fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

Analysis

max time kernel
127s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
Size

156KB
MD5

79fb609aa97f5b8a1af29f0c4e00c200
SHA1

13239d7687cf65c23a0917de7381eff4d182cc11
SHA256

fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8
SHA512

91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da
SSDEEP

1536:/cDGTHJxWxwPZqDNU2ig1P0XTNWLTTHqAk1JCXf3l9izMfUBRq/YxiLvxnjXIRXY:ED6c6iU2imUNEfNf3wRqQxKvxnsRcaC

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
2572	852.#.exe
4976	242.#.exe
3664	718.#.exe
3520	994.#.exe
4424	899.#.exe
2036	755.#.exe
4024	781.#.exe
4780	793.#.exe
2448	818.#.exe
2260	819.#.exe
4328	223.#.exe
3184	759.#.exe
2584	26.#.exe
1268	973.#.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4964-134-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4964-137-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e37-140.dat	upx
behavioral2/files/0x0006000000022e37-141.dat	upx
behavioral2/memory/2572-144-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0007000000022e34-146.dat	upx
behavioral2/memory/2572-147-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0007000000009f72-152.dat	upx
behavioral2/files/0x0007000000009f72-151.dat	upx
behavioral2/memory/4976-156-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x00030000000226cd-161.dat	upx
behavioral2/files/0x00030000000226cd-160.dat	upx
behavioral2/memory/3664-167-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e42-170.dat	upx
behavioral2/files/0x0006000000022e42-169.dat	upx
behavioral2/memory/3520-175-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e45-179.dat	upx
behavioral2/files/0x0006000000022e45-178.dat	upx
behavioral2/memory/4424-182-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000002132d-187.dat	upx
behavioral2/files/0x000300000002132d-188.dat	upx
behavioral2/memory/2036-194-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000021341-197.dat	upx
behavioral2/files/0x0006000000021341-196.dat	upx
behavioral2/memory/4024-201-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4976-204-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4424-205-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e4f-207.dat	upx
behavioral2/files/0x0006000000022e4f-208.dat	upx
behavioral2/memory/4780-212-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0003000000000725-216.dat	upx
behavioral2/files/0x0003000000000725-217.dat	upx
behavioral2/memory/2448-221-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000000072d-225.dat	upx
behavioral2/files/0x000300000000072d-226.dat	upx
behavioral2/memory/2260-230-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0003000000000733-235.dat	upx
behavioral2/files/0x0003000000000733-234.dat	upx
behavioral2/memory/4328-236-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2260-240-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4328-241-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000400000001629c-245.dat	upx
behavioral2/files/0x000400000001629c-246.dat	upx
behavioral2/memory/3184-250-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x00050000000162ab-254.dat	upx
behavioral2/files/0x00050000000162ab-255.dat	upx
behavioral2/memory/3184-261-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000400000001da0d-264.dat	upx
behavioral2/files/0x000400000001da0d-263.dat	upx
behavioral2/memory/2584-267-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1268-268-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3688-274-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000300000001e7dc-273.dat	upx
behavioral2/files/0x000300000001e7dc-275.dat	upx
behavioral2/files/0x0002000000022c40-282.dat	upx
behavioral2/files/0x0002000000022c40-283.dat	upx
behavioral2/memory/2136-286-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3688-288-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0002000000022c4f-293.dat	upx
behavioral2/files/0x0002000000022c4f-292.dat	upx
behavioral2/memory/2136-299-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e51-302.dat	upx
behavioral2/files/0x0006000000022e51-301.dat	upx
behavioral2/memory/1496-306-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Adds Run key to start application 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	899.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	818.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	818.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	819.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	852.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	994.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	26.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	242.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	852.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	242.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	718.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	819.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	819.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	223.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	759.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	759.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	994.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	899.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	781.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	793.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	793.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	759.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	26.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	994.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	899.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	755.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	755.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	781.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	242.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	718.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	223.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	818.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	26.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	718.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	755.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	781.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	793.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	223.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	852.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\	793.#.exe
File created	C:\Program Files\7-Zip\7z.exe	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\	899.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\	899.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\	755.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\	781.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	899.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\	818.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	755.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\	899.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\	899.#.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	819.#.exe
File opened for modification	C:\Program Files\7-Zip\	781.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\	793.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	793.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\	818.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\	781.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	994.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	994.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	755.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\	818.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	223.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\	718.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	818.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\	818.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\	852.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\	793.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\	899.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	994.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\	793.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\	793.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	994.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\	819.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\	781.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\	755.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\	242.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	781.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\	852.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\	818.#.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\ = "Script Encoder Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.htm	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode\ = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe

NTFS ADS 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	718.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	899.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	793.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	242.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	781.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	223.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	994.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	755.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	26.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	818.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	819.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	852.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	759.#.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
2572	852.#.exe
4976	242.#.exe
3664	718.#.exe
3520	994.#.exe
4424	899.#.exe
2036	755.#.exe
4024	781.#.exe
4780	793.#.exe
2448	818.#.exe
2260	819.#.exe
4328	223.#.exe
3184	759.#.exe
2584	26.#.exe
1268	973.#.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2268	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	84
PID 4964 wrote to memory of 2268	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	84
PID 4964 wrote to memory of 2268	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	84
PID 4964 wrote to memory of 4492	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	85
PID 4964 wrote to memory of 4492	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	85
PID 4964 wrote to memory of 4492	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	85
PID 4964 wrote to memory of 2572	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	86
PID 4964 wrote to memory of 2572	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	86
PID 4964 wrote to memory of 2572	4964	fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe	86
PID 2572 wrote to memory of 2180	2572	852.#.exe	87
PID 2572 wrote to memory of 2180	2572	852.#.exe	87
PID 2572 wrote to memory of 2180	2572	852.#.exe	87
PID 2572 wrote to memory of 4920	2572	852.#.exe	89
PID 2572 wrote to memory of 4920	2572	852.#.exe	89
PID 2572 wrote to memory of 4920	2572	852.#.exe	89
PID 2572 wrote to memory of 4976	2572	852.#.exe	90
PID 2572 wrote to memory of 4976	2572	852.#.exe	90
PID 2572 wrote to memory of 4976	2572	852.#.exe	90
PID 4976 wrote to memory of 2204	4976	242.#.exe	91
PID 4976 wrote to memory of 2204	4976	242.#.exe	91
PID 4976 wrote to memory of 2204	4976	242.#.exe	91
PID 4976 wrote to memory of 4112	4976	242.#.exe	92
PID 4976 wrote to memory of 4112	4976	242.#.exe	92
PID 4976 wrote to memory of 4112	4976	242.#.exe	92
PID 4976 wrote to memory of 3664	4976	242.#.exe	93
PID 4976 wrote to memory of 3664	4976	242.#.exe	93
PID 4976 wrote to memory of 3664	4976	242.#.exe	93
PID 3664 wrote to memory of 3956	3664	718.#.exe	94
PID 3664 wrote to memory of 3956	3664	718.#.exe	94
PID 3664 wrote to memory of 3956	3664	718.#.exe	94
PID 3664 wrote to memory of 3660	3664	718.#.exe	95
PID 3664 wrote to memory of 3660	3664	718.#.exe	95
PID 3664 wrote to memory of 3660	3664	718.#.exe	95
PID 3664 wrote to memory of 3520	3664	718.#.exe	96
PID 3664 wrote to memory of 3520	3664	718.#.exe	96
PID 3664 wrote to memory of 3520	3664	718.#.exe	96
PID 3520 wrote to memory of 1360	3520	994.#.exe	97
PID 3520 wrote to memory of 1360	3520	994.#.exe	97
PID 3520 wrote to memory of 1360	3520	994.#.exe	97
PID 3520 wrote to memory of 2064	3520	994.#.exe	98
PID 3520 wrote to memory of 2064	3520	994.#.exe	98
PID 3520 wrote to memory of 2064	3520	994.#.exe	98
PID 3520 wrote to memory of 4424	3520	994.#.exe	99
PID 3520 wrote to memory of 4424	3520	994.#.exe	99
PID 3520 wrote to memory of 4424	3520	994.#.exe	99
PID 4424 wrote to memory of 1064	4424	899.#.exe	100
PID 4424 wrote to memory of 1064	4424	899.#.exe	100
PID 4424 wrote to memory of 1064	4424	899.#.exe	100
PID 4424 wrote to memory of 1632	4424	899.#.exe	101
PID 4424 wrote to memory of 1632	4424	899.#.exe	101
PID 4424 wrote to memory of 1632	4424	899.#.exe	101
PID 4424 wrote to memory of 2036	4424	899.#.exe	102
PID 4424 wrote to memory of 2036	4424	899.#.exe	102
PID 4424 wrote to memory of 2036	4424	899.#.exe	102
PID 2036 wrote to memory of 1832	2036	755.#.exe	103
PID 2036 wrote to memory of 1832	2036	755.#.exe	103
PID 2036 wrote to memory of 1832	2036	755.#.exe	103
PID 2036 wrote to memory of 2184	2036	755.#.exe	104
PID 2036 wrote to memory of 2184	2036	755.#.exe	104
PID 2036 wrote to memory of 2184	2036	755.#.exe	104
PID 2036 wrote to memory of 4024	2036	755.#.exe	105
PID 2036 wrote to memory of 4024	2036	755.#.exe	105
PID 2036 wrote to memory of 4024	2036	755.#.exe	105
PID 4024 wrote to memory of 4408	4024	781.#.exe	106

C:\Users\Admin\AppData\Local\Temp\fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe
"C:\Users\Admin\AppData\Local\Temp\fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - Modifies registry class
  PID:2268
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\859325.vbs"
  2⤵
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\852.#.exe
  C:\Users\Admin\AppData\Local\Temp\852.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - Modifies registry class
    PID:2180
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\220531.vbs"
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\242.#.exe
    C:\Users\Admin\AppData\Local\Temp\242.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      Modifies registry class
      PID:2204
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\902782.vbs"
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\718.#.exe
      C:\Users\Admin\AppData\Local\Temp\718.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        Modifies registry class
        
        PID:3956
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\163768.vbs"
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\994.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\994.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3520
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        Modifies registry class
        
        PID:1360
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\317699.vbs"
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\899.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\899.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\797313.vbs"
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\755.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\755.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\699047.vbs"
        8⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\781.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\781.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\505443.vbs"
        9⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\793.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\793.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4780
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\20580.vbs"
        10⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\818.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\818.#.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\485546.vbs"
        11⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\819.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\819.#.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\171825.vbs"
        12⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\223.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\223.#.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        13⤵
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\364086.vbs"
        13⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\759.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\759.#.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:3184
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        14⤵
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\953731.vbs"
        14⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\26.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\26.#.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        15⤵
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\22701.vbs"
        15⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\973.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\973.#.exe
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        16⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\196163.vbs"
        16⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\833.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\833.#.exe
        16⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        17⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\595089.vbs"
        17⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\682.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\682.#.exe
        17⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        18⤵
        
        PID:180
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\35274.vbs"
        18⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\594.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\594.#.exe
        18⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        19⤵
        
        PID:648
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\997188.vbs"
        19⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\568.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\568.#.exe
        19⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        20⤵
        
        PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\10a0699fa37928d39c\spfirewall.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\223.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\223.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\242.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\242.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\26.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\26.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\568.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\568.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\594.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\594.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\682.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\682.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\718.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\718.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\755.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\755.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\759.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\759.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\781.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\781.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\793.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\793.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\818.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\818.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\819.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\819.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\833.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\833.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\852.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\852.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\899.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\899.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\973.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\973.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\994.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\994.#.exe

Filesize
156KB

MD5
79fb609aa97f5b8a1af29f0c4e00c200

SHA1
13239d7687cf65c23a0917de7381eff4d182cc11

SHA256
fcb5f6624464e55bd3f3529924b3715e3d8111379be5b3f5edb28405b3a6a8e8

SHA512
91862073f2f5655972dbf8ecd82adc87929024eeae1e93b726fbdf5d02823fe7ac90572a046a3aba60e8fbfffff8fbe6e49a499628e40bdc8c304e39d3fdc4da

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\163768.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\171825.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\196163.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\20580.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\220531.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\22701.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\317699.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\35274.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\364086.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\485546.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\505443.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\595089.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\699047.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\797313.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\859325.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\902782.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\953731.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\997188.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
memory/1268-268-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1496-306-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2036-194-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2136-286-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2136-299-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2260-240-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2260-230-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2448-221-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2572-144-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2572-147-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2584-267-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3184-261-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3184-250-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3520-175-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3664-167-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3688-274-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3688-288-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4024-201-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4328-241-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4328-236-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4424-182-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4424-205-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4780-212-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4964-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4964-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4976-204-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4976-156-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download