876ca2d3195a2bec847d41b0033115fbaab8c057d67596897db78eaed1297188

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c71e4e7e88a658c637e6200746dec3da.exe
Size

20KB
MD5

c71e4e7e88a658c637e6200746dec3da
SHA1

086b704065365d7e617ab09d39f72eceae48d02f
SHA256

876ca2d3195a2bec847d41b0033115fbaab8c057d67596897db78eaed1297188
SHA512

f40fa7a999df65760c5e88a585df52413b37e2c85fadc22b71ef7d1905ea7c7964912f93356886ad3b32154e017e8ccc2fcc2c87369bd9b09b1dff46069a39e1
SSDEEP

384:4l8q7E2vDsnwe6qyGPHK7pgymJu7UzFI1PuwNC7GjIP51:4Wq7E2FnqZWgTr+Gw1cD

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wuauclt.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMAIN.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMAIN.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAS.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32KRN.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wuauclt.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAS.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32KRN.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE	c71e4e7e88a658c637e6200746dec3da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE\Debugger = "C:\\Windows\\system32\\wauc1t.exe"	c71e4e7e88a658c637e6200746dec3da.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\U:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\E:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\H:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\I:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\N:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\X:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\Z:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\K:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\Q:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\S:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\T:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\V:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\W:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\Y:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\J:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\L:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\M:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\O:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\P:	c71e4e7e88a658c637e6200746dec3da.exe
File opened (read-only)	\??\R:	c71e4e7e88a658c637e6200746dec3da.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	c71e4e7e88a658c637e6200746dec3da.exe
File created	C:\AUTORUN.INF	c71e4e7e88a658c637e6200746dec3da.exe
File opened for modification	F:\AUTORUN.INF	c71e4e7e88a658c637e6200746dec3da.exe
File created	F:\AUTORUN.INF	c71e4e7e88a658c637e6200746dec3da.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wauc1t.exe	c71e4e7e88a658c637e6200746dec3da.exe
File opened for modification	C:\Windows\SysWOW64\iexplorer.exe	c71e4e7e88a658c637e6200746dec3da.exe
File created	C:\Windows\SysWOW64\rskbrskb.dll	c71e4e7e88a658c637e6200746dec3da.exe
File opened for modification	C:\Windows\SysWOW64\rskbrskb.dll	c71e4e7e88a658c637e6200746dec3da.exe
File created	C:\Windows\SysWOW64\wauc1t.exe	c71e4e7e88a658c637e6200746dec3da.exe
File created	C:\Windows\SysWOW64\iexplorer.exe	c71e4e7e88a658c637e6200746dec3da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "1855662272"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23EAEF51-36DA-11D6-85B2-6A83D32C515E} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe
2044	c71e4e7e88a658c637e6200746dec3da.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeSystemtimePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeBackupPrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeBackupPrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe
Token: SeRestorePrivilege	2044	c71e4e7e88a658c637e6200746dec3da.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2128	2044	c71e4e7e88a658c637e6200746dec3da.exe	28
PID 2044 wrote to memory of 2128	2044	c71e4e7e88a658c637e6200746dec3da.exe	28
PID 2044 wrote to memory of 2128	2044	c71e4e7e88a658c637e6200746dec3da.exe	28
PID 2044 wrote to memory of 2128	2044	c71e4e7e88a658c637e6200746dec3da.exe	28
PID 2128 wrote to memory of 3024	2128	cmd.exe	30
PID 2128 wrote to memory of 3024	2128	cmd.exe	30
PID 2128 wrote to memory of 3024	2128	cmd.exe	30
PID 2128 wrote to memory of 3024	2128	cmd.exe	30
PID 3024 wrote to memory of 1216	3024	net.exe	31
PID 3024 wrote to memory of 1216	3024	net.exe	31
PID 3024 wrote to memory of 1216	3024	net.exe	31
PID 3024 wrote to memory of 1216	3024	net.exe	31
PID 2044 wrote to memory of 2540	2044	c71e4e7e88a658c637e6200746dec3da.exe	32
PID 2044 wrote to memory of 2540	2044	c71e4e7e88a658c637e6200746dec3da.exe	32
PID 2044 wrote to memory of 2540	2044	c71e4e7e88a658c637e6200746dec3da.exe	32
PID 2044 wrote to memory of 2540	2044	c71e4e7e88a658c637e6200746dec3da.exe	32
PID 2540 wrote to memory of 2668	2540	cmd.exe	34
PID 2540 wrote to memory of 2668	2540	cmd.exe	34
PID 2540 wrote to memory of 2668	2540	cmd.exe	34
PID 2540 wrote to memory of 2668	2540	cmd.exe	34
PID 2668 wrote to memory of 2696	2668	net.exe	35
PID 2668 wrote to memory of 2696	2668	net.exe	35
PID 2668 wrote to memory of 2696	2668	net.exe	35
PID 2668 wrote to memory of 2696	2668	net.exe	35
PID 2044 wrote to memory of 2708	2044	c71e4e7e88a658c637e6200746dec3da.exe	36
PID 2044 wrote to memory of 2708	2044	c71e4e7e88a658c637e6200746dec3da.exe	36
PID 2044 wrote to memory of 2708	2044	c71e4e7e88a658c637e6200746dec3da.exe	36
PID 2044 wrote to memory of 2708	2044	c71e4e7e88a658c637e6200746dec3da.exe	36
PID 2708 wrote to memory of 2528	2708	cmd.exe	38
PID 2708 wrote to memory of 2528	2708	cmd.exe	38
PID 2708 wrote to memory of 2528	2708	cmd.exe	38
PID 2708 wrote to memory of 2528	2708	cmd.exe	38
PID 2528 wrote to memory of 2808	2528	net.exe	39
PID 2528 wrote to memory of 2808	2528	net.exe	39
PID 2528 wrote to memory of 2808	2528	net.exe	39
PID 2528 wrote to memory of 2808	2528	net.exe	39
PID 2044 wrote to memory of 2408	2044	c71e4e7e88a658c637e6200746dec3da.exe	40
PID 2044 wrote to memory of 2408	2044	c71e4e7e88a658c637e6200746dec3da.exe	40
PID 2044 wrote to memory of 2408	2044	c71e4e7e88a658c637e6200746dec3da.exe	40
PID 2044 wrote to memory of 2408	2044	c71e4e7e88a658c637e6200746dec3da.exe	40
PID 2408 wrote to memory of 864	2408	cmd.exe	42
PID 2408 wrote to memory of 864	2408	cmd.exe	42
PID 2408 wrote to memory of 864	2408	cmd.exe	42
PID 2408 wrote to memory of 864	2408	cmd.exe	42
PID 864 wrote to memory of 2804	864	net.exe	43
PID 864 wrote to memory of 2804	864	net.exe	43
PID 864 wrote to memory of 2804	864	net.exe	43
PID 864 wrote to memory of 2804	864	net.exe	43
PID 2044 wrote to memory of 2680	2044	c71e4e7e88a658c637e6200746dec3da.exe	44
PID 2044 wrote to memory of 2680	2044	c71e4e7e88a658c637e6200746dec3da.exe	44
PID 2044 wrote to memory of 2680	2044	c71e4e7e88a658c637e6200746dec3da.exe	44
PID 2044 wrote to memory of 2680	2044	c71e4e7e88a658c637e6200746dec3da.exe	44
PID 2680 wrote to memory of 2752	2680	cmd.exe	46
PID 2680 wrote to memory of 2752	2680	cmd.exe	46
PID 2680 wrote to memory of 2752	2680	cmd.exe	46
PID 2680 wrote to memory of 2752	2680	cmd.exe	46
PID 2752 wrote to memory of 2424	2752	net.exe	47
PID 2752 wrote to memory of 2424	2752	net.exe	47
PID 2752 wrote to memory of 2424	2752	net.exe	47
PID 2752 wrote to memory of 2424	2752	net.exe	47
PID 2044 wrote to memory of 2600	2044	c71e4e7e88a658c637e6200746dec3da.exe	48
PID 2044 wrote to memory of 2600	2044	c71e4e7e88a658c637e6200746dec3da.exe	48
PID 2044 wrote to memory of 2600	2044	c71e4e7e88a658c637e6200746dec3da.exe	48
PID 2044 wrote to memory of 2600	2044	c71e4e7e88a658c637e6200746dec3da.exe	48

C:\Users\Admin\AppData\Local\Temp\c71e4e7e88a658c637e6200746dec3da.exe
"C:\Users\Admin\AppData\Local\Temp\c71e4e7e88a658c637e6200746dec3da.exe"
1⤵
- Sets file execution options in registry
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop McShield
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\net.exe
    net stop McShield
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop McShield
      4⤵
      PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KWhatchsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\net.exe
    net stop KWhatchsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KWhatchsvc
      4⤵
      PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KPfwSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\net.exe
    net stop KPfwSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KPfwSvc
      4⤵
      PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop DefWatch
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\net.exe
    net stop DefWatch
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop DefWatch
      4⤵
      PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop KWhatchsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\net.exe
    net stop KWhatchsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop KWhatchsvc
      4⤵
      PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "McAfee McShield"
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfee McShield"
    3⤵
    PID:2512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfee McShield"
      4⤵
      PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop DefWatch
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\net.exe
    net stop DefWatch
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop DefWatch
      4⤵
      PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus Client"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus Client"
    3⤵
    PID:2640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus Client"
      4⤵
      PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus"
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus"
    3⤵
    PID:2760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus"
      4⤵
      PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Symantec AntiVirus Definition Watcher"
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec AntiVirus Definition Watcher"
    3⤵
    PID:2780
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec AntiVirus Definition Watcher"
      4⤵
      PID:108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "McAfee Framework ·þÎñ"
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfee Framework ·þÎñ"
    3⤵
    PID:2336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfee Framework ·þÎñ"
      4⤵
      PID:616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop "Norton AntiVirus Server"
  2⤵
  PID:804
- - C:\Windows\SysWOW64\net.exe
    net stop "Norton AntiVirus Server"
    3⤵
    PID:1896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Norton AntiVirus Server"
      4⤵
      PID:1952
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\packet.dll /e /p everyone:f
  2⤵
  PID:2200
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\pthreadVC.dll /e /p everyone:f
  2⤵
  PID:808
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\wpcap.dll /e /p everyone:f
  2⤵
  PID:1612
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\npf.sys /e /p everyone:f
  2⤵
  PID:988
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\npptools.dll /e /p everyone:f
  2⤵
  PID:996
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\acpidisk.sys /e /p everyone:f
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\wanpacket.dll /e /p everyone:f
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯ /e /p everyone:f
  2⤵
  PID:1700
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1472
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AUTORUN.INF

Filesize
145B

MD5
43a741a56d6407be6c4190a29c26b39b

SHA1
fd4f5a3732fa9c9426428d8100812cd33ffb4e03

SHA256
a094953255a5f2815a96bfddf420056e42abead85111df8362adb1de83d81dc3

SHA512
5b75cb17a44f14eacf6ccc10fc455a4945872a152aecb5f1ea30b0bead88501e41711103d8f64e9a455ca02fe2281fc1771efc09fb025bd3d0884975c79fd5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de92a0512f6f9c1d301187d46f54a22

SHA1
6ac030e17247f9f472e5b25f79e76aa8a133c8db

SHA256
5b30ac15fe86302d3b943057513d0631c5b2f40be93dc8e01dbae903ebff3490

SHA512
76865d0994f32a270f7f66bdf6399487e4c152c8bf0be0d8ecaecf17961ca9f5834da05f1b70b0c8e83d589d1dff6c62cd4d07a5df31e8dd195ecb675256891e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17384cfe0153fda8109bd0ad0643108

SHA1
c8efd8281446501b5b4015902d55493e528f2bf5

SHA256
e634f575629485f724d4e08ffcc2c4fa13ac0b211ad18da2b61603ce405ae462

SHA512
e830c01b033ebd45c5f659f24a724d43a508adccd2389d23870a43eceeed25a437e1b11cdb1c0600ad10eaf9c11c7d152ca22994a3ecdb993b7f1064aab123cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bba0929a7e2d8bf00660023ed242915

SHA1
6258c13b007abe8fb5af7e8c498003c32122247a

SHA256
8c4d49afedfb432570fce23d74a1bd6621e0fb6096d0476dbb0ae6cc89200dfb

SHA512
dad501b1d857eb9d6e5b2f2e1527769ae2c1a37e5e1358220282434428aae6b64def04d92f5ed88fde076cb83ad8c2ce5a98e98d54989602d90deb4aa7a73b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65c5fa24ed513eb8145637c368db0c4

SHA1
e8a7178058bb35a6345674e4d2c60a2f9f997f7b

SHA256
5a2bf17e8e9786ce88b52aba5a9bb80d0476faad5f4fd6fa6763e5efbbf47825

SHA512
e39767536bf651b0f851d28dd2c77f24a8183636705d75cf1d3ba9b27e1da8829b77e2a84d6318e33ec6c4db629bf238fc8486f2eaa7bfa2008cbbabd1ca86a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed63e5a40b16ca62ee19fdd09ef0226

SHA1
0a2b3190b14c72e58698c48e37a6e902ad645e95

SHA256
1d56e716f1887f090048ce4f33bc5301abda236962b6a2772f66fb2a9d715571

SHA512
1152e921ed16a7835e5c5acf1611055808262849b1f598494a0df68f40427ceb5f9737724c788177d63037b7764ccf4f7d29a535b0154e2f935f7b268d9f5387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594017c574a8d8c6cf79602c8d3ab67f

SHA1
e7d96745bb5a04c644a1a353bca836d58ee9157f

SHA256
88c309ce2cb607b6aacf6b121bbecf278f13508fec57dba7e5af94129ee01ddf

SHA512
39b1001dddef09da48c181128b057c5b26ff128cdf70ec42760419d36303ed68458121addcc13ddd3142cc2095917009061b8920ee9a60587120783f9cba32b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53006ebf743ece83239c5d54ef0bf854

SHA1
210e8975c6dc9d13eaf1605eaa322d60d661cce4

SHA256
da7eef3359055d5eda8a7d49fe8cff3f4c4549690b44df931e8da62ecd6706f8

SHA512
a6b8c3027e37906fc1404f0d1ba55edf1f9b2b1f3534a53ae49f5270656f644aae17d5be15632801d92dd6cd2c25b23dcbd83c3b5b1ca5ccc9dc7c46ddccdce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92aa83ebaed57c6993c24726f6a6cdfe

SHA1
866acb9f315dce5e06025dda2b91d654d5d261f5

SHA256
e38c0e14ea0783531cd359028af5c41e394976d48633d2fb8e614b9bd4ae8d3d

SHA512
4d1911ef7c17f743ecff090af65e85e5235acdb764e1fff4f51e9720c0ba97ce8478008a07696a367a9d29fcb168b210419bbcf38fa81884dc76aa84d27eea6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6e556b2ced0e239e9f79163afd8d93

SHA1
14f0c2ad5f2717a00eff0f4b1d77e7f6a2962961

SHA256
d87727c84df78de8b1be7ea8e7e7227289e11c14ae837300dea7b96a658236d3

SHA512
d39a067b8e11e09621ad1165915dea19ab002534791a7f3fba8c2d7a1710375c02a2e24059f3eda83f826c3fede0597d1731cf220a815f8ea995f1eb2b9a61a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
099318989fc9fbc5406563ae5803b280

SHA1
a5b054580fe98900f6a6a58fd459da6351f8ac2b

SHA256
8f4f3183ca01b7b88fbe882a30a2184b5aac8b5c56a8e339212f482da5604222

SHA512
0e05d7df5be04b56925864327afb8e28a3d577a03ce2c028cd3abfdd2cd75c689b2d56d8c16ed76841966c3abfa7b3d40fe5af09dfd92803c843c9e281290457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
178ab7929ad9acb32ba3369d3cc5787f

SHA1
73f3d2e67e75614a4611c93bf61d011cb527943b

SHA256
91c05e16831e8433f702f47fcaf924b68ffbb58b6adafe5d9e09d4674d1e09c2

SHA512
21e684c549de03367867b302c5b0497c4523be5226337ca4337f249952c4d3871f560be12608442fac9e24629533984bed401b9678ae4c2367db463bdebcc9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
768d97927538a1271c6933cfa4527cfd

SHA1
30f5d95d9b871e2a8bd7ce8073916274407273bb

SHA256
d6993f83f6d349b8390ffd929be75e4e14e534b0fdc594381c5cf7933fa3e6d7

SHA512
9f2e9c2b9a71d8e5996cc7a675616c1ca8eb662bf5bb1e4e97a6caa5f74d36426ba94dafeb6eef575b68f468509df9499cc3951f6cd08553cb4fc042defde681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccae8f06361636c7cb7b77ec85e7d13c

SHA1
5a6527dec3efff227175de164087686a4f6c2c7b

SHA256
24b34082a15beb2b7d6206e14b882555455d9c1dff275b4e08d3ae955f06197e

SHA512
e5c887b6c0c2f214c39e2e555ca70168913f987cf4e611e75f15479195259ab81dc3f41fc6b413762836d8bc8a62d1ac2a4a6b0b45a560cbece29f22a1d71d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e52774a455aa81649dd9ccccb19a1244

SHA1
3cf30b2a46d26cb176c0a5ff9357c24adb403420

SHA256
9ca3ac113b88097b7f0760d168744eaa0f97441c3d15f3f5e03eeadde01e78ad

SHA512
9c96957a4f646c867ee3af8b5177565ffa018e0c40f90c412c5757183e2be2b4c1d412b31065dd01e1fe94ccf72e62f8702aaffa84be188d87955f5a4237886a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2664ac7259d0711b26c2a847d72952c

SHA1
04fcb0c886b6d2abaa5a656bb59913f313dc9e7e

SHA256
e05dc18cf32eb39d42d2fc3ecc99a0fa31f7232c5727584de2b414393b8c8c11

SHA512
3dc3da28e4e22ec2a0b6e78cc9d471f9192d47892a75611c8c00ff8132322f4672cac8dbd2dc829b77dc7525af305c27c1c1da872a0265b65d50c56f19d9a912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ed64cf04c26376a7ba1bfd08349a08

SHA1
ad753c4a90a5262dfdee15ce0c3c33370e73ec2a

SHA256
9c857c1d44c85d636fdfc816aba2a05fa42dea833efa2be01cd3f8469e31404b

SHA512
1eb7602ee174fbff6b80d1bf3895f9248a8f2e421fab7406114833eac7bb708babb5daa7a1a210ffe7b6694a42b776c977403820c80d5faaf95f26e0291c4aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b694ac3a39816afc5f92cf0d50511747

SHA1
268e3200386496d4c07da860177efbe2356d45cf

SHA256
11e5766d2d57ebf1e6ec59e92aa0b852af1e5201452a4221cbf4e82ff5674a3b

SHA512
9431ee9c990fa4dbce759932f27e78f9f2de936aedf9ea4219f9fb9e6ff9de1d2c65ebe4a09e53efac93018728eca47ba6ede449b9bb3af54e1caaf8cdaa769f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a98733ae5e95d1e7cb26cd24092c5fce

SHA1
11f2edde3dbae22dc8ff23e6297a03e427ac38c7

SHA256
c3c56a96bf7024c703315c4af2a8b05f7d9dc3082a2e246077c8aff8164ef7d9

SHA512
9cedf695953db80b27c54a34ed18c80cc11db27ceda5d1788a0ebd37cd1054602695132371e423eaea755416b6700c6b45c8da8fb60969887e58c9416fe2e39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8ba35d96f27c70996de13df1332d92

SHA1
b4afa101ac40e43963b91169b8c5044992f8cef6

SHA256
de58e9f0c42bfc797f5d9298d474df5313deeb92e2c882958dad85cf7eebdbd3

SHA512
0a635d852af83b1013d695db1ef3064b756854e0f9291a82ddb1794870bf684b4acd1196ba615261d4cd55b969a7571e385c58a4e320126cf6e9566d37cf0af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be362fd4b8b06cc8f018a5f0b83b85ea

SHA1
37a5f5ad32996348788244cab720be854dd53703

SHA256
21dfd906e2050555845e349e0755bdb4a827e2e9c4fd26bfefd495fab627b6a3

SHA512
c345395db7259d89a72216ac321a6467879382cbf605de0c33a7462d1e043cc25a2e6a699b364efc975e036c4c8ea360c927514a05d65e89a7cb2a8e7369e2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a02e6d67c7458381c6e7ae8ce55d9120

SHA1
444032208edd225ed1818a521dcd1d5546675246

SHA256
f8daa25f4615ffab00c4277c89c243f95cc8d8da9737a8043be807744537480b

SHA512
a3a9c48af70fd6d1ae2ac8c1e684608407a5b1523b6af721bc13c8400125394c9ac7963c3fb8a71e6d054c002945f1f54c377711301c321ddd6a66db92628e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C56.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D54.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DC4.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\SysWOW64\wauc1t.exe

Filesize
20KB

MD5
c71e4e7e88a658c637e6200746dec3da

SHA1
086b704065365d7e617ab09d39f72eceae48d02f

SHA256
876ca2d3195a2bec847d41b0033115fbaab8c057d67596897db78eaed1297188

SHA512
f40fa7a999df65760c5e88a585df52413b37e2c85fadc22b71ef7d1905ea7c7964912f93356886ad3b32154e017e8ccc2fcc2c87369bd9b09b1dff46069a39e1

Download Submit
memory/2044-0-0x0000000013140000-0x0000000013159000-memory.dmp

Filesize
100KB

Download
memory/2044-10-0x0000000013140000-0x0000000013159000-memory.dmp

Filesize
100KB

Download