Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://disk.yandex....

windows10-2004-x64

10

Analysis

  • max time kernel
    331s
  • max time network
    331s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-02-2025 15:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://disk.yandex.ru/d/WParBzB259JkAQ

Score
10/10
dcratcredential_accessdefense_evasiondiscoveryexecutioninfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • DcRat 13 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Process spawned unexpected child process 16 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 7 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disk.yandex.ru/d/WParBzB259JkAQ
    1⤵
    • DcRat
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe39cecc40,0x7ffe39cecc4c,0x7ffe39cecc58
      2⤵
        PID:2480
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1904 /prefetch:2
        2⤵
          PID:1060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
            PID:1256
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2432 /prefetch:8
            2⤵
              PID:3796
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3120 /prefetch:1
              2⤵
                PID:1328
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3172 /prefetch:1
                2⤵
                  PID:628
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4704,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4764 /prefetch:1
                  2⤵
                    PID:2288
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5236,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=5248 /prefetch:8
                    2⤵
                      PID:2540
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5428,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4976 /prefetch:8
                      2⤵
                        PID:2860
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5348,i,7203388365661666212,5892818315605311570,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4928 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5944
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:5048
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:768
                        • C:\Windows\system32\OpenWith.exe
                          C:\Windows\system32\OpenWith.exe -Embedding
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2324
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:624
                          • C:\Program Files\7-Zip\7zG.exe
                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\bootstraper\" -ad -an -ai#7zMap15941:84:7zEvent20489
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:2444
                          • C:\Users\Admin\Downloads\bootstraper\bootstraper.exe
                            "C:\Users\Admin\Downloads\bootstraper\bootstraper.exe"
                            1⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2292
                            • C:\Users\Admin\AppData\Local\Temp\taskkkkt.exe
                              "C:\Users\Admin\AppData\Local\Temp\taskkkkt.exe"
                              2⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              PID:1440
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Msdrivernet\x6SEhPmsdq11GNGhC03Y.vbe"
                                3⤵
                                • Checks computer location settings
                                • System Location Discovery: System Language Discovery
                                PID:4308
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Msdrivernet\QSVDJppKNQyKqg68RpY.bat" "
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3120
                                  • C:\Msdrivernet\Saveshostnet.exe
                                    "C:\Msdrivernet\Saveshostnet.exe"
                                    5⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4404
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msdrivernet\Saveshostnet.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3824
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\SearchApp.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2760
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msdrivernet\dwm.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3128
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2544
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msdrivernet\dllhost.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2132
                                    • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe
                                      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe"
                                      6⤵
                                      • Modifies WinLogon for persistence
                                      • Drops file in Drivers directory
                                      • Manipulates Digital Signatures
                                      • Boot or Logon Autostart Execution: Print Processors
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Indicator Removal: Clear Windows Event Logs
                                      • Drops autorun.inf file
                                      • Drops file in System32 directory
                                      • Modifies termsrv.dll
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      PID:5264
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N7XO3McAFn.bat" "
                                        7⤵
                                          PID:3340
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            8⤵
                                              PID:5500
                                • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2128
                                  • C:\Users\Admin\Downloads\bootstraper\luna\Luna.exe
                                    luna\Luna.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:2340
                                    • C:\Users\Admin\Downloads\bootstraper\luna\Luna.exe
                                      C:\Users\Admin\Downloads\bootstraper\luna\Luna.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:4968
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\SearchApp.exe'" /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:3824
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\SearchApp.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:1168
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\SearchApp.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:2132
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Msdrivernet\dwm.exe'" /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:1864
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Msdrivernet\dwm.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:4512
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Msdrivernet\dwm.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:4416
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe'" /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:3688
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:844
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\WmiPrvSE.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:3272
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Msdrivernet\dllhost.exe'" /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:4652
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Msdrivernet\dllhost.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:4432
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Msdrivernet\dllhost.exe'" /rl HIGHEST /f
                                1⤵
                                • DcRat
                                • Process spawned unexpected child process
                                • Scheduled Task/Job: Scheduled Task
                                PID:1500
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /delete /tn "WmiPrvSE" /f
                                1⤵
                                • Process spawned unexpected child process
                                PID:736
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /delete /tn "WmiPrvSEW" /f
                                1⤵
                                • Process spawned unexpected child process
                                PID:5992
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /delete /tn "WmiPrvSE" /f
                                1⤵
                                • Process spawned unexpected child process
                                PID:4540
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /delete /tn "WmiPrvSEW" /f
                                1⤵
                                • Process spawned unexpected child process
                                PID:1252

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Replication Through Removable Media

                              1
                              T1091

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Print Processors

                              1
                              T1547.012

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Print Processors

                              1
                              T1547.012

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Indicator Removal

                              1
                              T1070

                              Clear Windows Event Logs

                              1
                              T1070.001

                              Modify Registry

                              2
                              T1112

                              Subvert Trust Controls

                              1
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              Credential Access

                              Credentials from Password Stores

                              2
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Windows Credential Manager

                              1
                              T1555.004

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              3
                              T1012

                              System Information Discovery

                              3
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Lateral Movement

                              Remote Services

                              1
                              T1021

                              Remote Desktop Protocol

                              1
                              T1021.001

                              Replication Through Removable Media

                              1
                              T1091

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Msdrivernet\5940a34987c991
                                Filesize

                                261B

                                MD5

                                e96385e0859eadec707981ecbd815cec

                                SHA1

                                0763268209ac2651d73f4c9ea7863583473bb00c

                                SHA256

                                1615af42bf5ba83e00f26b2b06382b61110442ef5d801e1f77416a389d8cf261

                                SHA512

                                e15ab9635154cab5cb3626c03ddb05f630ce0dd1f91387fdccae3d959b08234ef046bd99986fdaa7e030ed04b1ca629eacdb409598b31d7438ed9db64fd2bd22

                                Download Submit

                              • C:\Msdrivernet\6cb0b6c459d5d3
                                Filesize

                                540B

                                MD5

                                600bfd7d8e515a67d3185134ec55f430

                                SHA1

                                ac52282101782d33e47d2e3f289460558926eb8d

                                SHA256

                                6f6a23d858bbb5259b37d48b04d9c401f27026bc4f8e06f76e583b5d334eeb70

                                SHA512

                                7ad274408d09860279ede98d3a94c2c38219d7d12fb580197b934b7669805f53ebbcb06de926449e6351ce472b3167867d2dd1c1ff87138ea6a8dd53ce9ff195

                                Download Submit

                              • C:\Msdrivernet\QSVDJppKNQyKqg68RpY.bat
                                Filesize

                                33B

                                MD5

                                379fcf0ed42255ba681895ad8585b447

                                SHA1

                                32d9326d818290a9d8300925ab61cf62f5e9ffdc

                                SHA256

                                41db89702373814e19b3e4a4feed0df45699c81e045f47077dbddbac6a49ce88

                                SHA512

                                e0087e8d891a15e0d2ff097c76ea783dd78541268135f48bb35dceb4c70646752216b846f72119faf278766cad3dc53fda191594b6ab4ef955c8e1345704a25f

                                Download Submit

                              • C:\Msdrivernet\Saveshostnet.exe
                                Filesize

                                1.0MB

                                MD5

                                3b8e6eccefebca78111b82b48d0b6ebf

                                SHA1

                                3bc300fe15313caa65a38c0240d880ccb7d06f49

                                SHA256

                                42108dcce57bd3ad9f597daa1a1d2485120a402e6d76234b48fafcddf283cf7a

                                SHA512

                                275df3fd17db2731414204f7a9f37b231939d3555c3da379a4c406809aab896809631e3b8b8fc33fe5ab7621615b9bfa1eecee05641bf5d7f5163b907c6abe1d

                                Download Submit

                              • C:\Msdrivernet\x6SEhPmsdq11GNGhC03Y.vbe
                                Filesize

                                207B

                                MD5

                                fae1802ba17a6bad4c2d3fd08cbfe6bb

                                SHA1

                                d87ae5e4fe78de0f873444fceb5fd4c9c3e67d48

                                SHA256

                                092d7952ec04540330fda3540ba154540c8d8a5ce357a3b23f7152658b9dc611

                                SHA512

                                1704d06500bad6871d62b03aeb5374fe252c46bd228f6145d4ce00c5d600602ba4c705e09774c3695c877bc75f9f66230290ca800a4019e46b4bc3fad53d2ae6

                                Download Submit

                              • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\24dbde2999530e
                                Filesize

                                28B

                                MD5

                                49e2f0b1c5104f74f565af734dccd7ca

                                SHA1

                                69c4235a47943397e5f112aceac9da0dbc965c77

                                SHA256

                                b0b6eb482aec6c4c3bcebfd45e94588f5714fc2db779b3d8dc293db7c4f3b8d2

                                SHA512

                                c0a0891fcd3a179a94c7aceb94f77868bafbe927801cc5cad7ed840c5e71965d50458ad761fc13cfc4ad3a27e601af33267e05d2a02e4f83594fdd74d90f1b68

                                Download Submit

                              • C:\ProgramData\38384e6a620884
                                Filesize

                                286B

                                MD5

                                ce05f46eefb20f619a3a33049dd89d75

                                SHA1

                                13885ce03c31d6159054addd9c155de03c65f0c6

                                SHA256

                                64ffbf81adbc5c141c45e4a93512e6c8dbdd42692685dd337552c5f318ac552c

                                SHA512

                                3c12a1f191621319c0b1456fe15a5da4caadb55179bcb82147f8e9cf4dc820a435c594b1988d0677cbb26dd9b5d55799a6373d80206b3548a111e96ead15c754

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                Filesize

                                64KB

                                MD5

                                6f68f3ffb1dadefc96d1de1c1d440acf

                                SHA1

                                93abcf8fdcd282debdd613bcf41ced6c773cdf9b

                                SHA256

                                28d04b9d08d447ac0be9dd4cb06480e452d106575bde529e4d6c1f033e4cf4fd

                                SHA512

                                8c39f9efc73e3df517ceca202a6ef9cf38a35be10aeefff95fd9eb3c912174ba89f3c42e356434c3ac77ab342ac5a4d2af2e5e4c8247c8b413d2b7ae3bbabcc1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                Filesize

                                4B

                                MD5

                                f49655f856acb8884cc0ace29216f511

                                SHA1

                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                SHA256

                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                SHA512

                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                Filesize

                                992B

                                MD5

                                ff9615348bafab70a615c61fd851b1ad

                                SHA1

                                4a42b22af709709fb9e23911cc2290aae99ccd8a

                                SHA256

                                896ac590c141fe0109068f3a3d4059fd0a888c0202574e3c4326f9fcec62c38f

                                SHA512

                                a0fc04d882774717cd8aa4967b2ac8b0bd401a960f7d318c3864bf347c424412047fe4c18c8854c03920d376601adbd784a8808ef9e9c6ca6276a466dd3e0be1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                Filesize

                                40B

                                MD5

                                803875f3119ad168088f57828c07d4a4

                                SHA1

                                74f20960bc7f4107d6b47b4ed3df1ed3e8c00d2f

                                SHA256

                                f695eb7f778c845f2e16d58adc2b9b1a1e51aaaaf4cf7af21367b3719bec50a1

                                SHA512

                                fbdbf52e9131f186721a1d0d06231a0ee19dee24d22e282ec3e38c1da580fd6c9a426270386fc3f8c58df4408f392681c7cfa7e6eaf314f5cd5de6e9c42fe734

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4361d510-d3a8-4f6a-a2b5-63ce18edd89c.tmp
                                Filesize

                                9KB

                                MD5

                                90e404393fc89ab2f0a4d6947543ff73

                                SHA1

                                d95ecdddcf327c04bf536190fc97950ed6fe4870

                                SHA256

                                e8150ce2e74518d0eb5c60e6492ec609992d839b6fd1e82657961f3b1555f42d

                                SHA512

                                df33e127cb2f8d4e48b3caf30b3a9d29d44b4301d52073de2f0995afd2a398cedefb86795b7b724ff6478407bfd1778e3d274544961840e03378ef2e05428147

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                Filesize

                                649B

                                MD5

                                9a083d242718f329b79cd41d5e2d594e

                                SHA1

                                2817284f046ec68c037e03e14569be6f26ea1735

                                SHA256

                                cad8a2705f0ebf2f10eb4a685c1964abfe953bfec60d3bb7af9e2c8b46675709

                                SHA512

                                629d83baf63658ddef08d39c7e58d9136ae2d7928979cdea0c3c12631819d59d341d6bf6c17504877d17c57b0fd952ed1cfdd66663124c93b43f56141a1f2f0f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
                                Filesize

                                44KB

                                MD5

                                d8590535cb047b73584eb1c7bdb6f67a

                                SHA1

                                98076ab6657cdd8d11346d17ce735f7b772827da

                                SHA256

                                00121884e48d5317b597f2ab50f383dce040888c4a0c2f5cd4094070e828c851

                                SHA512

                                6acca28041d14ed99c9d12471c89abff8e4965f7f14208c7528f593b6f6305d37fe9c8d28514412c376525a0846d743de4ee9b3afbf63525347d419ddc57e834

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
                                Filesize

                                264KB

                                MD5

                                9e72a2de4b30d2ab80220b8608525c5a

                                SHA1

                                62be5b19d0b0660103021a9c063fd17eef1a0975

                                SHA256

                                42034d330b27f50adab4af436ae14848a18167e02f1c7d98c8498899c7481e4a

                                SHA512

                                4e2cebb2faa92bd2cda54832d0546cdab393fd97e58550bd7631aa313c8976dd48d642328a99523cab98913acf35086947228550b6110d6dd756c3c133911a68

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
                                Filesize

                                1.0MB

                                MD5

                                9cfe638d9c9070d4523aebf8ff485e14

                                SHA1

                                dd82803a24b0ae270408d0267320344ca2ab92ec

                                SHA256

                                334ab5ca467c471669785fb5fd52f293d5c1b5cdda4506413fd29071d652fef7

                                SHA512

                                299d6cfe39b55fe09f5c3aa981d75f445dc6be585867529f297545fd6900c50ff2b097c3cf9958076cc95c78628530fa0bbfbfc09b1e95f9e1323647e98ea8b9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
                                Filesize

                                4.0MB

                                MD5

                                d073f0f641456cab6d2ba44c10fa672d

                                SHA1

                                c1ef9a2664c0ad9377395b35d8dedebce611c5dc

                                SHA256

                                d74c70ce864fcf82d85d1f2f298976c110123d0110852b017dc38f21f2143f05

                                SHA512

                                8a9e645fd889579cf973041606a06fb5d69d40488c1fc5596335c850ab1f284a5145c0facf746a3ebbdc1f1cb309d8dfd523d1844ee9bd34d8ff61a5c9585d08

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
                                Filesize

                                22KB

                                MD5

                                dee99d4af92269d231e2f5c4afeb93ff

                                SHA1

                                b68511bbbba4caeff8838e8546065c7c97f9baef

                                SHA256

                                874bb6a78c1841cce808752e780ba34abdae60cb573851c37ee43dfa650c1d9f

                                SHA512

                                1bc4009db2fc4596d01bfad3a42230ca61a411a8c942a73a57c07087711a8a3731938b4bcbde49393846d4572acb158ba71e2665474ef821120e16be8169383c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
                                Filesize

                                36KB

                                MD5

                                a6e924885f70da898f9497757dfcf6c2

                                SHA1

                                5511e4273c8145f87fd86090f75690da79e37ba3

                                SHA256

                                ed63e0fabef4714b77396ad16f1933bcd9aca9a4654fda8c56a75f5feb49e481

                                SHA512

                                ef8db797d38db309f6e7650b2cda77ef5d38db271be6cab5e8b6c5aca9f643b92cc704bff7180db6a589e2d2cd18ea4376acc2ec64c80fcb9dfad959acfa03ce

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                Filesize

                                576B

                                MD5

                                9329e4c8ecfa73b7bd2995a567bd2c37

                                SHA1

                                b27a7a95437d45318c62e04050c827443606f843

                                SHA256

                                0662eec2990b7911dc36412f60b0d17e57fd312e2762ea3c9f95a19de4f32bbc

                                SHA512

                                39a8818f6d4221e0eb9e5c0315538a5531607fb1cb305ad00d6354b270c74b07b07234e4e4919c0bb32a058059ba3db1edb93456bb1202009ae9556272ed031d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
                                Filesize

                                28KB

                                MD5

                                4985a9e12c722d320b531a8f37a2cb27

                                SHA1

                                dcfbf80cb8728647a2356c9bf85263068420e3c4

                                SHA256

                                df1bc789a8e065159be95f2f490d4c6cf225aaf0777f5612a953bcbb12b0ae52

                                SHA512

                                5ec7cf5db563641cb27905133afa387333eedd6d270ea683bbc31079441bd8f45eded5d76b31b259c8ebccbddc378ef9ff4fdef7ce23c917beba2c2ba92c539b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
                                Filesize

                                24KB

                                MD5

                                54197950da917ba44eacca63d4b3fba7

                                SHA1

                                6ad66e888014a112b34d12a08e5629f738444216

                                SHA256

                                6bd7c56c888e05896baf7e122ce4d7c4f41f30469d5ad9952f00df68b68ee72f

                                SHA512

                                95e2cb0ff17eb40b96a14e9a0ae36dd2bbef0ca10de2bb8d3e87999777b5a3a042338ab88fe2a3cbf2b766441e700c023566d33cd5620e574463309d1a55c643

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
                                Filesize

                                16B

                                MD5

                                46295cac801e5d4857d09837238a6394

                                SHA1

                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                SHA256

                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                SHA512

                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                Filesize

                                160KB

                                MD5

                                05448ba73ccbf1eb0cb3807d3ce79424

                                SHA1

                                7a9ce53342e19730a157d5b0d1ed4906113c1912

                                SHA256

                                e0d8708f39b4779ade57c4f6df362699321d76cfc5497f72cc19f15de6894177

                                SHA512

                                4749751b516c5cbdad9c8c12f3424db201f9f34dc899189fe9e9310ecc9c14b3f71ea3523d2e829a073bb41e7017359aff02db7ae253f77ed587f7f5aeb307fe

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
                                Filesize

                                8KB

                                MD5

                                945943dea7dc5d71d139a71f711298d1

                                SHA1

                                fd0d9bcac710fc36ab8b9393eca3399bf57475af

                                SHA256

                                3545e5cb2ae883234d3f2d3961e22d5d3d3983e73f9ec7d610af67ab3a9fbcd1

                                SHA512

                                b53031e80a242ee48fafdd5c9406d90b06b192ce1f7047e0666074d2853ad88c2f14ca2b2d5d161e60facf1c26eece457f84e129fd3a38a2f3f1c6375ffa6fe7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                Filesize

                                5KB

                                MD5

                                6a6dc7de268bdab7a6731403907b8fd3

                                SHA1

                                bac44750c5ddce3946b4ce4e63ce3d9e8ecf5d11

                                SHA256

                                d17c00e2bd148e240b3a52877d8e62db1122525178d21ee3e78b7b6af73e10bb

                                SHA512

                                6ee7c2241f4614012b674bec52ca4211a5c7c4ae876ed2b2a53cbcc2d5241cf872256ac58dd7bdd41aea756d24bf6957007f5c19b7fb489ed14aff115657fae3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                Filesize

                                2KB

                                MD5

                                5010100ec0add069e4aad3f0bbc6529d

                                SHA1

                                15229d42c86b0fdaf1709d118b00e67952909f07

                                SHA256

                                b87bce06f73befd4965299a7435183078fa60ca702644a2b04252b34b0ed0bb1

                                SHA512

                                f4609db52347e2ce483cb60eacb79cd2cd2045364702698fabb166b6abfbe696ed8981b128e7f02560cb8cb83e98ba079e8908f9782cefc0e888c1bd1e7460f2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                8135f1e950e0c4663c4b27cd1b226944

                                SHA1

                                52314566cb04913d6334c1136f77db0d1fd3f718

                                SHA256

                                303fb788b1da8efa3a818aeecdab39917edf007ecc462e6866c0273c5df16efc

                                SHA512

                                30f35e7c320a824a7ea6f02e9b3f473829802fb8647dba1e9cc4f0ed56a9f98002120d5d343b62d3b3ac2c5c4f84ac4fa492c06ebb468b46ce7209012ea3013f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                27a8c49229edbfe7964d35ea58444879

                                SHA1

                                5efae11ef801e5a42d5834c0baf6d88dbc9562dd

                                SHA256

                                d03b4a75f638e201fd5f7d5e7a02e12c46fb09dfd845986658d66f83b3159ebb

                                SHA512

                                ce63c8bd6567b81b1177d6277a710729118d8df0f20c7dd180adf05c81ef39d1b6c3d7630a21474bd166496dfaafd1a8919d2b5d1336050b0b3696fbb6a84839

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                afb1ae25a5e929e80753af6c38413956

                                SHA1

                                c0f18c3f8a2a089e228b7b77ea2f115921912f67

                                SHA256

                                770f041ac68b63d844c7752a50d704eaafb8792d6d48ae1336d8c82811e8025c

                                SHA512

                                721af6afcb613452767a07cd3edf64a02a73d94a4764e97db8c54505e93613281832a216a1433d86c0bd8a67b4687bd2261563ea73f065037f71ac1c57476dd2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                889487275b4086832783d1e18a03a0f8

                                SHA1

                                981e19e359bea560e3869cbeaa9d6fba75d6ef63

                                SHA256

                                2a08760889808ead839642777131fdf37a807ddf54aa55b7eb5a25ec83f3a1da

                                SHA512

                                203088754f0ea2cdd4c801a86153cf3cfc8568c2abbfd1fffbc2336b5ad3c28c8ccd76bfea6292236b5e21f2d03fc1daed8ef6eabfd9c6236b572e83c0071454

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                4c759b80b9f955916e959238ea3c32a5

                                SHA1

                                ffa4af2174869be547d93572043ada461812a0eb

                                SHA256

                                d973d67ff132369fa69858d5ccba361c19c2f992e12a08c390a25b5c79f87720

                                SHA512

                                55bdf5988e0c8ce9dbae7397937f1e11da1210bec7860cb1c4a625e2ef0b90c37942ce089d2be26cfb82038ad5f9d56485a6c42b91a02d20b853a51650b823dd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                7291d784c9862878cbdaccf858e90622

                                SHA1

                                dac38c442aa7068310ceb74a18633bcc68ba6110

                                SHA256

                                90cd9d270f39c587924c75fe652125bcfb1fbdec49dc3eda68ac9fb62cf6ddab

                                SHA512

                                ea0e15b0c92f6920c318f359f9f033b6611b76c5f7286b61dbad8908abfc11ed245d89d86d7ae3916680252ea67a55bdc6884c918f62643c8e4ffa7598686abf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                d826bff17f7256362744affa28a575a0

                                SHA1

                                401135ae568b9d5a0cfeef2aa590aaa9e4e4e223

                                SHA256

                                7687c5c85cba1b68ddffb0085fc8049c967a1df2855603ce33523e9dd0f3e31a

                                SHA512

                                330d7b4ccd46f9b5686f3a0cbf74e529a447b0735a16889942c29b17efb2c7390007be9c5bcb0f99b510dac95f6c97a643f6e006eb88532d9b86f9e6cfdc9b5f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                4f9c50bce1e7eeab81c3ddd84a1275ce

                                SHA1

                                1548a2f93b88f0239caffd9c0c715ff1e98fab05

                                SHA256

                                9fe702221b63675f6323214982d65fb13cf0d11097751cad31c4d26f302a8030

                                SHA512

                                695aac7d0f4456f44277128a0586bf4a866feb67fa0f604ac7462479739b351ee63bc148af7a6b772e1ecb3e654343af12acbf1563f46261b226e2fbdf055502

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                aa810418c248f90be8c91fb4a4b099d7

                                SHA1

                                9ae0acd6836447d2415c245b1b8cfc319133c040

                                SHA256

                                3720da889aeaeda566c4c943794d651e8ee66b8308f0fb8056ef511b9ee185f6

                                SHA512

                                ae772425e3690cf65c5220c6a04b3eb90b3b0129a0afbece98d5b9195364852020c1d56e2dff65d231b6ad821f351fe2e57927c21ceeb939ab2afabccfb9bec0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                67abe7c4bdad079db3df174abb66dd16

                                SHA1

                                8645673d6a6e17010f25e2758d16821c3bff76dd

                                SHA256

                                2b02ed38ce7a8c0550cb54e6c1a72c0814199fff5c9405a1f127f11c0e625641

                                SHA512

                                4a75fbbdc8e4f4a9807dc051777462e79a6e7e8e5062cff201759fa29bd44c2f713bde70f3d68e2f19c24ef3062205fcf0cc28a184250106a0f252205689e05a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                264d0b0516176763c8db800a697fe355

                                SHA1

                                4622bc6aa91e8112ef7ff324ae1679bb21629a8a

                                SHA256

                                fcfca6004f3c7694eb7032c05a614bb7e52e1d183468daf17dfff1388452f3e6

                                SHA512

                                0a4f3f370b2598d3725e1d0a5cbb2132a068369161de11c38b0b7cf22ba766445e59b6dc0961c86ffe6260a5375ed92ed7dcecb99a3cc7713df18cd5d7c0d313

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                3ac24f2dee2bada255b47dc546cf20f1

                                SHA1

                                7a7fff07933630c16d4496761a542e6ab6b38c3c

                                SHA256

                                043807821b5e0df404bdfd915b2670b3d586489ec34e8678afa23f61e9ee4270

                                SHA512

                                492e2424dbc0d580041c911d7aa1d49160973aba828f610060cfb5626611516572e2e38d6a9a4248cc38501df59462c47aaaecc255c192cb29f21675833dd4b3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                e6b44f3a8cc89a2cd5c77d2a2c86a464

                                SHA1

                                d04b9cbfe3465d78046eb873b276ad84c3e7baaf

                                SHA256

                                ba7492d7e471713134ea1316c99ae455479ff645e8ee7f0eec876b28d6cad85a

                                SHA512

                                2bcfdc9b277d745621b898ce32bcdb215fbde6e9169a6e1aa33506f5c28c77f7bad71766e03b56de7c8081650e44b0a5aaf21f5288393f38bbbf2c848539a072

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                9KB

                                MD5

                                9f3f5e04f4e59e485dedc0988bebdfb2

                                SHA1

                                796551fbfb0f28938b93d73c903868016a28bdd9

                                SHA256

                                5236ffdb0e5a1b66ec16b1fffaa2e2c44b162336995d0becaa0895c51aa089af

                                SHA512

                                7e58aeb28ddcd58048ba56f747001547a110af0cad1a656c061376fb784431289d8e62371bc88be3146df5ac675d5c4012e43be795c3aafe509265a4dec98f6b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5b62ed.TMP
                                Filesize

                                9KB

                                MD5

                                7f7eb4b89dd886adaa1009a0d592fb05

                                SHA1

                                477f605f39b8d18847f7ab2015ebb6152a7cc195

                                SHA256

                                b106dd405f6a01ed1899006237220b422fc373d772849e2c3d6ec0e683f75fef

                                SHA512

                                c96a26d795058192863f31bf4635aa4443113eed789af54c57fdfcae88a2bc88faaf936fd4f95d57c89e7fe21f7c475a73177b74b1f0f9e378957eb01b0e4cda

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links
                                Filesize

                                128KB

                                MD5

                                36802852c46ce80fc290bbd6507d8339

                                SHA1

                                e3e268102ab646e735909e6dc34673e6beb753c7

                                SHA256

                                76d1b9e99bb532880af7cf6a83bf54ad7abbbc5a4a0f49e3b92105d75a7bcf81

                                SHA512

                                e0c075cb9665f9660f409620694d9bdec8cb80fac826f2ffcdbd4167c65bf4a277aacbe1bd012b8efe800a02f9d53edd850d85c981db966af3d80e1781704403

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
                                Filesize

                                106B

                                MD5

                                de9ef0c5bcc012a3a1131988dee272d8

                                SHA1

                                fa9ccbdc969ac9e1474fce773234b28d50951cd8

                                SHA256

                                3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590

                                SHA512

                                cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                Filesize

                                14B

                                MD5

                                ef48733031b712ca7027624fff3ab208

                                SHA1

                                da4f3812e6afc4b90d2185f4709dfbb6b47714fa

                                SHA256

                                c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

                                SHA512

                                ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                Filesize

                                122KB

                                MD5

                                eb9979a0baf572216a93e86facd2969b

                                SHA1

                                27d7a150c858f3088aa4bdef1fd01ded949d496f

                                SHA256

                                5e232aa1b72844180a2c864d5db0c93baca58c6a688e126e8ce0db3d6c6bc9fc

                                SHA512

                                0fbad5f1233bbbd32272f4ace73f355fa0eeb140fa33e57410d17180febc770fdacf65ac4f77636e3d95b91b79813e26b200a8f1d0a32267da0f114072dc1f7a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                Filesize

                                122KB

                                MD5

                                8cbfcf03816e2f744c6f02d1e090b65a

                                SHA1

                                a09ab034645aaa0cc0d6fd10f4c6cb840f979c43

                                SHA256

                                e439a361ed7423c6940e1e130f6eb4923e819653fc209c5be5ce58615f3977f2

                                SHA512

                                a26ac04d58ae529f266f2fa29f88a1526100ee8ac12d5e2647e0229aca9ca1fa46cd95bfa0b0f0612a33444b8bc4d4c9af71ea93edcda5825e642b351bd81ffe

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                Filesize

                                86B

                                MD5

                                961e3604f228b0d10541ebf921500c86

                                SHA1

                                6e00570d9f78d9cfebe67d4da5efe546543949a7

                                SHA256

                                f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                SHA512

                                535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
                                Filesize

                                48KB

                                MD5

                                5a1706ef2fb06594e5ec3a3f15fb89e2

                                SHA1

                                983042bba239018b3dced4b56491a90d38ba084a

                                SHA256

                                87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

                                SHA512

                                c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                d85ba6ff808d9e5444a4b369f5bc2730

                                SHA1

                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                SHA256

                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                SHA512

                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                944B

                                MD5

                                77d622bb1a5b250869a3238b9bc1402b

                                SHA1

                                d47f4003c2554b9dfc4c16f22460b331886b191b

                                SHA256

                                f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                SHA512

                                d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                944B

                                MD5

                                62623d22bd9e037191765d5083ce16a3

                                SHA1

                                4a07da6872672f715a4780513d95ed8ddeefd259

                                SHA256

                                95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                SHA512

                                9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
                                Filesize

                                9.4MB

                                MD5

                                f2a6133b7f38fc49f792ae799d1b4750

                                SHA1

                                6bef46ddde325f45a0e9ff123112c96bbd47c795

                                SHA256

                                37bde6655e1272e159b9c2e3a7eee3f4e9a837c0f04240645d3991d112287f8d

                                SHA512

                                f9611bed83b4bce1841868880a42dacb6b8f7e8859be1d85b3c8d3a365a0244566cbfb12294c7b2c82b15d6c0e47095d8246a95d522c3a064a0d8511b2411254

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1dzdob3v.1sr.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\taskkkkt.exe
                                Filesize

                                1.3MB

                                MD5

                                563cd219d254eb4bd0e7c3a7e703b759

                                SHA1

                                a7bc16a65f427437d5b1750027dc42f9c7bb81a9

                                SHA256

                                7c2bd82bf45b02338ca34d3d628c882ddd8787ae0ae0b8a99479b409ef9a7fcd

                                SHA512

                                3aabf639bdd7f179fe599327df18238e316fc115e99e937fa50f28122e9e95e517506c14fa382002992df05a1c5c0dda0027154eccb6e4d3c439b21d1b737418

                                Download Submit

                              • C:\Users\Admin\Downloads\bootstraper.rar.crdownload
                                Filesize

                                10.7MB

                                MD5

                                a88778f986f202d98e6155ec864ceb05

                                SHA1

                                9e08921d6c2e42bf76aab83a2e4fc098bb6c4f20

                                SHA256

                                e57e1f103ddf878147c66d6d39a4708c1f40a5e93c845ec397e03b29868b8a5c

                                SHA512

                                7edf42f7ce33d18dbb26115464b82db3c33c71f0134b3debc9b37f4e7d02d23245315a4a815ae63d07b49cc3063eebba677a7ec92d152a9504adb9dad59cdb58

                                Download Submit

                              • C:\Users\Admin\Downloads\bootstraper\bootstraper.exe
                                Filesize

                                10.7MB

                                MD5

                                1632ce7222b3859cae32f27e049b742b

                                SHA1

                                79909fc61296afef58479f4cbea5b2d904574a30

                                SHA256

                                7be26367c92662afd39747a918a13d3000afbe931f0a706f1c958ce2210af5d0

                                SHA512

                                373b284fac38cb16bd495c703ff80fcb775eaed37d89ca6728206096bd0cf3cc1a004e96879d6ee83d7453a4d85bd7e8e2dc674d5c9374e2622b9c566cabe1ea

                                Download Submit

                              • C:\Users\Admin\Downloads\bootstraper\luna\Luna.dll
                                Filesize

                                1.3MB

                                MD5

                                3a87fb61f757bc7f8aaa333663a55c78

                                SHA1

                                fb1beedbf2479e3f7584a6f281eee7b4e051233a

                                SHA256

                                5ea93e328a9d7cb9230acddc01b38dc09f3b94792f81f9db8ca3d30185a94c74

                                SHA512

                                4246a81245192968299bec9809557478201f89f717124e4d5242ae7a95e228258add92e9d369369e427ed89db4b1af4514e4289ecf693a53160022b16c627f35

                                Download Submit

                              • C:\Users\Admin\Downloads\bootstraper\luna\Luna.exe
                                Filesize

                                19.3MB

                                MD5

                                8385ed2957ba0b1293225d428c8f48b2

                                SHA1

                                cd91755a8bcf5ca7759596248bacaaaa7d4df98d

                                SHA256

                                e8b09a40118e80dd4fe5301c2532b46ba9142e9df7bd4285e9f47888d0c23644

                                SHA512

                                4fbd8edd5d1946487fdc9e1eda9036f7ecb591c8b3f4e5f910d735c7ee44d939f85e5dbc0adf01a985950a8afbc5a1abaa7d291e2ca5c468d9bfb98b401fb429

                                Download Submit

                              • memory/2292-189-0x0000000000400000-0x0000000000EC5000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/3128-243-0x000001E1389F0000-0x000001E138A12000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4404-211-0x00000000000A0000-0x00000000001AE000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/4404-212-0x00000000023C0000-0x00000000023DC000-memory.dmp

                                Filesize

                                112KB

                                Download

                              • memory/4404-213-0x000000001B440000-0x000000001B490000-memory.dmp

                                Filesize

                                320KB

                                Download

                              • memory/4404-214-0x00000000023E0000-0x00000000023EC000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/5264-476-0x000000001C560000-0x000000001C662000-memory.dmp

                                Filesize

                                1.0MB

                                Download

                              • memory/5264-309-0x000000001C560000-0x000000001C662000-memory.dmp

                                Filesize

                                1.0MB

                                Download