neshta | 4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-06-2022 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Size

6.8MB
MD5

270765468d8169fa2eb0d59c01683c67
SHA1

e662801c56c133116ca043dcd17e19b0e8fec9a9
SHA256

4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4
SHA512

57c1cbe1b1ba7519aef7e47feea0e2c2c923ef329817b7e666e5848a78d7df51780ae6cbe389b1fbcec389bc6ee34c910edb7fadffc0d728715c7b1d38924c16

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta Payload 58 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	family_neshta
C:\Windows\svchost.com	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe	family_neshta
C:\Windows\svchost.com	family_neshta
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE	family_neshta
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE	family_neshta
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE	family_neshta
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	family_neshta
\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	family_neshta
\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\misc.exe	family_neshta
C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	family_neshta
\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	family_neshta
C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	family_neshta
\PROGRA~2\MICROS~1\Office14\OIS.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 6 IoCs

Processes:

._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exeSynaptics.exe._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exesvchost.com_CACHE~2.EXE

pid	process
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1708	Synaptics.exe
268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1164	svchost.com
1292	_CACHE~2.EXE

Loads dropped DLL 21 IoCs

Processes:

4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exesvchost.com._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

pid	process
1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1164	svchost.com
1164	svchost.com
268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

Drops file in Program Files directory 64 IoCs

Processes:

._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

Drops file in Windows directory 4 IoCs

Processes:

._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exesvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\Windows\svchost.com	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1556 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

1556 EXCEL.EXE

pid	process
1556	EXCEL.EXE

pid	process
1556	EXCEL.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exesvchost.com

description	pid	process	target process
PID 1452 wrote to memory of 1248	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1452 wrote to memory of 1248	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1452 wrote to memory of 1248	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1452 wrote to memory of 1248	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1248 wrote to memory of 640	1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1248 wrote to memory of 640	1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1248 wrote to memory of 640	1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1248 wrote to memory of 640	1248	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 1452 wrote to memory of 1708	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	Synaptics.exe
PID 1452 wrote to memory of 1708	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	Synaptics.exe
PID 1452 wrote to memory of 1708	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	Synaptics.exe
PID 1452 wrote to memory of 1708	1452	4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	Synaptics.exe
PID 640 wrote to memory of 268	640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 640 wrote to memory of 268	640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 640 wrote to memory of 268	640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 640 wrote to memory of 268	640	._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
PID 268 wrote to memory of 1164	268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	svchost.com
PID 268 wrote to memory of 1164	268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	svchost.com
PID 268 wrote to memory of 1164	268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	svchost.com
PID 268 wrote to memory of 1164	268	._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe	svchost.com
PID 1164 wrote to memory of 1292	1164	svchost.com	_CACHE~2.EXE
PID 1164 wrote to memory of 1292	1164	svchost.com	_CACHE~2.EXE
PID 1164 wrote to memory of 1292	1164	svchost.com	_CACHE~2.EXE
PID 1164 wrote to memory of 1292	1164	svchost.com	_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
"C:\Users\Admin\AppData\Local\Temp\4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe"
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
6⤵
- Executes dropped EXE
PID:1292

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
Filesize
285KB

MD5
831270ac3db358cdbef5535b0b3a44e6

SHA1
c0423685c09bbe465f6bb7f8672c936e768f05a3

SHA256
a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0

SHA512
f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
Filesize
313KB

MD5
8c4f4eb73490ca2445d8577cf4bb3c81

SHA1
0f7d1914b7aeabdb1f1e4caedd344878f48be075

SHA256
85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

SHA512
65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
Filesize
569KB

MD5
eef2f834c8d65585af63916d23b07c36

SHA1
8cb85449d2cdb21bd6def735e1833c8408b8a9c6

SHA256
3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

SHA512
2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
Filesize
381KB

MD5
3ec4922dbca2d07815cf28144193ded9

SHA1
75cda36469743fbc292da2684e76a26473f04a6d

SHA256
0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

SHA512
956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

Download Submit
C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE
Filesize
100KB

MD5
6a091285d13370abb4536604b5f2a043

SHA1
8bb4aad8cadbd3894c889de85e7d186369cf6ff1

SHA256
909205de592f50532f01b4ac7b573b891f7e6e596b44ff94187b1ba4bcc296bb

SHA512
9696e4f60a5b1166535ca8ca3fb495d718086463d1a12fa1facc08219ad5b918208ddd2a102f7955e29153b081e05985c4ae6e4302ab36d548bb62991a47db18

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
Filesize
130KB

MD5
7ce8bcabb035b3de517229dbe7c5e67d

SHA1
8e43cd79a7539d240e7645f64fd7f6e9e0f90ab9

SHA256
81a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c

SHA512
be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE
Filesize
2.4MB

MD5
a741183f8c4d83467c51abab1ff68d7b

SHA1
ddb4a6f3782c0f03f282c2bed765d7b065aadcc6

SHA256
78be3aeb507db7e4ee7468c6b9384ee0459deebd503e06bd4988c52247ecea24

SHA512
c15dbecc0754a662892ecaff4b9b6c1bad46f710d8e1b973f86eaee467444f8e5764b31ace8f5a9a5e936947cc4dcb97cb1b14a6930c1025f38a3544393b6b18

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE
Filesize
571KB

MD5
d4fdbb8de6a219f981ffda11aa2b2cc4

SHA1
cca2cffd4cf39277cc56ebd050f313de15aabbf6

SHA256
ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b

SHA512
7167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE
Filesize
503KB

MD5
3f67da7e800cd5b4af2283a9d74d2808

SHA1
f9288d052b20a9f4527e5a0f87f4249f5e4440f7

SHA256
31c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711

SHA512
6a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Filesize
125KB

MD5
46e43f94482a27df61e1df44d764826b

SHA1
8b4eab017e85f8103c60932c5efe8dff12dc5429

SHA256
dc6658dec5bf89f65f2d4b9bdb27634bac0bf5354c792bc8970a2b39f535facd

SHA512
ce5bdd3f9a2394ffda83c93fc5604d972f90bd72e6aded357bdf27a2b21a0469f6ac71ce40d9fb4ed8c845468c4171a3c5b4501edbae79447c4f4e08342d4560

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
Filesize
138KB

MD5
950000c930454e0c30644f13ed60e9c3

SHA1
5f6b06e8a02e1390e7499722b277135b4950723d

SHA256
09786f64db91266470b56046098d9825253ba5d6a5361c2f4e6dbc8ec28c9bb2

SHA512
22e3c677c83c755e53a7bf8735734541223f57151d588c3380bc758e5433b706441666d0d95c42bd23a720b093a6942a62346dab24ee3f0a18bee3e5ad1cd9d9

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
Filesize
138KB

MD5
fafb18b930b2b05ac8c5ddb988e9062f

SHA1
825ea5069601fb875f8d050aa01300eac03d3826

SHA256
c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265

SHA512
be034e7377bd27092aad02e13a152fb80ff74c1ba2fb63ccb344cd55315d115ee47e46727cbe55ca808efafa58d7924e3eed965e9a2fd3b9ae2dff7834383e54

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE
Filesize
251KB

MD5
33cb4562e84c8bbbc8184b961e2e49ee

SHA1
d6549a52911eaeebcceb5bc39d71272d3b8f5111

SHA256
1f455ea6bab09377e5fdfbd5df102f79c5cbbb5fe5ce456f2fbb34f94ec848bb

SHA512
0b638a6e86816ba5d83de5fc381c85371f2f4fe0a2fdff40141859a42e255a082903e5692a49ef253265a42ec99924e5a0aa150cb7ed6cd5521f42f6c9fe27a9

Download Submit
C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE
Filesize
85KB

MD5
685db5d235444f435b5b47a5551e0204

SHA1
99689188f71829cc9c4542761a62ee4946c031ff

SHA256
fde30bfdd34c7187d02eabe49f2386b4661321534b50032a838b179a21737411

SHA512
a06d711574fbe32f07d20e1d82b7664addd664bf4a7ee07a8f98889172afe3653f324b5915968950b18e76bbfc5217a29704057fd0676611629aa9eb888af54a

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE
Filesize
726KB

MD5
c3ee902099b98a299b1a215aba1b27bb

SHA1
602b023806464db25f5f8e4ffc157cc7d7e9886b

SHA256
e657a9f85af7cb5ded734e162db514e466256a83d51f4454abbf19c54b30686f

SHA512
3538548c99f266404395ce9bdcadb542171799865ac5feddce936305ff2b09ecb939bed60d1e7011a39ca8548af39f9b4ee723b15674a1df54404270fc5afc9f

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE
Filesize
144KB

MD5
a2dddf04b395f8a08f12001318cc72a4

SHA1
1bd72e6e9230d94f07297c6fcde3d7f752563198

SHA256
b35e60f1551870c1281d673380fe3101cd91b1f0b4d3c14c2383060f5e120373

SHA512
2159df98d90467720b738be68bee5aba38980d2449c18d2ea4b7b9bae7d222b4a85845d0f9597017d0ee417964190bc3d95cb4809e33aac16b6cfa6ec200dce3

Download Submit
C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE
Filesize
127KB

MD5
154b891ad580307b09612e413a0e65ac

SHA1
fc900c7853261253b6e9f86335ea8d8ad10c1c60

SHA256
8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483

SHA512
39bf032033b445fc5f450abec298ea3f71cadecfeafc624f2eb1f9a1d343a272181a874b46b58bb18168f2f14d498c3b917c3392d4c724fe4e5ae749113c2ad6

Download Submit
C:\PROGRA~2\MICROS~1\Office14\OIS.EXE
Filesize
308KB

MD5
4545e2b5fa4062259d5ddd56ecbbd386

SHA1
c021dc8488a73bd364cb98758559fe7ba1337263

SHA256
318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8

SHA512
cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1

Download Submit
C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE
Filesize
1.6MB

MD5
08ee3d1a6a5ed48057783b0771abbbea

SHA1
ebf911c5899f611b490e2792695924df1c69117d

SHA256
3f6decd82b72a5ba1ee224b52d9fbd6486be22a0b855e28eaad47ae92df266f0

SHA512
1711d023c60d4b047d553a654797bc3a2eecd951b310698c1a2c549e136c33f55e0fc1167a4a38f793b7796f7cfc3fb30017935127b147a21da2812eb38faac5

Download Submit
C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE
Filesize
262KB

MD5
2d1b4a44f1f9046d9d28e7e70253b31d

SHA1
6ab152d17c2e8a169956f3a61ea13460d495d55e

SHA256
d1d73220342ff51a1514d2354654c6fcaedc9a963cb3e0a7e5b0858cfc5c5c7d

SHA512
dd8f5e343417a3e131b3362f1aecaf9ce0f8a55c9f90aa3b7e55b6ddb6c5f4e06b3e76a7f4481fa13e2f325ab2490553f6977178acf7c486c7315755c05fc7c3

Download Submit
C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE
Filesize
2.1MB

MD5
6b63036a88f260b7a08da9814cf17ce0

SHA1
cac1bd549343a1c3fcefacc2d588155a00c4467b

SHA256
8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d

SHA512
383b8676a85e0f2447536bd15019c23bed15a51d633dafe5ac7bcbea75d8064ef9fd938461eab25df7f3eae3de18b87640e8cc12e95f7b58de1209937d8da284

Download Submit
C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE
Filesize
3.7MB

MD5
525f8201ec895d5d6bb2a7d344efa683

SHA1
a87dae5b06e86025abc91245809bcb81eb9aacf9

SHA256
39a089d363b15c37cca9f747a17e89ad1dbe0bc86ff23466526beaa5e36d6d4b

SHA512
f0a2070f11eb3f0bdf996ada42becc7710aab76e84268e5cdbbd9ecbf13ef5fb85b52b6227711137a9c511f8d731b018530cbf1935f8fcfd61ff2ef6c1348d63

Download Submit
C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE
Filesize
549KB

MD5
61631e66dbe2694a93e5dc936dd273be

SHA1
b1838b8ca92fa5ca89e1108ceb2630a6ecd2b8c2

SHA256
5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f

SHA512
323463c267ccdb701d5967198f4f72158056f5a6e889c47bf19d1a670233ab071a5fe8c108430beb67753b77af1c59028007101a8e1266618fe91fa0127b4dcf

Download Submit
C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE
Filesize
606KB

MD5
9b1c9f74ac985eab6f8e5b27441a757b

SHA1
9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5

SHA256
2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24

SHA512
d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4

Download Submit
C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE
Filesize
1.4MB

MD5
5ae9c0c497949584ffa06f028a6605ab

SHA1
eb24dbd3c8952ee20411691326d650f98d24e992

SHA256
07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e

SHA512
2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788

Download Submit
C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE
Filesize
1.8MB

MD5
fc87e701e7aab07cd97897512ab33660

SHA1
65dcd8e5715f2e4973fb6b271ffcb4af9cefae53

SHA256
bb1814297615d6b22fa20ee4f8613c8bc9fa67d93cb7fe032f46f377569e2f46

SHA512
b03e3b3f7b0f11b85757d8bf5678542f4281407e95cf8e074da4ddc421c217fcfaf23cc927ccd0bbca2891a424b2d3565072aba6406dc46c2fa1fdba7a249eec

Download Submit
C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE
Filesize
1.5MB

MD5
93766da984541820057ae0ab3d578928

SHA1
ea19a657c6b1b5eb5accc09c45dcf04f063151c3

SHA256
ad3a9f7beaaea0bc49a7ccba83198cfb2882d462441203684076695b0ef6c514

SHA512
e14c86e13ab79fa9b9eb1a05d69764d522c4acfab7742c200080b215bb3bc31ec7f3dd2abf44cbc996d2e58a0ca1990b18ab055b232b243fe61b5fb018a9b719

Download Submit
C:\PROGRA~2\MICROS~1\Office14\misc.exe
Filesize
598KB

MD5
02e02577a83a1856dc838f9e2f24e8d2

SHA1
2ab44e2072a3598fc7092b2ccb9aff3a2c5d4ced

SHA256
3b6ca9d9fcbb0c1677fe4caeef03e4db326f70166f030b5f9fa9f2856031d4fc

SHA512
a95d454a4f9e5271bc52e6c245c7840a92b8331b84260b2556432ac66dd07bec1b2c3dcf41282d6d8ae581a152f3147e75dc673ce0c7ecbb653dcc61bc1d1bd8

Download Submit
C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
Filesize
279KB

MD5
f2056a3543ba9b6b6dde4346614b7f82

SHA1
139129616c3a9025a5cb16f9ad69018246bd9e2d

SHA256
2bab7d64d5327ca21ffd13df88b30431d0b8c0dd6cad8f4bb4db33eeb2b37d1e

SHA512
e11d1c65e046a0a6817cec4d17df1b7f5849fdb5b95527fdef78f0c433294fd2186037116a581ec3a66b07f1ab75cd8e60e408005cd64bc5eacc61a582da0942

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
753KB

MD5
170bbaa416953a140a898d56e23bd161

SHA1
422afc229914075c9637854bdae58db86f6996a5

SHA256
24fc8dd07d4431f72366f8cccce9644e6b5e890d6679654b22ad4f549e55ff0f

SHA512
5d25966c9fa2dfda3f5bff16c066313dd28e6a9b64ca68ee2a1440ef8325f2fd137bee046a76e449e88571f66e7169774871001db2b7860eddbb230d6be34ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
5.2MB

MD5
cb637196328e1e139e38fceb254874fb

SHA1
e1b77f2bb1c120f7fd550dfae4d0eabb4a11204c

SHA256
120d77264c9ce495637333f52c9ef1ca8e0d4ac81e1eb4e723c2bba4b80897a1

SHA512
213a835eaa83283b9c1b0eccd6fb8d6d7669d3d70afaceaf3d12293a72beb77f59ec9730d30b1328b8343510ee216c54c480a2729bf6675ad85fc2368a725f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
5.2MB

MD5
cb637196328e1e139e38fceb254874fb

SHA1
e1b77f2bb1c120f7fd550dfae4d0eabb4a11204c

SHA256
120d77264c9ce495637333f52c9ef1ca8e0d4ac81e1eb4e723c2bba4b80897a1

SHA512
213a835eaa83283b9c1b0eccd6fb8d6d7669d3d70afaceaf3d12293a72beb77f59ec9730d30b1328b8343510ee216c54c480a2729bf6675ad85fc2368a725f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
7a3fa9fb8b4e25909336f13577bc8620

SHA1
9d0f32e38711b83d27a712fc5f7216d2654c1835

SHA256
d4b3e88dc2e9ea49e633c2305742c099827f7422c0fdefb4e15af6794e2b3c76

SHA512
cef9aa7f6fcbc5aa0525cc303996f8c933392dcf60691f98f8cf78c065076610e7636f2af3dff00d15f49e0e04e69a2a61a00a85d113c16ea5a9ccac32b0be6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
7a3fa9fb8b4e25909336f13577bc8620

SHA1
9d0f32e38711b83d27a712fc5f7216d2654c1835

SHA256
d4b3e88dc2e9ea49e633c2305742c099827f7422c0fdefb4e15af6794e2b3c76

SHA512
cef9aa7f6fcbc5aa0525cc303996f8c933392dcf60691f98f8cf78c065076610e7636f2af3dff00d15f49e0e04e69a2a61a00a85d113c16ea5a9ccac32b0be6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
b850a6f065128d50e5d7f68e634791d8

SHA1
1ed6094c18b193454d56fcf79844966e84007802

SHA256
90aa27b7a620bcb9f88bc94712427187512d12f95e6d307b8afcfe3f3b25d0ad

SHA512
6a5bc637192e74a78c26ad45f44368933c2f46e1768f0c5880d549c277f8868d9be62c225cec770ab6988f08da0bd8ce9a52693592b9b196b323f2e06512c04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
b850a6f065128d50e5d7f68e634791d8

SHA1
1ed6094c18b193454d56fcf79844966e84007802

SHA256
90aa27b7a620bcb9f88bc94712427187512d12f95e6d307b8afcfe3f3b25d0ad

SHA512
6a5bc637192e74a78c26ad45f44368933c2f46e1768f0c5880d549c277f8868d9be62c225cec770ab6988f08da0bd8ce9a52693592b9b196b323f2e06512c04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
Filesize
5.2MB

MD5
f44d3c4516eeab26c19977504a489348

SHA1
6d9c8d5d031776672b823f1bbc8800d7960f89e4

SHA256
2e9ba90fd45f84816b40018b36327abc66d94043c28bfa6ac0a152f48f48c856

SHA512
799361419c34a24e3556f7f08a12ad5368856150f63b863058bb378d59ec2539fcc0810c101cf636c47398641e9771c3949dc9ee1e28786a65a3b03c33c6c69d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
Filesize
5.2MB

MD5
f44d3c4516eeab26c19977504a489348

SHA1
6d9c8d5d031776672b823f1bbc8800d7960f89e4

SHA256
2e9ba90fd45f84816b40018b36327abc66d94043c28bfa6ac0a152f48f48c856

SHA512
799361419c34a24e3556f7f08a12ad5368856150f63b863058bb378d59ec2539fcc0810c101cf636c47398641e9771c3949dc9ee1e28786a65a3b03c33c6c69d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bRTymRxe.xlsm
Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
79b7d44e4d5b4d3469bde72d4f2065fb

SHA1
72a6849a2ffa008ed051b06e23e097a83cac0812

SHA256
b432fa6402cd61b67e4bb645460d9d30369fde5713109c79282b93621ad6bb49

SHA512
835fbd0f05b84b7aea4c95f5fc7a1c65f52372994a34b5847db2c3e33fdc5b7f77e607053db36a08babd77f206336b60bb56ae952bc0c7f2821112369d985417

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
79b7d44e4d5b4d3469bde72d4f2065fb

SHA1
72a6849a2ffa008ed051b06e23e097a83cac0812

SHA256
b432fa6402cd61b67e4bb645460d9d30369fde5713109c79282b93621ad6bb49

SHA512
835fbd0f05b84b7aea4c95f5fc7a1c65f52372994a34b5847db2c3e33fdc5b7f77e607053db36a08babd77f206336b60bb56ae952bc0c7f2821112369d985417

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
Filesize
313KB

MD5
8c4f4eb73490ca2445d8577cf4bb3c81

SHA1
0f7d1914b7aeabdb1f1e4caedd344878f48be075

SHA256
85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

SHA512
65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
Filesize
130KB

MD5
7ce8bcabb035b3de517229dbe7c5e67d

SHA1
8e43cd79a7539d240e7645f64fd7f6e9e0f90ab9

SHA256
81a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c

SHA512
be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c

Download Submit
\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE
Filesize
726KB

MD5
c3ee902099b98a299b1a215aba1b27bb

SHA1
602b023806464db25f5f8e4ffc157cc7d7e9886b

SHA256
e657a9f85af7cb5ded734e162db514e466256a83d51f4454abbf19c54b30686f

SHA512
3538548c99f266404395ce9bdcadb542171799865ac5feddce936305ff2b09ecb939bed60d1e7011a39ca8548af39f9b4ee723b15674a1df54404270fc5afc9f

Download Submit
\PROGRA~2\MICROS~1\Office14\OIS.EXE
Filesize
308KB

MD5
4545e2b5fa4062259d5ddd56ecbbd386

SHA1
c021dc8488a73bd364cb98758559fe7ba1337263

SHA256
318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8

SHA512
cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
753KB

MD5
170bbaa416953a140a898d56e23bd161

SHA1
422afc229914075c9637854bdae58db86f6996a5

SHA256
24fc8dd07d4431f72366f8cccce9644e6b5e890d6679654b22ad4f549e55ff0f

SHA512
5d25966c9fa2dfda3f5bff16c066313dd28e6a9b64ca68ee2a1440ef8325f2fd137bee046a76e449e88571f66e7169774871001db2b7860eddbb230d6be34ede

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
753KB

MD5
170bbaa416953a140a898d56e23bd161

SHA1
422afc229914075c9637854bdae58db86f6996a5

SHA256
24fc8dd07d4431f72366f8cccce9644e6b5e890d6679654b22ad4f549e55ff0f

SHA512
5d25966c9fa2dfda3f5bff16c066313dd28e6a9b64ca68ee2a1440ef8325f2fd137bee046a76e449e88571f66e7169774871001db2b7860eddbb230d6be34ede

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
5.2MB

MD5
cb637196328e1e139e38fceb254874fb

SHA1
e1b77f2bb1c120f7fd550dfae4d0eabb4a11204c

SHA256
120d77264c9ce495637333f52c9ef1ca8e0d4ac81e1eb4e723c2bba4b80897a1

SHA512
213a835eaa83283b9c1b0eccd6fb8d6d7669d3d70afaceaf3d12293a72beb77f59ec9730d30b1328b8343510ee216c54c480a2729bf6675ad85fc2368a725f59

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
5.2MB

MD5
cb637196328e1e139e38fceb254874fb

SHA1
e1b77f2bb1c120f7fd550dfae4d0eabb4a11204c

SHA256
120d77264c9ce495637333f52c9ef1ca8e0d4ac81e1eb4e723c2bba4b80897a1

SHA512
213a835eaa83283b9c1b0eccd6fb8d6d7669d3d70afaceaf3d12293a72beb77f59ec9730d30b1328b8343510ee216c54c480a2729bf6675ad85fc2368a725f59

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
7a3fa9fb8b4e25909336f13577bc8620

SHA1
9d0f32e38711b83d27a712fc5f7216d2654c1835

SHA256
d4b3e88dc2e9ea49e633c2305742c099827f7422c0fdefb4e15af6794e2b3c76

SHA512
cef9aa7f6fcbc5aa0525cc303996f8c933392dcf60691f98f8cf78c065076610e7636f2af3dff00d15f49e0e04e69a2a61a00a85d113c16ea5a9ccac32b0be6c

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
7a3fa9fb8b4e25909336f13577bc8620

SHA1
9d0f32e38711b83d27a712fc5f7216d2654c1835

SHA256
d4b3e88dc2e9ea49e633c2305742c099827f7422c0fdefb4e15af6794e2b3c76

SHA512
cef9aa7f6fcbc5aa0525cc303996f8c933392dcf60691f98f8cf78c065076610e7636f2af3dff00d15f49e0e04e69a2a61a00a85d113c16ea5a9ccac32b0be6c

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
b850a6f065128d50e5d7f68e634791d8

SHA1
1ed6094c18b193454d56fcf79844966e84007802

SHA256
90aa27b7a620bcb9f88bc94712427187512d12f95e6d307b8afcfe3f3b25d0ad

SHA512
6a5bc637192e74a78c26ad45f44368933c2f46e1768f0c5880d549c277f8868d9be62c225cec770ab6988f08da0bd8ce9a52693592b9b196b323f2e06512c04d

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
b850a6f065128d50e5d7f68e634791d8

SHA1
1ed6094c18b193454d56fcf79844966e84007802

SHA256
90aa27b7a620bcb9f88bc94712427187512d12f95e6d307b8afcfe3f3b25d0ad

SHA512
6a5bc637192e74a78c26ad45f44368933c2f46e1768f0c5880d549c277f8868d9be62c225cec770ab6988f08da0bd8ce9a52693592b9b196b323f2e06512c04d

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\._cache_4b8fe24560d919a2e4d4d347945c7d89eef3e6ddf339ddc7f85ab2633c59cab4.exe
Filesize
6.0MB

MD5
b850a6f065128d50e5d7f68e634791d8

SHA1
1ed6094c18b193454d56fcf79844966e84007802

SHA256
90aa27b7a620bcb9f88bc94712427187512d12f95e6d307b8afcfe3f3b25d0ad

SHA512
6a5bc637192e74a78c26ad45f44368933c2f46e1768f0c5880d549c277f8868d9be62c225cec770ab6988f08da0bd8ce9a52693592b9b196b323f2e06512c04d

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
Filesize
5.2MB

MD5
f44d3c4516eeab26c19977504a489348

SHA1
6d9c8d5d031776672b823f1bbc8800d7960f89e4

SHA256
2e9ba90fd45f84816b40018b36327abc66d94043c28bfa6ac0a152f48f48c856

SHA512
799361419c34a24e3556f7f08a12ad5368856150f63b863058bb378d59ec2539fcc0810c101cf636c47398641e9771c3949dc9ee1e28786a65a3b03c33c6c69d

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
Filesize
5.2MB

MD5
f44d3c4516eeab26c19977504a489348

SHA1
6d9c8d5d031776672b823f1bbc8800d7960f89e4

SHA256
2e9ba90fd45f84816b40018b36327abc66d94043c28bfa6ac0a152f48f48c856

SHA512
799361419c34a24e3556f7f08a12ad5368856150f63b863058bb378d59ec2539fcc0810c101cf636c47398641e9771c3949dc9ee1e28786a65a3b03c33c6c69d

Download Submit
memory/268-75-0x0000000000000000-mapping.dmp

Download
memory/640-63-0x0000000000000000-mapping.dmp

Download
memory/1164-80-0x0000000000000000-mapping.dmp

Download
memory/1248-57-0x0000000000000000-mapping.dmp

Download
memory/1292-91-0x0000000000000000-mapping.dmp

Download
memory/1452-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1556-128-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-129-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-142-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-144-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-145-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-130-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-147-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-146-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-148-0x000000007219D000-0x00000000721A8000-memory.dmp

Filesize
44KB

Download
memory/1556-141-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-127-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-126-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-125-0x0000000000592000-0x0000000000598000-memory.dmp

Filesize
24KB

Download
memory/1556-86-0x000000002FED1000-0x000000002FED4000-memory.dmp

Filesize
12KB

Download
memory/1556-94-0x00000000711B1000-0x00000000711B3000-memory.dmp

Filesize
8KB

Download
memory/1556-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1556-110-0x000000007219D000-0x00000000721A8000-memory.dmp

Filesize
44KB

Download
memory/1708-68-0x0000000000000000-mapping.dmp

Download