7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa

General
Target

7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe

Filesize

590KB

Completed

11-05-2021 15:25

Score
8/10
MD5

c239adfb4505f89d70669cec4dc1364c

SHA1

a47b03163f78c21242d0eaff14c0fc2238037659

SHA256

7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa

Malware Config
Signatures 9

Filter: none

Defense Evasion
Persistence
  • Executes dropped EXE
    wmpscfgs.exewmpscfgs.exewmpscfgs.exewmpscfgs.exe

    Reported IOCs

    pidprocess
    3728wmpscfgs.exe
    3648wmpscfgs.exe
    3788wmpscfgs.exe
    752wmpscfgs.exe
  • Adds Run key to start application
    7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"wmpscfgs.exe
  • Drops file in Program Files directory
    wmpscfgs.exe7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe

    Reported IOCs

    descriptioniocprocess
    File created\??\c:\program files (x86)\internet explorer\wmpscfgs.exewmpscfgs.exe
    File created\??\c:\program files (x86)\adobe\acrotray .exe7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    File created\??\c:\program files (x86)\adobe\acrotray.exe7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    File created\??\c:\program files (x86)\internet explorer\wmpscfgs.exe7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    File createdC:\Program Files (x86)\259312765.datwmpscfgs.exe
    File createdC:\Program Files (x86)\259312796.datwmpscfgs.exe
    File opened for modification\??\c:\program files (x86)\adobe\acrotray .exewmpscfgs.exe
    File opened for modification\??\c:\program files (x86)\adobe\acrotray.exewmpscfgs.exe
  • Modifies Internet Explorer settings
    IEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.com\ = "1158"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com\Total = "2311"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3963206805"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000e349ea20ed5b2ac81db863e33f78f715317e1e5bb871e350d5e714ab1c15a63c000000000e80000000020000200000005542761cc7c399781cc82bab1f7c9b816368e6acfce407107ec3d5665d04f23420000000d4ed64025c8c825d79eddb0fb71ca56186ce193de77567fdf3c949a7f18a831c400000009569a3122f96d78abca30d4132c0d28fdf63aadbdfe4f437e04ef8f97426c47cd774ce7761fa4b8a19d09e7d0da80c0ae4771ebbc605941d530cb0f571020adfiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.superwebbysearch.com\ = "1168"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManageriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4242653692"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000d33373dcd662a41398b2b37b79cf778032956df80c03ab0aeedf41cf4ae3f273000000000e8000000002000020000000084e677502ec0cfdc51f9f36a60324f736922412103f0f4a7693240f52369fd620000000e7bd7571e229f6b4fb43ae9eab3dd7b61d8b5edf9a69cc2d120a48f6bb8f8cb2400000005dc52b27a5b9deef5fe8b8f610413da0cb17038b26c159437abf3fdb556f06e7dedb2c1c272bded003fc7a66f1597fd09afa7fd6161d73664ba8835e2109d504iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.comIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.superwebbysearch.comIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885514"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3479"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.comIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManagerIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.com\Total = "1168"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000009d7e2578fc34990aa2f283cacb7ada58a02ac7a354e7af92a3391106c26b3f29000000000e800000000200002000000008d8d9f593015b93a4dd03a5d9d0a93b8f641fb3a44c54f4d56d03845deb62ad200000000c72bdf040c746ed0835998364153646503f5611a054228396b1b32ce371e01a40000000d153f20990e620e3f01f83c8a3fc2859bc2634ad30b58e32459b7c9ee43f42f64dc93d47ba3f3d44db58fb8d8768be37a721a505e51af732dc6c6d9a8b01760biexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManagerIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16E61AF7-B27E-11EB-B2DB-5A4A21AC7400} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com\Total = "1158"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorageIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3963206805"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885514"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1158"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30885514"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2311"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4005081936"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a185f78a46d701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ca20e28a46d701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.com\ = "2311"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4033831624"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885514"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com\NumberOfSubdomains = "1"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885514"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.com\NumberOfSubdomains = "1"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManagerIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a691ef8a46d701iexplore.exe
  • Suspicious behavior: EnumeratesProcesses
    7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exewmpscfgs.exewmpscfgs.exewmpscfgs.exe

    Reported IOCs

    pidprocess
    9007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    9007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    3728wmpscfgs.exe
    3728wmpscfgs.exe
    3728wmpscfgs.exe
    3728wmpscfgs.exe
    3648wmpscfgs.exe
    3648wmpscfgs.exe
    3648wmpscfgs.exe
    3648wmpscfgs.exe
    752wmpscfgs.exe
    752wmpscfgs.exe
    3788wmpscfgs.exe
    3788wmpscfgs.exe
  • Suspicious use of AdjustPrivilegeToken
    7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exewmpscfgs.exewmpscfgs.exewmpscfgs.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege9007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    Token: SeDebugPrivilege3728wmpscfgs.exe
    Token: SeDebugPrivilege3648wmpscfgs.exe
    Token: SeDebugPrivilege752wmpscfgs.exe
    Token: SeDebugPrivilege3788wmpscfgs.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    1260iexplore.exe
    1260iexplore.exe
    1260iexplore.exe
    1260iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    Reported IOCs

    pidprocess
    1260iexplore.exe
    1260iexplore.exe
    3864IEXPLORE.EXE
    3864IEXPLORE.EXE
    1260iexplore.exe
    1260iexplore.exe
    2248IEXPLORE.EXE
    2248IEXPLORE.EXE
    1260iexplore.exe
    1260iexplore.exe
    3112IEXPLORE.EXE
    3112IEXPLORE.EXE
    1260iexplore.exe
    1260iexplore.exe
    3864IEXPLORE.EXE
    3864IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 900 wrote to memory of 37289007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 900 wrote to memory of 37289007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 900 wrote to memory of 37289007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 900 wrote to memory of 36489007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 900 wrote to memory of 36489007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 900 wrote to memory of 36489007f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exewmpscfgs.exe
    PID 3728 wrote to memory of 37883728wmpscfgs.exewmpscfgs.exe
    PID 3728 wrote to memory of 37883728wmpscfgs.exewmpscfgs.exe
    PID 3728 wrote to memory of 37883728wmpscfgs.exewmpscfgs.exe
    PID 3728 wrote to memory of 7523728wmpscfgs.exewmpscfgs.exe
    PID 3728 wrote to memory of 7523728wmpscfgs.exewmpscfgs.exe
    PID 3728 wrote to memory of 7523728wmpscfgs.exewmpscfgs.exe
    PID 1260 wrote to memory of 38641260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 38641260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 38641260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 22481260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 22481260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 22481260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 31121260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 31121260iexplore.exeIEXPLORE.EXE
    PID 1260 wrote to memory of 31121260iexplore.exeIEXPLORE.EXE
Processes 9
  • C:\Users\Admin\AppData\Local\Temp\7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
    "C:\Users\Admin\AppData\Local\Temp\7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe"
    Adds Run key to start application
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:900
    • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
      c:\users\admin\appdata\local\temp\\wmpscfgs.exe
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3728
      • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
        c:\users\admin\appdata\local\temp\\wmpscfgs.exe
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3788
      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:752
    • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3648
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3864
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:82946 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2248
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:82949 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3112
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

                        MD5

                        c6d81022bd4fa3480c90df8496b043fa

                        SHA1

                        6c9a9d99da7718214d040f957004bb1d40d643cb

                        SHA256

                        1e8c4b7b76318d552460540edc796e9fdf636f5d7759df727fa615794f4bb738

                        SHA512

                        2a1faaf3452d802194a3e904798107b9476eca65196424aa7596b0e1498102b4a1704d2dbc104389c2d515e024d4a77427c877774cfd32854a2ac2de950474ad

                      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

                        MD5

                        c6d81022bd4fa3480c90df8496b043fa

                        SHA1

                        6c9a9d99da7718214d040f957004bb1d40d643cb

                        SHA256

                        1e8c4b7b76318d552460540edc796e9fdf636f5d7759df727fa615794f4bb738

                        SHA512

                        2a1faaf3452d802194a3e904798107b9476eca65196424aa7596b0e1498102b4a1704d2dbc104389c2d515e024d4a77427c877774cfd32854a2ac2de950474ad

                      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

                        MD5

                        c6d81022bd4fa3480c90df8496b043fa

                        SHA1

                        6c9a9d99da7718214d040f957004bb1d40d643cb

                        SHA256

                        1e8c4b7b76318d552460540edc796e9fdf636f5d7759df727fa615794f4bb738

                        SHA512

                        2a1faaf3452d802194a3e904798107b9476eca65196424aa7596b0e1498102b4a1704d2dbc104389c2d515e024d4a77427c877774cfd32854a2ac2de950474ad

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

                        MD5

                        e03f80fb59ad1cc5964772153e93ef1d

                        SHA1

                        baad49be0a07ace70621b1884d34fada905ff7b1

                        SHA256

                        a09f91b3b41e6da13cf5a4a1c33041c87d85a1af1b1e7cb5684337f8acace2d2

                        SHA512

                        b9c69f8705a12a7be72c75628d80738b426fa5ee8adfb6929bfebbf876682fd13d1e06dc2043cd9cf86488dce97399a2ead1dd975175802c45d80bf1ffdf5390

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        f7dcb24540769805e5bb30d193944dce

                        SHA1

                        e26c583c562293356794937d9e2e6155d15449ee

                        SHA256

                        6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                        SHA512

                        cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        f7dcb24540769805e5bb30d193944dce

                        SHA1

                        e26c583c562293356794937d9e2e6155d15449ee

                        SHA256

                        6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                        SHA512

                        cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        f7dcb24540769805e5bb30d193944dce

                        SHA1

                        e26c583c562293356794937d9e2e6155d15449ee

                        SHA256

                        6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                        SHA512

                        cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        f7dcb24540769805e5bb30d193944dce

                        SHA1

                        e26c583c562293356794937d9e2e6155d15449ee

                        SHA256

                        6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                        SHA512

                        cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                        MD5

                        06165dea77d5d10217992bd74f065006

                        SHA1

                        964d97611d8050aaf7d8a3a5e641cd20df6afd92

                        SHA256

                        9b125647f3ede14fa37214fe956f3b906f8bf58510bdc1eecfdf2ca4c827fe8f

                        SHA512

                        e126e1fdd45d2b08c37724b568a1ee9eef95895f2c31f5626186032293eb7f2a62f907fea96f1f0fca4c7de3cd9bac45df28bb69d42b2cd7ea5468e1aefdfee2

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

                        MD5

                        aa724496828fc82150410dad680d68a7

                        SHA1

                        e22f3fd55313514c664da27d669ad99e862ea7c4

                        SHA256

                        4418b0ab67e6f79fe54eedb50dfc4c663238d27e75e508d000db8e9579cb5944

                        SHA512

                        c416d5b92ed1013a36f38207832c8885667ca3ad50b387493bfdc90dc7dc713689e318f11db2922e6c7dc8b136f5e078e914518a724225f8a8565e2e47f33cab

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

                        MD5

                        26ce0019f647a0d4a8c1dca7241fee71

                        SHA1

                        1b8d10cc286eba73676334a563f57f4101e24dec

                        SHA256

                        ce78329b92289993e16261abdaa26fa91d493b9d0a568feba189a605825840d7

                        SHA512

                        f7fa36a5923b1909fd4f6d225680c274a488e2afa6d2ea704e0103c4657c02216b42a4b88ff0a73b72081ed3376f0a42fcf5b358659397f97eb528b50c425707

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C6FF98C595508FD7E083DED836DFAB48_B246D135A32C10345B597B5C0A8DB6D5

                        MD5

                        8e6739b18de21983e459b078ba41c628

                        SHA1

                        1671f0c159335a65a9d9bbfbb7c85bebc661688d

                        SHA256

                        f73a9f2907dd55f90e3c74b29dc8785b6badc7f81656821a0a2ecc48d2ebf5b2

                        SHA512

                        d3c47b6bee1e7fe5bea8f79700d91f48989428dfe7097ab51fcb623ff0d51fc6bf63e0112324c16398c50f04fb57747fdfa24d9ce76ae629d754b9520e451101

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_268F86C68F0AAD030772C8E464CF93C5

                        MD5

                        6c6e084f1d414bdeedae71fc5e69ab54

                        SHA1

                        3c17e223bc5712fb3e697a48bfab62e941500480

                        SHA256

                        ea717a1092eae16a242f4d7b9cb1d65014f12065807c8dcd5af21757e3eb7177

                        SHA512

                        bc33b774d8c80e6af87787f87b53a59641aab139909f039269d366f5c34841fdee77f7348898691a1f1db5bf4ac21824d26bb048c03ac2de36e27c6121dbd2c8

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_5F0F16F363E79E7BD83FDF03966FD918

                        MD5

                        7bc2899c78fd30af831c14c619df6725

                        SHA1

                        32686c84fcc77e97e20bbd8146092b40082ccd1f

                        SHA256

                        3bba001fc3d82998560c99375373a4c55e0f9b71b3c2e292b723defb2c0bd25c

                        SHA512

                        087bd5a6ddd2b048769aa908630c17c93fad6b728a7b3b8d28648df2fdfc7ac610f15a4909e25865cefef7c3d462b28fc4ea3f72b22fe60b5576b668faf442e5

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B

                        MD5

                        4f914d6a12b48374677859978d3def97

                        SHA1

                        d29a1ff9bc1fbf5c4c0cf3210c9aefe33fc8e5a5

                        SHA256

                        eb9ac8c88c0857b9588076073491eec79f4725aa32bc7af00c20ef31095d1d68

                        SHA512

                        ab9cc44820d05b5207d1210e189041f3df258346619f05ae1b058de8b358438095a09b0fed26fcf09d7d08caae353f680936ebe24fdc94c18411463d5ecfbe61

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

                        MD5

                        a4503a0aeb703f8b1d10d14a243f571d

                        SHA1

                        7485dfd49ae0a672ade7a934a3305d38ff030400

                        SHA256

                        5c08368b2fab795c81e0446d2f0fb5cc5b2f1570daedb58011640d2785974471

                        SHA512

                        329d14e24ca035aeb92b5033c4cc280abb1868d3d93bb533bf9d8f9b8267e06c1ad7a38fa6616a624c9277d1c01a7a2cd9ea414f1e42b1718c9e33666cec472d

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        49413e76416729c0bf1d29b6b1c383c2

                        SHA1

                        44a2fe34d01948767d22af3909b448ad3caa3240

                        SHA256

                        4f75303bb57bb136a79e25d53d3a0a8b713a6083464abc9d02f9170c7f81af93

                        SHA512

                        58c93d75390f6869d7a0b9d34075032368c1ab2ead8430fc9f7336d0c845468923ced12cccf2b96d628a8167288079b04964527756e60bde39b073d008ef6dca

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        5e1cfaa77f2fef535d0741e79499468a

                        SHA1

                        d8705398bb6d8887e9216d3e146cc2caf61b9656

                        SHA256

                        cfac9a8c5d293fed6c76f534e2877492ea3f66799bebac00b154489472ca3221

                        SHA512

                        1e007232cab92c203d20da74685314fb0eb694ad25fee0d78f1bad2b8a0066c567c097056d56d997195a8f650bb33ee06fb2b531b5c12896c28b3344db674119

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        5e1cfaa77f2fef535d0741e79499468a

                        SHA1

                        d8705398bb6d8887e9216d3e146cc2caf61b9656

                        SHA256

                        cfac9a8c5d293fed6c76f534e2877492ea3f66799bebac00b154489472ca3221

                        SHA512

                        1e007232cab92c203d20da74685314fb0eb694ad25fee0d78f1bad2b8a0066c567c097056d56d997195a8f650bb33ee06fb2b531b5c12896c28b3344db674119

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        MD5

                        f8616955f943a4fe6aee189618505716

                        SHA1

                        bb1e319a145008457e5463742f9b4aff447808fa

                        SHA256

                        c1cf2711aca536ef21b4fcc079f9f72dadfab804a9bf2a27a84d2c2832302b6b

                        SHA512

                        fe5781a4850c8f3f1ed4f3ac0b5a24a30a7b7c65ecaf7b2dbced67c7de7f3e83a7d6e5731a4282acb27b2c0b9e23b4f790ba9e15ed69a794a2f496204bdc539f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                        MD5

                        347f28519eb166c0fbbe334a64703f45

                        SHA1

                        65a7a755a8593d52c2c08f8e9c70d9c5bf0284fb

                        SHA256

                        a1b4a56fbdb1bde2b8803670c38685a6a76391270140fc000e9c1a6248f2dff6

                        SHA512

                        c6d0d6ab531efa7e6e228475d135bf127f4f08ac33d9850487d2d9ce546c8f9f778f96cc9d628f767021674d60a9ca38335bccc14a24b0eb506a0b611a28f220

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

                        MD5

                        ba1c1db92ed25dc29786bcf49da61cf5

                        SHA1

                        35ee481f7b06f3439cedd2a36e69aab17780ded4

                        SHA256

                        40dca5804ae7fb11676114e53a176dfaafeec707cf8659a5073bb40b858b64e4

                        SHA512

                        b4d542b0e125a025eff287e941efc0ae822b48392579b20bf1726092fdb921f6e152a16e043391b7ccb47818cd4a70fe6d2d5c5cb77bcd3c23804430abba3e3c

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

                        MD5

                        966b2be8df8d6da913b0cfb61048c697

                        SHA1

                        54cfbb0c69f7a3c87fe942f33de93b75e13750df

                        SHA256

                        be670dc6d09d1da0a8d67bfe7570b9e1dcbaedbbffcbe891bd691983a114219d

                        SHA512

                        ea738a47d822e4ad7ebd14742dcdb518d1179c6acb1ca6b1b293d3bb941ce1396ccdfd27d20320c3714a9beb0e11bdc62992de7e28a4a648e2ba73e02a932b8f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

                        MD5

                        966b2be8df8d6da913b0cfb61048c697

                        SHA1

                        54cfbb0c69f7a3c87fe942f33de93b75e13750df

                        SHA256

                        be670dc6d09d1da0a8d67bfe7570b9e1dcbaedbbffcbe891bd691983a114219d

                        SHA512

                        ea738a47d822e4ad7ebd14742dcdb518d1179c6acb1ca6b1b293d3bb941ce1396ccdfd27d20320c3714a9beb0e11bdc62992de7e28a4a648e2ba73e02a932b8f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

                        MD5

                        e772383da6156b2cd0e7c1a3ddd14cc5

                        SHA1

                        22f2378403e03ef3b6f3e6b55b5d7fd4d975c238

                        SHA256

                        0ffa505457a2a4fa462c59727947b58668c91c4a5961ca2492dee525ddfb835b

                        SHA512

                        df5eb42bcd493e829040af5ff0445365133f9eceeb5134174a76b69dc56c13a383667dada67cc11c1e172853baa2eb1532d9f2d114104aa2be3f852b2d45d2b1

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C6FF98C595508FD7E083DED836DFAB48_B246D135A32C10345B597B5C0A8DB6D5

                        MD5

                        fe3dd6e5616ef52bdc49b417351ed290

                        SHA1

                        968122e86037db74c4686302ed1b328d3abd3228

                        SHA256

                        14867bed7f15789f4cd65e06bddd6a6a37c16226e4d0fd89d2550722134c3ad0

                        SHA512

                        f54be33a47fea8396105d4adb6e8ccf352383add772f8cb4c906ffb7ca1e19d167a44a7aba3b261ae1002373d7159165bba0c38c0ed32beee1e44a01eaea0de1

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C6FF98C595508FD7E083DED836DFAB48_B246D135A32C10345B597B5C0A8DB6D5

                        MD5

                        fe3dd6e5616ef52bdc49b417351ed290

                        SHA1

                        968122e86037db74c4686302ed1b328d3abd3228

                        SHA256

                        14867bed7f15789f4cd65e06bddd6a6a37c16226e4d0fd89d2550722134c3ad0

                        SHA512

                        f54be33a47fea8396105d4adb6e8ccf352383add772f8cb4c906ffb7ca1e19d167a44a7aba3b261ae1002373d7159165bba0c38c0ed32beee1e44a01eaea0de1

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_268F86C68F0AAD030772C8E464CF93C5

                        MD5

                        558b08d99ee2e24e8facf790fdbb8b08

                        SHA1

                        53958bb5c307790339825aab340379f132ee0a5b

                        SHA256

                        43f1f7390298bffa9a2521623a5ab08cfd0e0a9e6a0ab64b761650ff34a3498f

                        SHA512

                        9127c035f0fb28220ac63697dcb550c99982d8b9d0906e3897bfa455692d0610ff777a99f054a152192b8f286ded13786233c0e3f59881ff24d92242aba52390

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_268F86C68F0AAD030772C8E464CF93C5

                        MD5

                        ce52621d8db7b6e77676f1767095dbdf

                        SHA1

                        f2f08851ccd633a2521367fcf15db9f81f837cb1

                        SHA256

                        8b98efe7fdcbb7f16191795a23e46c73cde93a2ef191a69b9fedbc41514f6437

                        SHA512

                        097a7c08c139a57c89569eb5b9bf6f8986cbdc786521c9b8b8e77322c195ca4b7c355df81784c914f167bbce1c31dec9d7df37d7d073e5b451a3a4f21e6bf521

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_5F0F16F363E79E7BD83FDF03966FD918

                        MD5

                        c021a28a88e61dc8b544ca8820caee8b

                        SHA1

                        644668bee730704ea0391a1d73ac4eec8164b951

                        SHA256

                        731c5951b2f074be2a1408b0f0cd4d2656d3e8d7578508b037c4e12ac1c86166

                        SHA512

                        745b02432a61d19bff001816863414105ef3b9cc90d0700a9a3d231b4a3d98e2c7cae0d07c71e3c6d02b188528a794e6dc0afae7cb538a266e924eb612ba0243

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B

                        MD5

                        42ec23cc109a1622bcfa9356440660d6

                        SHA1

                        3eadab507de5e5b808446997615d81d9df85a9dc

                        SHA256

                        9d5c6461655317afddfa18e7f85bfe19424b7140923a925e68468e4d1ba83c2d

                        SHA512

                        6f62ec4036438fd2ecad127568397807643e08b1225b600a156cc9e63307581c9ec764710b7aa8e4a8a6fbd9b3d23fc0979a16437df4e4058ce5b2f3ca342d3b

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FJUVESFQ\www.supernetforme[1].xml

                        MD5

                        c1ddea3ef6bbef3e7060a1a9ad89e4c5

                        SHA1

                        35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

                        SHA256

                        b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

                        SHA512

                        6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FJUVESFQ\www.supernetforme[1].xml

                        MD5

                        c96a7701dc53ba7cd89ddcc8e621a4cb

                        SHA1

                        c4820e2baa612c68727dd509540e530fb44dd02c

                        SHA256

                        b8a5a50b5c348a3d818d983ac438b93447cf4eb420d79976eed737697d96573c

                        SHA512

                        cdb29da2777a7f13fa9943efc829971c313c5025d05b26de15f9c73a754832332fb396887fb3172a88c2d54fadffe7feb3a6720f1ab859980d681cf5f4b5888b

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\74AX7LAV\caf[2].js

                        MD5

                        71e1ed365cf8116780c753e955d41f84

                        SHA1

                        8b1ad54ebeeab8860f341f432ea8860e1f7d89d3

                        SHA256

                        898003a85d3766bbcc37021fadba8bdfe1ed3b93e6c8ceb5ac9908104adcae14

                        SHA512

                        8b7301348181ed15abe7178eeb44d122cd03ffe9a1da6bd8db61b86fc937439c43e5b4fd8fd11e1cbafa813d875bfd8a8953f44ee829510834bfb424f462a6be

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\74AX7LAV\main.71640174.chunk[2].js

                        MD5

                        7c7bf187a633beecfb9ac2ed792e915e

                        SHA1

                        1894219dce76dad5649f29dc424089d5974599ba

                        SHA256

                        6c5c7341e0d38a5c67af76bf3e5ba24903053383944d3b918ca3f973572375dc

                        SHA512

                        fdaa1dc98be5cfabcd6a47446a31f2aa1abefbd0511efdb9df6922f67432359fc73ff8f2e1285aab73d6814ab13198d5aeea8db75e17d7a12bd81addd104b8db

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NPXJ0CH4\u3ToyJsKfSs3PO_CRuQAhJwWl8IhuUBmheZ8ydfVXFc[2].js

                        MD5

                        7d5181b2b63cadafb08337aeaa719bd8

                        SHA1

                        7e047f6072ba5f5b5fa5125dc4f2f3967a27bafa

                        SHA256

                        bb74e8c89b0a7d2b373cefc246e400849c1697c221b9406685e67cc9d7d55c57

                        SHA512

                        f5f8f78e36dce8f78fdec106f68ecabab55909bc7705dd7639d25cf94dcbf5f5627bcd370fc3436e257417e449a8fadbde814f9b51080068bb18ffd6fe2d1521

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\chevron[2].svg

                        MD5

                        114d2c009dc75b40dddad432d1500de0

                        SHA1

                        c48cb9d834cdf13208fe6d2dc8a47b17bf0ee851

                        SHA256

                        a0f2728b3c46b9817c807714ed006928bf5dc446c3f848d8d7d9c7d9fe81fd1f

                        SHA512

                        0dc32f0051e33bcdc3199b5fc1c07456362ce5ec3b7498e39b61f021a25b562e1d25a398eb49998e4b54a750df52d175a718a494eff60dc4c83580bec7a35a5a

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\53C8T3DN.cookie

                        MD5

                        9c7b0b2f315be9de91784d5749ecd50c

                        SHA1

                        8741c9c58bfec81b8b71d55a23d032b7800b2856

                        SHA256

                        2ac574c182db2e61109685c0925d09977b4f67d25585148be8864e50e758be7a

                        SHA512

                        ec614461887b1b78c3f910e2f20e201895f22c07cac00333e5fe9db6b93755f692bd7c49ae88f4ebf2ee52c934ed23fc830e0e92d9aae8cf6bd0b3daff42cc6c

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5DAI5PNZ.cookie

                        MD5

                        459f079bbf078850ea858d03379a755a

                        SHA1

                        979db5e5be7d8055a94741379d87e5be2f0d1eb6

                        SHA256

                        78bb7266cb698bb9419bf1259665443b3c21c78fcd8ce053566e2951092c1042

                        SHA512

                        347f34e4fd99d07f9fbe3ac2e72a52a004ef92864229f905e812d9901e5663abc532765742c3dcdb54b1a9ba5ab9c5fb7e23a3348e919eb7494d9a44ca1bfc54

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JG2YHWWX.cookie

                        MD5

                        c8596c5046f0536d4bd671c65873cc10

                        SHA1

                        589bea9b60c317f3961eb5ea2b8c0531694593d4

                        SHA256

                        559ec411c535e87f123e0c6105df50ea8f7071a36bbcbd6877bc58548ff8bace

                        SHA512

                        5bfa51ee498fc38659171445a466330a7288084815cbeee317aa349a0157cdd99a6c4026323e9af021586a1e62c940c3fac600cb24538570bf339847971b5b43

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MK3GEUMU.cookie

                        MD5

                        eaed14072988c148b4962d342b11c717

                        SHA1

                        e2f43cd39935c5a73d5c5fc87b90d8b8dc3e6400

                        SHA256

                        39117c2b66967bbe595c071ecf5cb01e98c5c4baa5cb7f31f57bbe2675ed05ce

                        SHA512

                        2dcbc237d938c89a05c86e27017a4e893e24e3fe72546cb11807013334f3d1b7286944eb90174476883f161430260470eb21714c2ac91607dbf4aac7ee95f37e

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Z19DX8O4.cookie

                        MD5

                        2b666f5bf0c0a2d8e84792403492eabe

                        SHA1

                        5008c44b686ae6b919922821225dee77f31cf00a

                        SHA256

                        404abaa97b88015cc7c2455b45bf5a4ac589b5234ae95119e27b1c6fa1d8e35d

                        SHA512

                        988d6a494643d155562cb61745f953c8e5be3591a3a2cc813cd794efe27df8de88da6ff9435f22d37c7230ffbe1676dc8ccc68dbf973dd0a97cc3e4aa1758613

                      • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

                        MD5

                        c296d961a92fe4e12d9f4630d4b5e730

                        SHA1

                        ad9002e590f2506e935dc397c194f9266f6e5d24

                        SHA256

                        2faeea830ba20563a70984d7e34039f5d8bbb9cdca284711584f36c29f94cfd4

                        SHA512

                        e7be36e366e1213f166315a78853d77d2e48a9337178184759a85d485f2fd27d95a56b218221738a4f7ce0abb580a76a8cf7d30e240efa7089755682623a5276

                      • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

                        MD5

                        c296d961a92fe4e12d9f4630d4b5e730

                        SHA1

                        ad9002e590f2506e935dc397c194f9266f6e5d24

                        SHA256

                        2faeea830ba20563a70984d7e34039f5d8bbb9cdca284711584f36c29f94cfd4

                        SHA512

                        e7be36e366e1213f166315a78853d77d2e48a9337178184759a85d485f2fd27d95a56b218221738a4f7ce0abb580a76a8cf7d30e240efa7089755682623a5276

                      • \??\c:\program files (x86)\adobe\acrotray .exe

                        MD5

                        9ae9bc7f986e8dc8e828d93a2f841008

                        SHA1

                        a0a5de41aa8ccb2c24961a53bc874900cb40d497

                        SHA256

                        cb4c84eba62e12dd08b512c21bb46608d97206689fa4b33a2df46bf0c58be369

                        SHA512

                        9183702abd3788f06c488c3547343c0855ac1e43301190afc21aacf8d3566125b2faa4aff688a7b9e0a816e78733d2b6430e783cd706955f9da1a6cc8a229035

                      • \??\c:\program files (x86)\adobe\acrotray.exe

                        MD5

                        2a476956cd6c697ad34c686d4c3df449

                        SHA1

                        904ce19b5dd732149d8973a78c3b06a696215370

                        SHA256

                        30a38dd77faf35d3eeeec6da8422141e0690e86c7c797a474d0fac3af44d1460

                        SHA512

                        823e155ac6277f65b547caba0b0c0a03a50d46841fbfebc0508d142013e759f6773ff4ac2b8d5c7f641d9f83e870efb200644237e56a83f78dec43a5b6f9df27

                      • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe

                        MD5

                        c296d961a92fe4e12d9f4630d4b5e730

                        SHA1

                        ad9002e590f2506e935dc397c194f9266f6e5d24

                        SHA256

                        2faeea830ba20563a70984d7e34039f5d8bbb9cdca284711584f36c29f94cfd4

                        SHA512

                        e7be36e366e1213f166315a78853d77d2e48a9337178184759a85d485f2fd27d95a56b218221738a4f7ce0abb580a76a8cf7d30e240efa7089755682623a5276

                      • memory/752-130-0x0000000000000000-mapping.dmp

                      • memory/900-114-0x0000000010000000-0x0000000010010000-memory.dmp

                      • memory/1260-132-0x00007FFA8C4B0000-0x00007FFA8C51B000-memory.dmp

                      • memory/2248-138-0x0000000000000000-mapping.dmp

                      • memory/3112-171-0x0000000000000000-mapping.dmp

                      • memory/3648-119-0x0000000000000000-mapping.dmp

                      • memory/3728-116-0x0000000000000000-mapping.dmp

                      • memory/3788-128-0x0000000000000000-mapping.dmp

                      • memory/3864-137-0x0000000000000000-mapping.dmp