8720e91f2f4c8b8c4d9e9163fedb50252920bed3fec48b23416c2236ac09659f

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6ddaedbe89ed3721a759d36b4458037.exe
Size

24KB
MD5

b6ddaedbe89ed3721a759d36b4458037
SHA1

1b9dc20b35fc43af5a9cb01d197604713cac5110
SHA256

8720e91f2f4c8b8c4d9e9163fedb50252920bed3fec48b23416c2236ac09659f
SHA512

52fbe3d11a23596bc09897ffeb74d333d8a7f17a863180642849073f9852b449e5763933451be89dfe67338694fc79582887891167cad524d2bc65245fc5ea06
SSDEEP

384:4l8q7E2vDsnwe6qyGPHK7pgymJu7UzFI1PuwNC7GjIP5jaTiJ6OSV:4Wq7E2FnqZWgTr+Gw1cZaTicO+

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAS.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wuauclt.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIARP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMAIN.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32KRN.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAS.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32KRN.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIARP.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wuauclt.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMAIN.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	b6ddaedbe89ed3721a759d36b4458037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE	b6ddaedbe89ed3721a759d36b4458037.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\P:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\Q:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\J:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\M:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\R:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\S:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\H:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\I:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\N:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\O:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\U:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\Y:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\Z:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\E:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\G:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\K:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\T:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\V:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\W:	b6ddaedbe89ed3721a759d36b4458037.exe
File opened (read-only)	\??\X:	b6ddaedbe89ed3721a759d36b4458037.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	b6ddaedbe89ed3721a759d36b4458037.exe
File created	F:\AUTORUN.INF	b6ddaedbe89ed3721a759d36b4458037.exe
File opened for modification	C:\AUTORUN.INF	b6ddaedbe89ed3721a759d36b4458037.exe
File created	C:\AUTORUN.INF	b6ddaedbe89ed3721a759d36b4458037.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rskbrskb.dll	b6ddaedbe89ed3721a759d36b4458037.exe
File opened for modification	C:\Windows\SysWOW64\rskbrskb.dll	b6ddaedbe89ed3721a759d36b4458037.exe
File created	C:\Windows\SysWOW64\wauc1t.exe	b6ddaedbe89ed3721a759d36b4458037.exe
File created	C:\Windows\SysWOW64\iexplorer.exe	b6ddaedbe89ed3721a759d36b4458037.exe
File opened for modification	C:\Windows\SysWOW64\wauc1t.exe	b6ddaedbe89ed3721a759d36b4458037.exe
File opened for modification	C:\Windows\SysWOW64\iexplorer.exe	b6ddaedbe89ed3721a759d36b4458037.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "1855000266"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7E9F941-30D4-11D6-9F87-7EEA931DE775} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe
2168	b6ddaedbe89ed3721a759d36b4458037.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeSystemtimePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeBackupPrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeBackupPrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe
Token: SeRestorePrivilege	2168	b6ddaedbe89ed3721a759d36b4458037.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3016	2168	b6ddaedbe89ed3721a759d36b4458037.exe	28
PID 2168 wrote to memory of 3016	2168	b6ddaedbe89ed3721a759d36b4458037.exe	28
PID 2168 wrote to memory of 3016	2168	b6ddaedbe89ed3721a759d36b4458037.exe	28
PID 2168 wrote to memory of 3016	2168	b6ddaedbe89ed3721a759d36b4458037.exe	28
PID 3016 wrote to memory of 1880	3016	cmd.exe	30
PID 3016 wrote to memory of 1880	3016	cmd.exe	30
PID 3016 wrote to memory of 1880	3016	cmd.exe	30
PID 3016 wrote to memory of 1880	3016	cmd.exe	30
PID 1880 wrote to memory of 3068	1880	net.exe	31
PID 1880 wrote to memory of 3068	1880	net.exe	31
PID 1880 wrote to memory of 3068	1880	net.exe	31
PID 1880 wrote to memory of 3068	1880	net.exe	31
PID 2168 wrote to memory of 2528	2168	b6ddaedbe89ed3721a759d36b4458037.exe	32
PID 2168 wrote to memory of 2528	2168	b6ddaedbe89ed3721a759d36b4458037.exe	32
PID 2168 wrote to memory of 2528	2168	b6ddaedbe89ed3721a759d36b4458037.exe	32
PID 2168 wrote to memory of 2528	2168	b6ddaedbe89ed3721a759d36b4458037.exe	32
PID 2528 wrote to memory of 2656	2528	cmd.exe	34
PID 2528 wrote to memory of 2656	2528	cmd.exe	34
PID 2528 wrote to memory of 2656	2528	cmd.exe	34
PID 2528 wrote to memory of 2656	2528	cmd.exe	34
PID 2656 wrote to memory of 2672	2656	net.exe	35
PID 2656 wrote to memory of 2672	2656	net.exe	35
PID 2656 wrote to memory of 2672	2656	net.exe	35
PID 2656 wrote to memory of 2672	2656	net.exe	35
PID 2168 wrote to memory of 2676	2168	b6ddaedbe89ed3721a759d36b4458037.exe	36
PID 2168 wrote to memory of 2676	2168	b6ddaedbe89ed3721a759d36b4458037.exe	36
PID 2168 wrote to memory of 2676	2168	b6ddaedbe89ed3721a759d36b4458037.exe	36
PID 2168 wrote to memory of 2676	2168	b6ddaedbe89ed3721a759d36b4458037.exe	36
PID 2676 wrote to memory of 2660	2676	cmd.exe	38
PID 2676 wrote to memory of 2660	2676	cmd.exe	38
PID 2676 wrote to memory of 2660	2676	cmd.exe	38
PID 2676 wrote to memory of 2660	2676	cmd.exe	38
PID 2660 wrote to memory of 2544	2660	net.exe	39
PID 2660 wrote to memory of 2544	2660	net.exe	39
PID 2660 wrote to memory of 2544	2660	net.exe	39
PID 2660 wrote to memory of 2544	2660	net.exe	39
PID 2168 wrote to memory of 2512	2168	b6ddaedbe89ed3721a759d36b4458037.exe	40
PID 2168 wrote to memory of 2512	2168	b6ddaedbe89ed3721a759d36b4458037.exe	40
PID 2168 wrote to memory of 2512	2168	b6ddaedbe89ed3721a759d36b4458037.exe	40
PID 2168 wrote to memory of 2512	2168	b6ddaedbe89ed3721a759d36b4458037.exe	40
PID 2512 wrote to memory of 2520	2512	cmd.exe	42
PID 2512 wrote to memory of 2520	2512	cmd.exe	42
PID 2512 wrote to memory of 2520	2512	cmd.exe	42
PID 2512 wrote to memory of 2520	2512	cmd.exe	42
PID 2520 wrote to memory of 1976	2520	net.exe	43
PID 2520 wrote to memory of 1976	2520	net.exe	43
PID 2520 wrote to memory of 1976	2520	net.exe	43
PID 2520 wrote to memory of 1976	2520	net.exe	43
PID 2168 wrote to memory of 3044	2168	b6ddaedbe89ed3721a759d36b4458037.exe	44
PID 2168 wrote to memory of 3044	2168	b6ddaedbe89ed3721a759d36b4458037.exe	44
PID 2168 wrote to memory of 3044	2168	b6ddaedbe89ed3721a759d36b4458037.exe	44
PID 2168 wrote to memory of 3044	2168	b6ddaedbe89ed3721a759d36b4458037.exe	44
PID 3044 wrote to memory of 2420	3044	cmd.exe	46
PID 3044 wrote to memory of 2420	3044	cmd.exe	46
PID 3044 wrote to memory of 2420	3044	cmd.exe	46
PID 3044 wrote to memory of 2420	3044	cmd.exe	46
PID 2420 wrote to memory of 2828	2420	net.exe	47
PID 2420 wrote to memory of 2828	2420	net.exe	47
PID 2420 wrote to memory of 2828	2420	net.exe	47
PID 2420 wrote to memory of 2828	2420	net.exe	47
PID 2168 wrote to memory of 2412	2168	b6ddaedbe89ed3721a759d36b4458037.exe	48
PID 2168 wrote to memory of 2412	2168	b6ddaedbe89ed3721a759d36b4458037.exe	48
PID 2168 wrote to memory of 2412	2168	b6ddaedbe89ed3721a759d36b4458037.exe	48
PID 2168 wrote to memory of 2412	2168	b6ddaedbe89ed3721a759d36b4458037.exe	48

C:\Users\Admin\AppData\Local\Temp\b6ddaedbe89ed3721a759d36b4458037.exe
"C:\Users\Admin\AppData\Local\Temp\b6ddaedbe89ed3721a759d36b4458037.exe"
1⤵
- Sets file execution options in registry
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop McShield
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\net.exe
    net stop McShield
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop McShield
      4⤵
      PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KWhatchsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\net.exe
    net stop KWhatchsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KWhatchsvc
      4⤵
      PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KPfwSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\net.exe
    net stop KPfwSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KPfwSvc
      4⤵
      PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop DefWatch
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\net.exe
    net stop DefWatch
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop DefWatch
      4⤵
      PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KWhatchsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\net.exe
    net stop KWhatchsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KWhatchsvc
      4⤵
      PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "McAfee McShield"
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfee McShield"
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfee McShield"
      4⤵
      PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop DefWatch
  2⤵
  PID:2432
- - C:\Windows\SysWOW64\net.exe
    net stop DefWatch
    3⤵
    PID:2388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop DefWatch
      4⤵
      PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus Client"
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus Client"
    3⤵
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus Client"
      4⤵
      PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus"
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus"
    3⤵
    PID:2704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus"
      4⤵
      PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus Definition Watcher"
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus Definition Watcher"
    3⤵
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus Definition Watcher"
      4⤵
      PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "McAfee Framework ·þÎñ"
  2⤵
  PID:612
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfee Framework ·þÎñ"
    3⤵
    PID:1724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfee Framework ·þÎñ"
      4⤵
      PID:356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Norton AntiVirus Server"
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\net.exe
    net stop "Norton AntiVirus Server"
    3⤵
    PID:1912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Norton AntiVirus Server"
      4⤵
      PID:1852
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\packet.dll /e /p everyone:f
  2⤵
  PID:2280
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\pthreadVC.dll /e /p everyone:f
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\wpcap.dll /e /p everyone:f
  2⤵
  PID:584
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\npf.sys /e /p everyone:f
  2⤵
  PID:956
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\npptools.dll /e /p everyone:f
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\acpidisk.sys /e /p everyone:f
  2⤵
  PID:836
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\wanpacket.dll /e /p everyone:f
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯ /e /p everyone:f
  2⤵
  PID:2796
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1952
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AUTORUN.INF

Filesize
145B

MD5
43a741a56d6407be6c4190a29c26b39b

SHA1
fd4f5a3732fa9c9426428d8100812cd33ffb4e03

SHA256
a094953255a5f2815a96bfddf420056e42abead85111df8362adb1de83d81dc3

SHA512
5b75cb17a44f14eacf6ccc10fc455a4945872a152aecb5f1ea30b0bead88501e41711103d8f64e9a455ca02fe2281fc1771efc09fb025bd3d0884975c79fd5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e817e0c0a7a33086f5ba79f6d8fdc2c4

SHA1
2df7aa0f171b42ce8581375838d439c2d19e285d

SHA256
e44f2fab7258203344e148c4600fc9e500276d3eb198c87505a5b5780b7c31b5

SHA512
52ad4884053df89c6554a7d22c22990be191aa91006899c5babb7d25588225d0dabbec749473a6d0836c81d84a0f5dfece19e35d3e743b98b98abb710c398ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c76f59088b384fe9e3ce4cac4ba0b75

SHA1
e9842ca24a34e3acc3deb7c67491ee316a2c15f9

SHA256
3c56fa9f19e05de60b71db51974ba8938c7066b6277d46fbe93d135bc625f82f

SHA512
039d7e2ae569318b7bd0d077035cfe5e751ad1f49880f884434830907988a934e5e3ffcd994ebd9263508d5ef478bf637ec5336a22dc28cd0e9d6b882bac1523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4f25b6e58b0007dafabb8e95409cd2f

SHA1
4604898821493524b6fb5cb87520f328c6848c07

SHA256
871cbb90f6e42e8e069635cab2699787c0c8937e1b53f0ed715676d3f9e0f650

SHA512
d867013b05553eed96390b58e0c36092b969f7075e1d7c85a7dbde3ffe644df56e5c48d503743e801a24670c85825ff7e34af78c90e664cc8095fc3cf512b28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae46e043f1658588b554dc77ccd14ea

SHA1
6d18c80a3ce81f9b890b58b80e11dc021fb8862b

SHA256
c9083085649874d3c59e9cade82ccdcd281dad71532c34b9a8176429bb952943

SHA512
36ea2db644b05493f0a5d164c12b63ef8afd8c06a18967da4708a6903c51d8609809d3d2f65e8eea5658c7a79d0fd3afca2602908f9d4535540bf4898deabd90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50bd215fc29f7bbda74bf48810ccf182

SHA1
11262d4bff9c2cf223ba996896d2958723867c45

SHA256
6feff345707ea2221ca211f6a3cdd0a83a4765963c07daec7b1ac86ec805bdf3

SHA512
0653225575d4493f9aebb4983b8e017d55e70161c8d11d56c8e584232a889ef3912a1cfa3608bdbb48214c96efc67f1b2ec600c6387fc2e3824184f63d7e4152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f8fdeadaf93b3b73c8d44b040ceff7

SHA1
2a5bbf31845408cc8de08c14586b6c44783401fd

SHA256
25ec6ce757cf9e02a9ec4314f85ef20625c15ecac0eca3ab2410fd308995bb45

SHA512
d789e86bc85af8ab87309b67e1fb5b905db00cd3a9a84c52572354f2075115ce268eb1d594b0dfa6bc7e202cde2e609d1ac4594355aea8669acad6ebcc6e3e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61347acc0504764910b114f6022b1430

SHA1
395b579ec97309d0cbbec2b2d78e46ffc9f78a5b

SHA256
12d92062145caf443e6168f75c60f5b6b280fa80898b7596531e7781d3a1e444

SHA512
b5535ba36dfef7afc913ea421a6a7adc3cf6aff876d1dd0b936b589b7f1fce262280ede55023f2d94b096d599f20f1938c28333fbd5c1eeb180ddeddaf194a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63c47c3c988c3df027d89a90461f2d4

SHA1
40b3eccd84c427a0d2e060dfb89afae85bb65757

SHA256
d9c3e437182409a9ee177ba6000ac07c0628915fd94c6a89304bbbba1f8c2583

SHA512
f95e437a44ea85080db139648708f7ef2251048d8b049dc14b71f0c4c5736832bf5df356bac2bbc754f5a10cd646ab31d8e336efecb0f3f837d3b5935e62a1ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b02fd63a7db7de365114ba2fa4d77b

SHA1
51285c1e7fc405dc099f12f54edbd02ed7735224

SHA256
ba5eb59755a0638427445cb4eb46a990373c3ffb8a63e57141f8d69d070aff23

SHA512
a8839d8b9ce068ab41cd85f86d5df8ac624394ffb7e9b1d73a8329a1e8f4a5e1b48f38465975a79704dafafed855a0310c5fcdade3d3f9ae52409028035cb0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b57628c70eedabe9616f20e390cb6f

SHA1
62458b686241129cc985773402a09ae575944ad4

SHA256
7cba7963e2f258cd2d17254f31472a372523753e63ab87093c665e35b262c2c5

SHA512
4ddde4d51bd6e93b234c319769bd7569fcc950c34e0b83b2f5f9ad310ccf8433f2dee42b9ce14db57e412bb1476adfb4ee6e84b50fb9ece7488fc30dc106371f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ead43192870252c897bc991856037963

SHA1
b705f57efa59f67614f41c736dfd99c7177c2e7c

SHA256
576252dd4c3780ae4435364868b59e1a6d4b1f49a0a4f33d3193253069fbf726

SHA512
72caab81a0a2c5825c22f0587ffbc5fdb81bd610343dcefd8cd93ca4ea5bccce827465d5ba5a2af492459171c70ec33c30d8c73bb7ba34239fc2181c9b687515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c259c92c7a20db99fa8df6c2fe553fce

SHA1
c11e6bb27903811abd4d0cdc4dc2656b3b2b5338

SHA256
6da7d1d97f7940e8c90dc3107beeb6062c5f10ed0a541b0872990fb1056b6ec8

SHA512
847858fe54988059f59b5605706c1d49003241796003988f7495aabf5950c0ff7896c443543723ea61615ab1c4eed73da5872abfff173fa331e4d9d7e925a87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc13433910ac068cafa7a078d10f45b

SHA1
b25974549d3f88ce0bf06c0b9b3a0697d9e49e35

SHA256
bc6fc701d8a9a8cde1da30faa3b57ffaacd47593690dc2a687f3e8704dd863ba

SHA512
33542a28f9c5eb9408118627690a9f252c4c1099b4dec87e5be714c11af8b3963c1f0c86571916714b0401c10e72eaf45f969f7d0b907fa33fe28e988d966694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b3b35d4a6d530db0878999557d47eea

SHA1
cd06eebb68b5abed7c1d0b78cc9704f904bbbf2f

SHA256
8c43740da8044da01f7dfe12d2d58533e9b396b85226ddbab7da9ae7dbb8c318

SHA512
4a13f98c4be9cde0676a0cc1652796676784b5e140d6c7ec4ef73171276c288cbc646374a341ad6f3495d9a23d3e0a870fee9f693ea09ba7b0ef3cff195da394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f2ecec2a0b7defd6b103f8111fcafa

SHA1
8a25d7498cd64bcf3c2381ada06008bab8136eac

SHA256
043ec67747d630351b15c44d22bf0b80e6f902386514dd27d4ac6a76fcb057e3

SHA512
d94370577edd774a4e2534d2d2aed1eb45dc99dd8cd72fd079301152a5306d2cafc71c40122c1ed4b1af1a9d658c3d3d7875ee158806dc95efda66497d13b20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AB6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\SysWOW64\wauc1t.exe

Filesize
24KB

MD5
b6ddaedbe89ed3721a759d36b4458037

SHA1
1b9dc20b35fc43af5a9cb01d197604713cac5110

SHA256
8720e91f2f4c8b8c4d9e9163fedb50252920bed3fec48b23416c2236ac09659f

SHA512
52fbe3d11a23596bc09897ffeb74d333d8a7f17a863180642849073f9852b449e5763933451be89dfe67338694fc79582887891167cad524d2bc65245fc5ea06

Download Submit
memory/2168-12-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/2168-3-0x0000000013140000-0x0000000013159000-memory.dmp

Filesize
100KB

Download
memory/2168-0-0x0000000013140000-0x0000000013159000-memory.dmp

Filesize
100KB

Download
memory/2168-1-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download