352617458a3c1b07fe57d1be551e5b54823a41475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
934a6334af65192f1b835c12040595ba

SHA1
9eac521fb5cf3286c19645ab8760313af8b7a067

SHA256
84ec7b15191a602273ea608f4f4bbb03b82a22e608a7384153da6499227b26c0

SHA512
c52eefebe8635e60278babf028acec3b3ace925d6f824928c00b14fc048e6363a20af573c3760ffcb147a3a5729e9a746e46d2aaea3d26ad951307e0973755c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
497abf77797e46f8d4cdc22fc7d1608f

SHA1
b4b66020cb0ebe5f6a273732ff3b66ee735213c3

SHA256
b3207622de29650f76329301e4b0e948b34f3f267ead64962e62501f47954d20

SHA512
2f6234510be2060684056758b44ebbef24eb12e1ac6b4fda1e51e67cdad7c0941e72c439e4b8ebc02b9416c889c9caf3f4b3a04660415b579030c1ea6aa14b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33d30fb23fc3c023ecf391e2f487c8b9

SHA1
c86b0b2d9f25078346ed202e92ad58a405aa7a7d

SHA256
e56eb67cadb96debce73c7f1f9036e7434f76c0dd844060707d4ff2256581a8f

SHA512
13f6d0a7c82b7de56b1c5be87cdae8e09eb0a8c9cb82611b90568794965c47d030651371cc2fed38a323da8b24d393d83d98cd514a1bbf0af830b96af75c0684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f4b13940db95b9eb5391e4c55b8e715

SHA1
ba5a1b6b7ab4d34560a5919b3d36f67a15a65905

SHA256
7185e3b3e4ebcddf23a7f492ee51ce385ce6bb3c345a9ca29f626b6b17f55b66

SHA512
18fae2b3eaf3c265b808f26d10c1bc5d7d88d947fe9f30927db5cfbf792d31b8feefedd07d60703cfe171388e3b298ae6dab8e9b1b0023ae241394dc39f41caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c89df2e75ccae9a027169a690b6b89d

SHA1
c60a7cb1a0bf40ae2642db758b283c107e592aa5

SHA256
ddd7488e00e967b7282350cc4bdafc2d01285c0e4dd8c85634dacd35b894f602

SHA512
cbc686176e672b8e29a2f84b1d4415a42c07b8c9990cdc2ed261a4ae5e6f9d48db8af2dff52e409e5faebe63da998c3fb6dbeb0f2f187d2420b9dccf31fcbb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
191f57dfb2e9be9acf9b058dcb08e92d

SHA1
f502b9d9d878a153f080b7e6a991b8ac71851444

SHA256
2b98a3ba5d8964d83968abb1f6cf8f9215c69f345bee3b4b50e2d0d958de0163

SHA512
fb9261812ab4b47fb70bbd858e7133a3dc98a92f334019a8c778894234f353999bc2e24050c7c26e56ec9b3c1babdcc1ec02289fbc22b30dab4eed45b42cc2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8144.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81F2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bd525d6f-4f5d-4029-ba77-99614bfffd48.vbs

Filesize
502B

MD5
6ec90684954191765b42a007121e097a

SHA1
f862b4de795d41458658bccdf10381e9df6557ef

SHA256
ddfba6a5f3ef0275482d73b3e23a597cda7926de6ae26496ecc0b51962550732

SHA512
a7035d8f9f6dc0bf3dca0721c94cc7083d0cfe805da13264701549bbb5d17d13bb0343543d2c8420a4cbde63df00736628effa4f81b0554a5723c7d61bc3fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6f309e7-b147-4995-94ec-ebd4fef6f306.vbs

Filesize
726B

MD5
0f2992cadf3c49732ffb13d1c8c5d50c

SHA1
955e3ad55b4a7892e895c3cfe472b29f234d3be9

SHA256
aab22eee8a7c2781370390ad1cc8810229e19b7c5f7fc2c93e1708524772bb0c

SHA512
e49a24ebdf40d79cbad63ac042e298d8fa916073532ebd85edfbf63109955bce241d7512a0e9d3c8c686fd92c29d654dc9165b58cfc8aa3d7727942c38225cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fwAG7KGXHJ.bat

Filesize
215B

MD5
664b890ef2bf3f5932a5c448dff2ac3c

SHA1
5c9dde7a6b5452f3e8ba04a08dfd331b7657fb20

SHA256
8710897fe0db7af6a57cb5588215b6ef4efff2e3ed2b45c25fdb6c9ef5f89f05

SHA512
878e49af768b10e6cab76f1b35dd0ec97eda35c1705c669ba0474e29ee380a3bf0ee42030f754c27123583ad02291086e90892e3a636f8141c1c1c6b17222b46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
abd96ca33fdcadd911ccd7afcf8fec78

SHA1
f679c7d57c8006bd1cd3ef126b77c1e09f2991b9

SHA256
a9663fb0753a7692d3f523b7fc4966f13f6de6883502d5b51bba4fddbb49df34

SHA512
c965b15d47b369082b97f72f880d3183e1e3f651056df13a6eeb2be5667c3001c542e1a69437f02238cc82f652c6b4d35c73e5bf60179306eb1500b70722d18b

Download Submit
C:\Windows\addins\sppsvc.exe

Filesize
1.8MB

MD5
9a5daea57391cfb5d875b8b13b780988

SHA1
623e3f38b88695add9f01a717f0c160fe2acf613

SHA256
0192036d0b4ffbea82e4f718f585d0fa3a0867f7dd70a8394f796f011d4a4344

SHA512
818e8e573f20ea72c009b2d9a55afe824acdac4d9c1ed9718300fc1f6d78c2bc3b26ad41cc9f90b725e442ea0535a40f9309ecedac620dd49c7108420ce1be63

Download Submit
memory/464-149-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1904-15-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/1904-23-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/1904-13-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Filesize
48KB

Download
memory/1904-1-0x0000000000DC0000-0x0000000000F8C000-memory.dmp

Filesize
1.8MB

Download
memory/1904-12-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download
memory/1904-20-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Filesize
48KB

Download
memory/1904-19-0x0000000000C90000-0x0000000000C9C000-memory.dmp

Filesize
48KB

Download
memory/1904-11-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/1904-17-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/1904-16-0x0000000000C60000-0x0000000000C6A000-memory.dmp

Filesize
40KB

Download
memory/1904-113-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/1904-14-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/1904-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/1904-2-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/1904-18-0x0000000000C80000-0x0000000000C88000-memory.dmp

Filesize
32KB

Download
memory/1904-10-0x0000000000B10000-0x0000000000B1C000-memory.dmp

Filesize
48KB

Download
memory/1904-9-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1904-8-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/1904-6-0x0000000000490000-0x00000000004A6000-memory.dmp

Filesize
88KB

Download
memory/1904-7-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/1904-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1904-4-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/1904-3-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/2516-150-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2896-153-0x0000000000FC0000-0x000000000118C000-memory.dmp

Filesize
1.8MB

Download