silverrat | 57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740

Analysis

max time kernel
80s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows Security Notification.exe
Size

86KB
MD5

434184cbd1ab6d8b3e6d04d69df75f4f
SHA1

39788e96ff6c0a7f1e7e257715e64b696198151b
SHA256

57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740
SHA512

4dcd69e84e8b031d83953a9165745c6daba6538cfebf4e76cf6f7f3f92aef4d334013be15d2b20bd4d126994059e1c1d1733ab444954ff3cf26e99f912c01c2c
SSDEEP

768:nMWKyi7didYfW/QdVXxRWl7H2+ZKJ7smhQpq/BRUT0fk9wGluB6SrDDv6/bB2Lj9:nMe2YVHYDCpwGAc9mokDDS/l2Lj9

Score

10^/10

silverrat evasion persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

policies-beside.gl.at.ply.gg:9967

Mutex

xhhCQtIByF

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1307565056380108840/pkpOqO-Y8vruO8aeIu53yzS3l1IFMwpDSYDrGkNa1byaHAiKSa4-gLYX_DpLfjxLj0q9
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
RFNmZ1JPaXBaQXBxS05BdUdsQWNWU0VHREZSbmRK
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
LU2wsiaOZ+/gZCLn0p/f7HnmbeuGF/B6ewFYcy0TAoCbL4cHqQZDETE02FQQQOpK0ycwb+sWB6hmbN5YVwd5kelF++2dUp3hd3yuGDK5LGIXWBz+kDFpcPCj87CLCJRnsV5khSfdXX9dLF5Iq0+fMAJb5S3M7kMYTsLsEP19/AWVP8WG1ZzsQMrjEZXfiXYvM1317wLwiXYPMy+spia0hVEZl7sXN7oM09PyHBVF2AYlmggjBUUkLVvhXasGKhBltrgdopTpGkPVUI1wr6Vaj0V55MG85DmcxRl6c99Tnn8/mi7xx1GOIki2wSrwXHf0LTW+EaPhc/JrdrZxlJtWZHRsGJGORjeN+sk4/p3rXWGvT3j8Wl44vyZAEmkJzOsWaDB6Mqnhf1BC+HfGjTayVUD+Rosklv3ZAwGhl4X9kN/Zv9oyfs0686LvfL5eGTRoidP0vr5NBsISTuJ6UFZ3qfIBaEVc97kNbntqIUj/jIy9AJr9/qgPCTLBPmaqiFYqlKcySYG9FcEvHosS08+vKgjs6tXypcocqOgacjWjg2/C/1RLqwrFSbucdNkvG0d5IFHHniydWX4aRcSpT1F3DRFW+uY1TpEPLpL/SZdgown4ZwlGCgkxjo/TPOADHZBYY1fqqqXbXO1nxQew+sspmqw4pz2Gb+XXUQmK2cq71xQ=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1980	attrib.exe
1168	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Windows Security Notification.exe

Executes dropped EXE 1 IoCs

pid	Process
4444	$77Windows Security Notification.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\Windows Security Notification\\$77Windows Security Notification.exe\""	Windows Security Notification.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	discord.com
28	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1560	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3640	Windows Security Notification.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
4444	$77Windows Security Notification.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	Windows Security Notification.exe
Token: SeDebugPrivilege	3840	taskmgr.exe
Token: SeSystemProfilePrivilege	3840	taskmgr.exe
Token: SeCreateGlobalPrivilege	3840	taskmgr.exe
Token: SeDebugPrivilege	4444	$77Windows Security Notification.exe
Token: 33	3840	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3840	taskmgr.exe
Token: SeDebugPrivilege	1364	taskmgr.exe
Token: SeSystemProfilePrivilege	1364	taskmgr.exe
Token: SeCreateGlobalPrivilege	1364	taskmgr.exe
Token: 33	1364	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1364	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe
1364	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	$77Windows Security Notification.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1980	3640	Windows Security Notification.exe	84
PID 3640 wrote to memory of 1980	3640	Windows Security Notification.exe	84
PID 3640 wrote to memory of 1168	3640	Windows Security Notification.exe	86
PID 3640 wrote to memory of 1168	3640	Windows Security Notification.exe	86
PID 3640 wrote to memory of 636	3640	Windows Security Notification.exe	94
PID 3640 wrote to memory of 636	3640	Windows Security Notification.exe	94
PID 636 wrote to memory of 1560	636	cmd.exe	96
PID 636 wrote to memory of 1560	636	cmd.exe	96
PID 636 wrote to memory of 4444	636	cmd.exe	98
PID 636 wrote to memory of 4444	636	cmd.exe	98
PID 4444 wrote to memory of 3368	4444	$77Windows Security Notification.exe	101
PID 4444 wrote to memory of 3368	4444	$77Windows Security Notification.exe	101
PID 4444 wrote to memory of 2504	4444	$77Windows Security Notification.exe	103
PID 4444 wrote to memory of 2504	4444	$77Windows Security Notification.exe	103
PID 4444 wrote to memory of 2884	4444	$77Windows Security Notification.exe	105
PID 4444 wrote to memory of 2884	4444	$77Windows Security Notification.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1980	attrib.exe
1168	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Windows Security Notification.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Notification.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1980
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1560
- - C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe
    "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:3368
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77Windows Security Notification.exe" /TR "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe \"\$77Windows Security Notification.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:2884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3840

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat

Filesize
190B

MD5
3a6a190252266190999a5ccf41a90c21

SHA1
129186a5474874440c2da34ccc728e94dcbd175f

SHA256
be989fe6c86a00f2577b63821759b9c28bf4912427faaf7fc767db061141d171

SHA512
3a7a4e77b4ca6756d79f1317970d4fbccd4f447f9272c3f85ab46c53d763ebb5df1dcbc3ea6f7ccf66a6708f85547a5759c476d34f2364948be2cd0511a23b89

Download Submit
C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe

Filesize
86KB

MD5
434184cbd1ab6d8b3e6d04d69df75f4f

SHA1
39788e96ff6c0a7f1e7e257715e64b696198151b

SHA256
57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740

SHA512
4dcd69e84e8b031d83953a9165745c6daba6538cfebf4e76cf6f7f3f92aef4d334013be15d2b20bd4d126994059e1c1d1733ab444954ff3cf26e99f912c01c2c

Download Submit
memory/1364-34-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-27-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-35-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-36-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-37-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-38-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-39-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-29-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/1364-28-0x0000028ACAA20000-0x0000028ACAA21000-memory.dmp

Filesize
4KB

Download
memory/3640-0-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

Filesize
8KB

Download
memory/3640-3-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

Filesize
8KB

Download
memory/3640-1-0x0000000000AB0000-0x0000000000ACA000-memory.dmp

Filesize
104KB

Download
memory/3640-4-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/3640-2-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/3640-22-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

Filesize
10.8MB

Download
memory/3840-13-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-14-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-11-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-5-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-6-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-15-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-16-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-17-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-12-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/3840-7-0x0000025D46380000-0x0000025D46381000-memory.dmp

Filesize
4KB

Download
memory/4444-43-0x000000001C8C0000-0x000000001C8D0000-memory.dmp

Filesize
64KB

Download
memory/4444-44-0x000000001C8D0000-0x000000001C8F0000-memory.dmp

Filesize
128KB

Download