734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
149s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Antivirus Platinum/[email protected]
Size

739KB
MD5

382430dd7eae8945921b7feab37ed36b
SHA1

c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256

70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512

26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
SSDEEP

12288:kUWA3AheuswygKEOKlC0DaWL8ldxj1UT1fzosC2kyINJATi1v2yUQpf84i:kUWqistgKErL8P6VzosCfE6TNpf8D

Score

10^/10

evasion trojan upx

Malware Config

Signatures

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	antivirus-platinum.exe

Executes dropped EXE 2 IoCs

Processes:

302746537.exeantivirus-platinum.exe

pid process

2568 302746537.exe
2488 antivirus-platinum.exe

pid	process
2568	302746537.exe
2488	antivirus-platinum.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\302746537.exe	upx
behavioral3/memory/2508-14-0x00000000006C0000-0x00000000006D0000-memory.dmp	upx
behavioral3/memory/2568-17-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral3/memory/2568-40-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral3/memory/2488-38-0x0000000000400000-0x000000000040D000-memory.dmp	upx
C:\Windows\antivirus-platinum.exe	upx
behavioral3/memory/2488-42-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Drops file in Windows directory 10 IoCs

Processes:

[email protected]attrib.exe

description	ioc	process
File created	C:\Windows\antivirus-platinum.exe	[email protected]
File opened for modification	C:\Windows\antivirus-platinum.exe	[email protected]
File opened for modification	C:\Windows\MSCOMCTL.OCX	[email protected]
File created	C:\Windows\302746537.exe	[email protected]
File opened for modification	C:\Windows\302746537.exe	[email protected]
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259440379	[email protected]
File opened for modification	C:\Windows\COMCTL32.OCX	[email protected]
File created	C:\Windows\MSCOMCTL.OCX	[email protected]
File created	C:\Windows\COMCTL32.OCX	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeantivirus-platinum.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204292d85173da01	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{036F5F01-DF45-11EE-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a7a41c08ffda76602ec49d3576535470a33dde9f73159944feaa97909293531b000000000e8000000002000020000000b6ebc585ccac742dbefbcb4372e62086a8a6f47f2bdb9871eb48cf444fe85bb02000000062bc2059b0fc88b99489934f9a7097f4878271caa2f3b63f061b3ff22689ace2400000009dd74598474db9cd42557efeca95b0ad9d54871b0325ceb6a633fe6eeb0dce0eee295bb02fdf849ca61bce1aac62e4749aeb122fc0d03b198106d8449c5d1ce4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416281675"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000034d2c8567d651ca8ed9b9972631cd9cef19a76ae4dbb4213fd4d9e3722799493000000000e80000000020000200000008411e269f1f0572cdbdc7ef3b6854f40398b5fe48d4c642f6f903bbc835b8e9490000000f897419b80443a45f1d8b07db4bd0e82813c61933fa72099bac6cee2fd85c33b5fa79addd087a6a7ad9beefe4b4a41a5afecd4e107b3cd7c5b61a4ee43652fece9d1a5bd44963c3e41313691b5ec31a75c82a98c1940d7b48bfa7290ec2b7d8ad73c1c2897d72b5ab32e920788b68b4968d6e9df2ccec46a5c6c1ee849ddb083adcbfee1ac2ff7ba04acfdbda53aec174000000010dd449db7598d4f696f3760fc34c9e83827d805fec35c4ced98a51635565e9ce29f97977e587ef1d387f95fedf39c338f10aea29004f531f7687387083b88ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\ = "IProgressBarEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\ = "Microsoft TreeView Control 6.0 (SP4)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ = "DImageComboEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl.2\ = "Microsoft StatusBar Control 6.0 (SP4)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E953-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B66834C6-2E60-11CE-8748-524153480004}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ = "ITab10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2\CLSID\ = "{35053A22-8589-11D1-B16A-00C0F0283628}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ = "IProgressBarEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Version\ = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}\ = "IListItems10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0713E8A0-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1920 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

antivirus-platinum.exeiexplore.exeIEXPLORE.EXE

pid process

2488 antivirus-platinum.exe
1920 iexplore.exe
1920 iexplore.exe
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE

pid	process
1920	iexplore.exe

pid	process
2488	antivirus-platinum.exe
1920	iexplore.exe
1920	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

[email protected]302746537.execmd.exeantivirus-platinum.exeiexplore.exe

description	pid	process	target process
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2508 wrote to memory of 2568	2508	[email protected]	302746537.exe
PID 2568 wrote to memory of 2548	2568	302746537.exe	cmd.exe
PID 2568 wrote to memory of 2548	2568	302746537.exe	cmd.exe
PID 2568 wrote to memory of 2548	2568	302746537.exe	cmd.exe
PID 2568 wrote to memory of 2548	2568	302746537.exe	cmd.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2600	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2456	2548	cmd.exe	regsvr32.exe
PID 2548 wrote to memory of 2488	2548	cmd.exe	antivirus-platinum.exe
PID 2548 wrote to memory of 2488	2548	cmd.exe	antivirus-platinum.exe
PID 2548 wrote to memory of 2488	2548	cmd.exe	antivirus-platinum.exe
PID 2548 wrote to memory of 2488	2548	cmd.exe	antivirus-platinum.exe
PID 2548 wrote to memory of 2844	2548	cmd.exe	attrib.exe
PID 2548 wrote to memory of 2844	2548	cmd.exe	attrib.exe
PID 2548 wrote to memory of 2844	2548	cmd.exe	attrib.exe
PID 2548 wrote to memory of 2844	2548	cmd.exe	attrib.exe
PID 2488 wrote to memory of 1920	2488	antivirus-platinum.exe	iexplore.exe
PID 2488 wrote to memory of 1920	2488	antivirus-platinum.exe	iexplore.exe
PID 2488 wrote to memory of 1920	2488	antivirus-platinum.exe	iexplore.exe
PID 2488 wrote to memory of 1920	2488	antivirus-platinum.exe	iexplore.exe
PID 1920 wrote to memory of 1848	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1848	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1848	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1848	1920	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2844 attrib.exe

pid	process
2844	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Antivirus Platinum\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Antivirus Platinum\[email protected]"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2508
- C:\WINDOWS\302746537.exe
  "C:\WINDOWS\302746537.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\C062.tmp\302746537.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\comctl32.ocx
      4⤵
      Modifies registry class
      PID:2600
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\mscomctl.ocx
      4⤵
      Modifies registry class
      PID:2456
  - - \??\c:\windows\antivirus-platinum.exe
      c:\windows\antivirus-platinum.exe
      4⤵
      Windows security bypass
      Disables RegEdit via registry modification
      Executes dropped EXE
      Windows security modification
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2488
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://secureservices2010.webs.com/update/update.txt
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1920
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h c:\windows\antivirus-platinum.exe
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d6055802faeb0e50ebfbab3e8dfff9

SHA1
44259a94d7e94eb759bf11624c897394e3d48972

SHA256
dd2c7770404b52a6a85aaae5cb1341cfedcc16eb015f1f979cb764bff70040fa

SHA512
71879067007ccb40c365c36059a4379747f2a80e44f0caf2dda4051084d5dd7d27d8bc0d5da4de163423c1d8874d535e8a00d02a3bc4e3789034d881f0ac8f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d06f38521b51b691608730be1f5d5a8e

SHA1
429e7d49bcf09454a6cb2889b20890a49cf1a948

SHA256
aed8e58f99d977e75a8f2ebe3bdf51ac4fe2bd0a7c4c3b9ff5790f37ac1bdad6

SHA512
45aa7b124d8a4c5bba95d7d184646f1070e591193da56467bfb05f152ec6d2040f8b47eca4ef30dedb7f32e42f19f69776452891c7a477702aaad723ddf06187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f58e184fcdb256be98a380fc1df2788

SHA1
acb5db8d53a78ebcee32abaaa2d1d3e1cf386815

SHA256
952bfb80b18e9c89b8180b9932c4a2238680ff41707239e0864cb7e8f769ec90

SHA512
79b0792becb283f38c826bb3c8646af18ca41e103edc6cc66b862790c1716f8c7109423a88749938dc6bf65998e199e0fb89fb708cc31cdab00033ddc1a4e4d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44682cdbf570651c9dbae5019c1a1bc0

SHA1
5b15073604496f5a663e238e005c40962864aa38

SHA256
ede759e4df1f5a215ee772a18564d21fb6fdf639e7d843dff7360b6f724a3f02

SHA512
bdda49d7a4313184363bcdbdd1084ca20f623495a50ea16172dbd60b0c4522b65df71c76bce3bd0d1350dde04d70485f1f8e34ed911deffb0237985335f02753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228bc24c32092c75dcf299998246e37a

SHA1
44745b174d33b0e49d446d4dc8abc88d61aec053

SHA256
637e9007f897a5ee3a1ad220ae665987e729e390fbb74ddcf669ffd1248e4731

SHA512
bbd2bc0bf7abaaac68a3151e69f58da0d495db5000d5326f32ff94753ad3683cbca50781a582105eb9646a090d076952ff7d5dfba00f40f56d37e0ab8cf2769c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f22b65b890bc7302ddba262c0f5c9418

SHA1
ca5c08b0aa879ff68cc9b5a20e8f4c648c6efac9

SHA256
81e9ac55b6c4b868c9938c87928f32126bb387de6b8d238712a02acd5bbc0040

SHA512
62632923241974235aa6160932ab16540e1c5b4a611cb86b6d0783dd3ded8cd5ae17da078a79d28ed951d20af4b32b3ca3d3e07c596866e69c910dde9a103550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19ef6d7a75f0487c000491dd82d18de

SHA1
3a195f1496da379d09029db3a5ce214430ca8ac2

SHA256
d2e7ba55491c0b96b5211ad529876245b0303bf9124677efa3976f282c58352b

SHA512
3823591356cb984cba5429966670837bd6049dd0a5fb97cee3ba35ac38270e0c8fa36b6f7afd3d90b118b0eeb9eb0b57ec3a448c739f0842677c6687e52b0453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d6d2068ececa5c9e133109095a7568

SHA1
3f3b51b96938e92689cebec55763bb7807c51448

SHA256
b1fa1643d9c757038c678baa897d8871ad725993f48cf566fddd9cd5e4749f42

SHA512
9009f0c095cbfe12374eb2594c0ea005fc8b3cfd0cab215a6d7fc9080d5260e6533fb1e78cfd0a76f200b95e8c9b840f7c1cefb4092c8dd1e6b9a6c76982a767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5321bd61d333c3a0e119882919be6f6c

SHA1
7ada5710c62013952e01c952863089b6ce22cd19

SHA256
fb97d9d7d7acaeeb31d395ed71ff1a45571fa99a5e93fb67266636dbe843e33c

SHA512
991ed28ce84cc971d615856286068314a66ab85690bffd0a23c4192111a35d70f530dbe817e82a60d8da9c550e01d1988ca3fb33c228d9d67bd6f80ccbc0aaf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8f98ebe9c3d183ce753257ef02ff03c

SHA1
5344222074ad6d88636c446cdd07b9e74061c5b5

SHA256
6aef8f8f594fdd1236a9c01319291644c0eb4d6b0308a47f818c704387601ed6

SHA512
995d7befc978a2841f539c90950cb074c71456191951c0b95e27e4e8e32f3908ccf8eb7f8b009476d82cd1fc34a1ab74ff660d98328966c2567275f4bd572b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fb77dd309b8585a85923a5cfb7d1c1

SHA1
a5f5c5461750ded709ede8f13e19173b6bf1d387

SHA256
8676f6d659ae414717e4796e1fe27f7428913dfba923a8909dfc7e31814b2e6f

SHA512
0e7bd403e814d7a182c4e3184c177e4511537b86711e5fb7258a81da80b1d156e953837036e2665d5a36c7f69790d6153ac4bebc004ea33dc0f62c45135e3a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ef015d417ab20946cda1d7340575ff

SHA1
32a80b20e613a4309fda747de5632fd5cddc38af

SHA256
d96878480174101a7d41b0a4d08c470c56600c047ea226942793813bcd644de2

SHA512
e6226e5aa395fb94b17f7027027c0109be8cb138c033fbece8e60d8d359446e10278dc49bfdc3e4ee186b2dfbcee540d0e45b424a92449092b7027049ff7b71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86f2e3ceb0e1a3de492cc5622dd4f43

SHA1
a932ce2af9e09b24c73b66180b8f01b603effe75

SHA256
1357d305a0ee8cd507e78054fb56b1553b871b5c3601f7f3b701173fd91a0eea

SHA512
fa96aaa89e8097cabddec4ae1c49ce914b56a5af4c263030bd56ae2d94b6e4be14b384f838629ab3e18416bc2a825d007f57bb2ceb798f3dac6889ad49ee45be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844acfa52c17b0c9c45c1bd45b544833

SHA1
5b6e9ba5a64c13f2c5c93185791f51167c4de35b

SHA256
06d9a9e5532c4aa2da35daf20c4a5d654bb78ac31042980f3930e0fa409d5dcb

SHA512
1c4ed2aa7093a92b3058861872a191ad09f8e50c0c6c5cc082b3f827ce1ce3158903368528e7bfbe9549be0a06ec058a2f5fc6cbcdcdddbb98e86e4fc1b5cf5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcbd8b848c5398ddfdeeb0ccb530965d

SHA1
075aaad41a56729a8206f0ccc2811f0036b46691

SHA256
b6198bd1658f59e5bd01e6dd6768435e37d2a01cd6c9b015ab2ed987e2892408

SHA512
0192da7c7650df7162179205f0e3bb0ad73c942ae6204529a1d08f9f52b074e9da4c6af3513833a8e2647e9ed76ee34ce2d9d57ce8654f5e3f65a32fa939cd70

Download Submit
C:\Users\Admin\AppData\Local\Temp\C062.tmp\302746537.bat

Filesize
348B

MD5
7d8beb22dfcfacbbc2609f88a41c1458

SHA1
52ec2b10489736b963d39a9f84b66bafbf15685f

SHA256
4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

SHA512
a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD9B.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\302746537.exe

Filesize
22KB

MD5
8703ff2e53c6fd3bc91294ef9204baca

SHA1
3dbb8f7f5dfe6b235486ab867a2844b1c2143733

SHA256
3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

SHA512
d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

Download Submit
C:\Windows\antivirus-platinum.exe

Filesize
9KB

MD5
cd1800322ccfc425014a8394b01a4b3d

SHA1
171073975effde1c712dfd86309457fd457aed33

SHA256
8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0

SHA512
92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

Download Submit
\??\c:\windows\comctl32.ocx

Filesize
595KB

MD5
821511549e2aaf29889c7b812674d59b

SHA1
3b2fd80f634a3d62277e0508bedca9aae0c5a0d6

SHA256
f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4

SHA512
8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

Download Submit
\??\c:\windows\mscomctl.ocx

Filesize
1.0MB

MD5
714cf24fc19a20ae0dc701b48ded2cf6

SHA1
d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

SHA256
09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

SHA512
d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

Download Submit
memory/2488-38-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2488-42-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2508-14-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/2508-10-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2548-36-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/2568-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2568-40-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download