0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

Analysis

max time kernel
157s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
Size

124KB
MD5

6f86f674a28302a2ba3e73a3d2d74cf0
SHA1

b58e4710a94a8fb4eac0284b2f26bd0567400843
SHA256

0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39
SHA512

96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf
SSDEEP

1536:/cDGTHJxWxwPZqDNUIRYcBDZJN5tM49Ik/HWKg1A67JfWtrIa0Uy4VtJ:ED6c6iUbcBDZJrSWps7JfMUa0Uy4VtJ

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4904	892.#.exe
1444	883.#.exe
3668	286.#.exe
1288	481.#.exe
2568	275.#.exe
4200	15.#.exe
4260	83.#.exe
1000	470.#.exe
540	388.#.exe
4864	13.#.exe
4956	143.#.exe
768	420.#.exe
4396	420.#.exe
4084	774.#.exe
3700	729.#.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4052-136-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000b000000022e25-142.dat	upx
behavioral2/files/0x000b000000022e25-143.dat	upx
behavioral2/memory/4904-147-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0008000000022e2d-148.dat	upx
behavioral2/files/0x0006000000022e4e-152.dat	upx
behavioral2/files/0x0006000000022e4e-153.dat	upx
behavioral2/memory/1444-157-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e51-161.dat	upx
behavioral2/files/0x0006000000022e51-162.dat	upx
behavioral2/memory/4052-165-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3668-166-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4904-167-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3668-171-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e55-172.dat	upx
behavioral2/files/0x0006000000022e54-174.dat	upx
behavioral2/files/0x0006000000022e54-175.dat	upx
behavioral2/memory/1288-178-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e59-184.dat	upx
behavioral2/files/0x0006000000022e59-183.dat	upx
behavioral2/memory/2568-188-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e5c-193.dat	upx
behavioral2/files/0x0006000000022e5c-192.dat	upx
behavioral2/memory/1288-196-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4200-197-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e5f-203.dat	upx
behavioral2/files/0x0006000000022e5f-202.dat	upx
behavioral2/files/0x0006000000022e61-207.dat	upx
behavioral2/files/0x000400000002136d-212.dat	upx
behavioral2/files/0x000400000002136d-211.dat	upx
behavioral2/memory/1000-215-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x00020000000213b1-217.dat	upx
behavioral2/files/0x00030000000213b7-222.dat	upx
behavioral2/files/0x00030000000213b7-221.dat	upx
behavioral2/files/0x0006000000022e65-225.dat	upx
behavioral2/memory/4200-226-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/540-227-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4260-231-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1000-232-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/540-233-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e68-236.dat	upx
behavioral2/files/0x0006000000022e68-235.dat	upx
behavioral2/memory/4864-239-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4864-241-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e6b-245.dat	upx
behavioral2/files/0x0006000000022e6b-246.dat	upx
behavioral2/memory/4956-251-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000000071f-255.dat	upx
behavioral2/files/0x000300000000071f-254.dat	upx
behavioral2/memory/768-258-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000000071f-263.dat	upx
behavioral2/memory/768-266-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4396-267-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4396-270-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000000072f-274.dat	upx
behavioral2/files/0x000300000000072f-273.dat	upx
behavioral2/memory/4084-277-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4084-280-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0004000000000735-284.dat	upx
behavioral2/files/0x0004000000000735-283.dat	upx
behavioral2/memory/3700-288-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000009dcc-289.dat	upx

Adds Run key to start application 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	15.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	83.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	13.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	13.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	420.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	143.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	420.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	892.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	883.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	481.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	275.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	470.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	470.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	774.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	892.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	286.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	83.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	420.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	774.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	883.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	275.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	275.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	470.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	143.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	143.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	729.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	883.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	286.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	481.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	15.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	15.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	83.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	420.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	729.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	892.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	286.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	388.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	13.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	420.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	420.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	481.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	388.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	388.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	774.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	729.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\	275.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\	470.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	470.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\	883.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	388.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\	83.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\	420.#.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	892.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\	83.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\	892.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\	83.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	286.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\	420.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\fr-FR\	286.#.exe
File created	C:\Program Files\7-Zip\7zFM.exe	286.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\	892.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	388.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	420.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\	388.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	15.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	388.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	143.#.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	420.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\	286.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\	892.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	883.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	470.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\	883.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	470.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\	420.#.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	420.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	286.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	15.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\	420.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	143.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	420.#.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\	883.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\	15.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\	388.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\	13.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\	481.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	388.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\	143.#.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	83.#.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\	13.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	883.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\	143.#.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\	470.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\ = "Script Encoder Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode\ = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode\ = "{85131630-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.html	regsvr32.exe

NTFS ADS 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	892.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	481.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	15.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	83.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	774.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	883.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	286.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	470.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	13.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	420.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	275.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	388.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	143.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	420.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	729.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
4904	892.#.exe
1444	883.#.exe
3668	286.#.exe
1288	481.#.exe
2568	275.#.exe
4200	15.#.exe
4260	83.#.exe
1000	470.#.exe
540	388.#.exe
4864	13.#.exe
4956	143.#.exe
768	420.#.exe
4396	420.#.exe
4084	774.#.exe
3700	729.#.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4084	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	82
PID 4052 wrote to memory of 4084	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	82
PID 4052 wrote to memory of 4084	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	82
PID 4052 wrote to memory of 5048	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	83
PID 4052 wrote to memory of 5048	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	83
PID 4052 wrote to memory of 5048	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	83
PID 4052 wrote to memory of 4904	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	84
PID 4052 wrote to memory of 4904	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	84
PID 4052 wrote to memory of 4904	4052	0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe	84
PID 4904 wrote to memory of 1824	4904	892.#.exe	85
PID 4904 wrote to memory of 1824	4904	892.#.exe	85
PID 4904 wrote to memory of 1824	4904	892.#.exe	85
PID 4904 wrote to memory of 384	4904	892.#.exe	86
PID 4904 wrote to memory of 384	4904	892.#.exe	86
PID 4904 wrote to memory of 384	4904	892.#.exe	86
PID 4904 wrote to memory of 1444	4904	892.#.exe	87
PID 4904 wrote to memory of 1444	4904	892.#.exe	87
PID 4904 wrote to memory of 1444	4904	892.#.exe	87
PID 1444 wrote to memory of 684	1444	883.#.exe	88
PID 1444 wrote to memory of 684	1444	883.#.exe	88
PID 1444 wrote to memory of 684	1444	883.#.exe	88
PID 1444 wrote to memory of 4568	1444	883.#.exe	89
PID 1444 wrote to memory of 4568	1444	883.#.exe	89
PID 1444 wrote to memory of 4568	1444	883.#.exe	89
PID 1444 wrote to memory of 3668	1444	883.#.exe	90
PID 1444 wrote to memory of 3668	1444	883.#.exe	90
PID 1444 wrote to memory of 3668	1444	883.#.exe	90
PID 3668 wrote to memory of 1432	3668	286.#.exe	91
PID 3668 wrote to memory of 1432	3668	286.#.exe	91
PID 3668 wrote to memory of 1432	3668	286.#.exe	91
PID 3668 wrote to memory of 112	3668	286.#.exe	92
PID 3668 wrote to memory of 112	3668	286.#.exe	92
PID 3668 wrote to memory of 112	3668	286.#.exe	92
PID 3668 wrote to memory of 1288	3668	286.#.exe	93
PID 3668 wrote to memory of 1288	3668	286.#.exe	93
PID 3668 wrote to memory of 1288	3668	286.#.exe	93
PID 1288 wrote to memory of 4716	1288	481.#.exe	95
PID 1288 wrote to memory of 4716	1288	481.#.exe	95
PID 1288 wrote to memory of 4716	1288	481.#.exe	95
PID 1288 wrote to memory of 1760	1288	481.#.exe	96
PID 1288 wrote to memory of 1760	1288	481.#.exe	96
PID 1288 wrote to memory of 1760	1288	481.#.exe	96
PID 1288 wrote to memory of 2568	1288	481.#.exe	98
PID 1288 wrote to memory of 2568	1288	481.#.exe	98
PID 1288 wrote to memory of 2568	1288	481.#.exe	98
PID 2568 wrote to memory of 3716	2568	275.#.exe	99
PID 2568 wrote to memory of 3716	2568	275.#.exe	99
PID 2568 wrote to memory of 3716	2568	275.#.exe	99
PID 2568 wrote to memory of 2016	2568	275.#.exe	100
PID 2568 wrote to memory of 2016	2568	275.#.exe	100
PID 2568 wrote to memory of 2016	2568	275.#.exe	100
PID 2568 wrote to memory of 4200	2568	275.#.exe	101
PID 2568 wrote to memory of 4200	2568	275.#.exe	101
PID 2568 wrote to memory of 4200	2568	275.#.exe	101
PID 4200 wrote to memory of 2924	4200	15.#.exe	102
PID 4200 wrote to memory of 2924	4200	15.#.exe	102
PID 4200 wrote to memory of 2924	4200	15.#.exe	102
PID 4200 wrote to memory of 1884	4200	15.#.exe	103
PID 4200 wrote to memory of 1884	4200	15.#.exe	103
PID 4200 wrote to memory of 1884	4200	15.#.exe	103
PID 4200 wrote to memory of 4260	4200	15.#.exe	104
PID 4200 wrote to memory of 4260	4200	15.#.exe	104
PID 4200 wrote to memory of 4260	4200	15.#.exe	104
PID 4260 wrote to memory of 712	4260	83.#.exe	105

C:\Users\Admin\AppData\Local\Temp\0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe
"C:\Users\Admin\AppData\Local\Temp\0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - Modifies registry class
  PID:4084
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\328365.vbs"
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\892.#.exe
  C:\Users\Admin\AppData\Local\Temp\892.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - Modifies registry class
    PID:1824
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\606929.vbs"
    3⤵
    PID:384
- - C:\Users\Admin\AppData\Local\Temp\883.#.exe
    C:\Users\Admin\AppData\Local\Temp\883.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      Modifies registry class
      PID:684
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\120113.vbs"
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\286.#.exe
      C:\Users\Admin\AppData\Local\Temp\286.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        Modifies registry class
        
        PID:1432
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\586666.vbs"
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\481.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\481.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        Modifies registry class
        
        PID:4716
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\928631.vbs"
        6⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\275.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\275.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\978435.vbs"
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\15.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\15.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\110515.vbs"
        8⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\83.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\83.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\295330.vbs"
        9⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\470.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\470.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:1000
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\557903.vbs"
        10⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\388.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\388.#.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\553631.vbs"
        11⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\13.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\13.#.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4864
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\888469.vbs"
        12⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\143.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\143.#.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        13⤵
        Modifies registry class
        
        PID:3272
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\119182.vbs"
        13⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\420.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\420.#.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        14⤵
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\211834.vbs"
        14⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\420.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\420.#.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4396
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        15⤵
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\653362.vbs"
        15⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\774.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\774.#.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4084
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        16⤵
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\935466.vbs"
        16⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\729.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\729.#.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:3700
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        17⤵
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\856365.vbs"
        17⤵
        
        PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\10a0699fa37928d39c\spfirewall.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
139KB

MD5
d90b781f5f9c5b60a1ec1c595f4da703

SHA1
bc45c99b33541c54d9882a11aff7c1f344eb3d8a

SHA256
a24b494719305035135d5a3eeeb341ae5adb165550bb56c052222fa98733d673

SHA512
8f2f6b949c8c7724c62ceb9b2212a2b5062d062ad6872aea501490a26d6de641e81ea9a1ab67505a2f8f02984d442e5939ea40d9e6aaf347bcf59a841748468f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
172KB

MD5
437467c45318d5e1504adf7c0eba80ed

SHA1
18d19302392e844cc9ed7a49416f70955b99ed55

SHA256
be932ad7e8f0c5779664ab38bf10136ea1c9abf41a18ecf0941e852912563735

SHA512
ca326fc352f681602eefadea76070ec9bf95f166e505527f8215b7026d0f751d5f5fe74745f97fead56f288f76c31610b96614ecb4571a0a536c889ce949bc06

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
483KB

MD5
e51fd0d300394e57dd51c3115a39455e

SHA1
4d0412a015bc113fa3ec3bdeae3e6e3379f30cea

SHA256
851156aad8e842932bcb504ae13d947a4a21599ab6bf9211a7cde8c91e55a0ed

SHA512
6af9365ef3de2e0a44eb4e665d42b83677d92abe51c3f8580626c155fae95dee1f2448531e148605e8c7525d95f39893c7e2379745f9905df182dedc8c00edc5

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$

Filesize
221KB

MD5
2466a3f4163b25a40bb1216086ea4957

SHA1
3110a93c4011b7575f96f65361cf1210b38b8384

SHA256
d58a106ebf0264fa651206eed113dafbba402955c12a0addda44bb07efff9f13

SHA512
5434a16d0ba034168d306058bbf0dccb84045dce2e7f8423b90c94a30b4a7f1dc271ccb58903f467215c3326748f9b38303338e17d085f6e235f5603f352c1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\143.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\143.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\15.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\15.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\275.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\275.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\286.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\286.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\388.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\388.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\420.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\420.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\420.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\470.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\470.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\481.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\481.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\729.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\729.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\774.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\774.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\83.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\83.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\883.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\883.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\892.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\892.#.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\110515.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\119182.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\120113.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\211834.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\295330.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\328365.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\553631.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\557903.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\586666.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\606929.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\653362.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\856365.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\888469.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\928631.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\935466.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\978435.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\odt\office2016setup.exe

Filesize
124KB

MD5
6f86f674a28302a2ba3e73a3d2d74cf0

SHA1
b58e4710a94a8fb4eac0284b2f26bd0567400843

SHA256
0e2e14c1f3babdbba64bb769e021245c33bceca8c90aa950d5fd56ed057ccc39

SHA512
96eb4922c8724193b8bf8e9ecc941d06731c90b3e117e179b2fdfedfa8a33c88b1513645c690e112bfdc18fe873d74003df1ab5162bf21d7d81a27448564e0cf

Download Submit
memory/540-233-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/540-227-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/768-258-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/768-266-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-215-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-232-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1288-196-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1288-178-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1444-157-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2568-188-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3668-166-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3668-171-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3700-288-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4052-165-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4052-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4084-280-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4084-277-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4200-197-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4200-226-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-231-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4396-267-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4396-270-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4864-239-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4864-241-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4904-147-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4904-167-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4956-251-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download