8dd1796ca7db68bc3e7daa76b17b71e162f287949185695cbbf33833ad1cc67c

Resubmissions

19/03/2024, 19:18

240319-x1bmcscg49 8

19/03/2024, 19:14

240319-xxqxwacf52 8

19/03/2024, 19:13

240319-xw6a6sde2x 8

Analysis

max time kernel
1073s
max time network
862s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Email-Worm.Win32.Magold.exe
Size

235KB
MD5

d40a18b03a699f63ee469a7b39ae86a7
SHA1

45eb3a218beded8bc4faa70d6ef5519bbddcb749
SHA256

8dd1796ca7db68bc3e7daa76b17b71e162f287949185695cbbf33833ad1cc67c
SHA512

d4a3f67cee28cd146d9c642ae64f2f39be0d2e2c386f5a0c21eadd89a010a8b3997406f662ed598d2fbea600f1044235e1e485c165da2a6e06e86e2f3b75ec1a
SSDEEP

3072:tGY6jEqdhFidUwFoRXbMRT4NIcmvyk2GqrUVksD3XRmY1n188bcXzwQsEv6/v49S:tGNrXcdUwQMRkNIc1rUeORmN8FpgL

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2356	rave.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Email-Worm.Win32.Magold.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-0-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/files/0x000a000000012241-6.dat	upx
behavioral1/memory/2356-10-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2444-8-0x0000000001FA0000-0x0000000002046000-memory.dmp	upx
behavioral1/memory/2444-15-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-16-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-17-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-19-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-21-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-22-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-24-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-25-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-26-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-27-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-29-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-30-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-32-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-34-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-35-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-37-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-40-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-42-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-43-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-342-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-2159-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-2337-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-2949-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3212-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3213-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3215-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3216-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3217-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3218-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3219-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3220-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3221-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3222-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2356-3226-0x0000000000400000-0x00000000004A6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\raVe = "C:\\Windows\\raVe.exe"	Email-Worm.Win32.Magold.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	rave.exe
File opened (read-only)	\??\S:	rave.exe
File opened (read-only)	\??\G:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\N:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\R:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\L:	rave.exe
File opened (read-only)	\??\O:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\P:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\V:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\H:	rave.exe
File opened (read-only)	\??\K:	rave.exe
File opened (read-only)	\??\M:	rave.exe
File opened (read-only)	\??\I:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\L:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\M:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\W:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\E:	rave.exe
File opened (read-only)	\??\G:	rave.exe
File opened (read-only)	\??\N:	rave.exe
File opened (read-only)	\??\O:	rave.exe
File opened (read-only)	\??\Q:	rave.exe
File opened (read-only)	\??\Y:	rave.exe
File opened (read-only)	\??\S:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\B:	rave.exe
File opened (read-only)	\??\J:	rave.exe
File opened (read-only)	\??\H:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\R:	rave.exe
File opened (read-only)	\??\X:	rave.exe
File opened (read-only)	\??\T:	rave.exe
File opened (read-only)	\??\W:	rave.exe
File opened (read-only)	\??\E:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\J:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\T:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\U:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\X:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\Y:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\Z:	rave.exe
File opened (read-only)	\??\P:	rave.exe
File opened (read-only)	\??\U:	rave.exe
File opened (read-only)	\??\A:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\B:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\K:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\Q:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\Z:	Email-Worm.Win32.Magold.exe
File opened (read-only)	\??\I:	rave.exe
File opened (read-only)	\??\V:	rave.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\raVec.txt	rave.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Grokster\My Grokster\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Bearshare\Shared\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Edonkey2000\Incoming\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Gnucleus\Downloads\Incoming\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Shareaza\Downloads\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Morpheus\My Shared Folder\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\ICQ\Shared Files\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Edonkey2000\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Limewire\Share\Maya Gold.scr	rave.exe
File created	C:\Program Files (x86)\Gnucleus\Downloads\Maya Gold.scr	rave.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\raVe\Maya Gold.scr	rave.exe
File created	C:\Windows\raVe.exe	Email-Worm.Win32.Magold.exe
File opened for modification	C:\Windows\raVe.exe	Email-Worm.Win32.Magold.exe
File created	C:\Windows\Maya Gold.scr	Email-Worm.Win32.Magold.exe
File created	C:\Windows\raVe\Maya Gold.scr	rave.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.offspring.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\offspring.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.offspring.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\offspring.com\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000e1386fdc7ae2d743e245a2665f34ba7aa22624982f80cb15a93fcb6efcf9ff6e000000000e8000000002000020000000aa82c03993d6395e030e7eec781778ebd342bb97a4f3f67c5cfc04fbbb13103b90000000f349d6686941127e8586e6d91ae61af12bafa545075453a4ceb4c75663768fe47ac733ac4962f06c9b67612807a19ee3c012db6285b092d0dabbf6bde9e9b786380921f8d3f79e2d3d1672a53e1fa7f3dc9c2307a4644c40c96f6c3b595ce21a910bf2783b76563ac0a8ee2b264322f9576aa305daaa6bf1cc9cf49ae338f4b7797362abd6fc65a80bae827f36d5ec7e40000000a8cc32a4f1747ed280fbf42d98c40c6f36f67ff3c32c0553162d3cdf33a34d08a7e014643d0f11353361f84b47984386b41758e3d107a1eafb370490e70be504	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\offspring.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000435eaf728058f7a55565660d32db279a0b2b89d8ff0cda81fea92ed392c037c1000000000e8000000002000020000000aa33a57133841831251bb8a40b5c7a1cb713d4fe9ac5ca3fc8fd6ee7eeb4d9052000000058b9c1a149e4c838c6290497f6e9b880ff9dee3b958cb24dedcf82e69b5b69844000000041db43add2a0db83d69c688efaccd2a361bec85a182e2744c448a342f4c84f0592cf8d92eaa47c481524e1be517a9442fc8293dd7bbfea87ca7aa487fb995721	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06b5299327ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417037852"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\offspring.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3701491-E625-11EE-B87E-66DD11CD6629} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.offspring.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "331"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "233"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	splwow64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	splwow64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	splwow64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	Email-Worm.Win32.Magold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\raVe.exe \"%1\" %*"	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	splwow64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Email-Worm.Win32.Magold.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	splwow64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	splwow64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1052	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1052	iexplore.exe
1052	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2440	splwow64.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2356	2444	Email-Worm.Win32.Magold.exe	29
PID 2444 wrote to memory of 2356	2444	Email-Worm.Win32.Magold.exe	29
PID 2444 wrote to memory of 2356	2444	Email-Worm.Win32.Magold.exe	29
PID 2444 wrote to memory of 2356	2444	Email-Worm.Win32.Magold.exe	29
PID 2356 wrote to memory of 1052	2356	rave.exe	31
PID 2356 wrote to memory of 1052	2356	rave.exe	31
PID 2356 wrote to memory of 1052	2356	rave.exe	31
PID 2356 wrote to memory of 1052	2356	rave.exe	31
PID 1052 wrote to memory of 2620	1052	iexplore.exe	33
PID 1052 wrote to memory of 2620	1052	iexplore.exe	33
PID 1052 wrote to memory of 2620	1052	iexplore.exe	33
PID 1052 wrote to memory of 2620	1052	iexplore.exe	33
PID 2356 wrote to memory of 2440	2356	rave.exe	36
PID 2356 wrote to memory of 2440	2356	rave.exe	36
PID 2356 wrote to memory of 2440	2356	rave.exe	36
PID 2356 wrote to memory of 2440	2356	rave.exe	36

C:\Users\Admin\AppData\Local\Temp\Email-Worm.Win32.Magold.exe
"C:\Users\Admin\AppData\Local\Temp\Email-Worm.Win32.Magold.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\rave.exe
  C:\Windows\rave.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.offspring.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2620
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x574
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
4d6b973b0e73710bbeaa90597b483877

SHA1
45ee6cab48bcf6185e682e5295dc50942d8ef3d0

SHA256
1ec1bf5699e553c7f6559dbaa68440b158e39b79d8e48f564f8e1555730b93f2

SHA512
9c01393d750054f7a6ed92ac332cee10b0d920c466019f140bd15e7554e8a2ebad645bf96ea95ab40e08c72950f92591ee4f1bd51c1110bba88a6ee602b30526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
726ddbd769e4cb1cadbff5f1097e8662

SHA1
0bd57b0195fef48434b4e4eb124328f8ac3ebf90

SHA256
efc2e94afd9de5184ac41701b44f13a2f0036c70b0f7b3224b077545fbdab559

SHA512
261e4500ddaeb09e277a4a55eef09b678378d9aaf030a3017445a58d7930b3289d7b5686c485ee214574b6d486a74e78215af082ad9cc9c3bc5ce0ace39a2d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
259267de4e190f6bc3f2ac80cab5f8ae

SHA1
3bded18702ded3a6970cb3e5a19a1fa22ccaae6b

SHA256
2ca3554c98e416e1482bf759486c94fa7a029f9c0297b7318ad3cb36983db47c

SHA512
7838a2b7cacdb0c2def6a353b827b9feab290da81f2bdaf6525c3be26e4525efa01638ae9be401ff47dcd448f54eac71bfd6993a44b5319e1839cdf1ea3a14c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6beece46cb9cbde5ccead09105f05d4c

SHA1
3f19411752720aae83ea24d1549642ae2351ef11

SHA256
b360abba4f729d018db68a7c64ae5c2825acec5b453aa7bd22d547c3c5fc3294

SHA512
fc0b859b5cb807f79c467cebc006c1abcc4cc4821e017db6160cb63df55fec7b6093c219262342405132fffedee13da256e768dfcb609891c1df6b79175a1b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d53f7b505b1361df659fb502078ab9

SHA1
35c416f374e3f5d299516089912de0cbd3b756a2

SHA256
d87c04b6b65af43f6a24b3a0aeffb6aee6828aed0284e302d85dc9109ecd0f23

SHA512
9d3fbf7f637f0b31d590cd32643c0225a29b52667b726ef87dd7446e5095c0dfd8e998b8356e56558057fc9125ea7d2b442a53a3bf343967218d038c0d57e51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddff49e84620b6461a310f29b311052a

SHA1
0a30071e42ef64512571b9d144d1ec7f686114ee

SHA256
85d07d8d389d4b296d02c9135b96e70da9b25b0c45041a29ab3f45f1ff706a79

SHA512
c5574f9a5ba7dcd16b3a79424a72fc11f1eba568299f75f76391643f35a1e51d258f1926c2557e885ebc4454fab7a6c0ce9fb411c87c93f9caa693d732f1ccda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e91730ce7023462b231597ff5aed0a

SHA1
306b752a9d184c84202d105be780bb8533c2343c

SHA256
7b94d869657ec46415ed17219f7532915205ba9523389313dad3996ecf6e096e

SHA512
f817177f3a66b6ea8d0d6eeb439e27721908424508dab27bd8c768b3f775a6b69a0150263350cb344a0e5dbbf8d5e45eb177fdd59932d0ebea024188f6757dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d17aa87b94b2839e7226f90337ce85

SHA1
7f9db26837597b6df92aae095e68eb855969bd03

SHA256
678d0ab75f70b3f7835d200062dd401adc279cc69293ce4e2c188a03232c48bf

SHA512
c82962886fc70c91a962db7d9efca63f475841e76792ddbffdfb0041d05ead233a5680def31abf77c1cd4d270e285c413600c6f44288d37b528b456bf4204056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc81c6076acd33d6d336ebd0f3afd12

SHA1
723051a215af7e561ef2ba1d2c4b498282cbbee1

SHA256
baa9bfb4b0bf4af98b8392c3ac31af9e3ce7466f09aabbeaaf91c88c7158566f

SHA512
da20b6389ec93e397ca1150f43564fe4ab01c81748181b14e44f0b6976684b4dfaa9c1da9d074c60f891e49f263a62106cae9bc0c76414a4e95942ecdf4406fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e71d5325034db3ba9efa7df6b2fb7c0

SHA1
8e7adaf9742fbd83432e1931ac25f378c6413b47

SHA256
7e794e0e119e20dfadf1b47aa8417efe28b992a75d1652c398e242aea34198ec

SHA512
6ea21e0ca7655ee843d6e2459d67c8741c43db25b4adb424fde041d9ccc9e67ed85f19b308ff988062ff7ffb8241cf9b8ec836e7539225a4282dde7343e0b468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dfc85ca304324818ca1389d7acb77d2

SHA1
c8b0be4973be4e305d875f3abe3a65ad611d75ad

SHA256
39a948cdb31bf2cc7ba384b3c78c6988ef788c711c5066a153fa17ea9ceb1033

SHA512
b0125de1807c1d9fa380c9ba7ccb945e0f2196b61b42ff4a624573ee006f3b1bc66642333626fcb75a00c13030cd52118bd2233c6d77c23871b9deca00b8057b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8974a038427631196eb03f2581ccde3

SHA1
58d1e391e72e036dd98874708187627265383a41

SHA256
05e055bc07d033d258e80fe6f53e0e4cd2f3206dc7f6287fa56567075cbce25c

SHA512
777e23ad42aa0a89c94ff254a5c9cd6d8a5c9379a8889f36d92085cf3e729301abefa1c51adc62e0df972c757414370bf975813b7a3ef2e5ea77d4d1be24ae85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd8ef7092f952e34b23128ecc207e3f

SHA1
21b6802df4fad5266ebceff55d8fa21a8762f5e6

SHA256
4ecd6024c86a52399a5ae7d90d00ce19a4bff442cbaa3f41e042bc67af31773f

SHA512
cdd1a8dd4f744d4cef2c92d27358bebd5dd2b871993c192e781ae66a3b91adf1d956952ced22168f6e0e4cbf8b7caa9d3a8196b0ee6fd8c70eb739318ecfc983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05581b07abdccdb796b6273e7dace26

SHA1
636f93ca4a3442fcbe58aad172417161f272d1b3

SHA256
8bb14c1ad2281d4e7b56ef050c86d9604c99724c796a2e8bf3c886bec88d07d9

SHA512
142ea9594a18de0d299df7280d8292a9d2c42d2ac7a0f10305d811280d29b89247555f374e7c6d0774b2fb2610cff6d180ffd147c454bad8f5df792f25d3433e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ff3b44ef15446e1123aecf7ac800b6

SHA1
bdc65ae32e3a11dc51df809b731ce1700d0d4639

SHA256
2aa33535bcf9c9b83cb60aefbdf110b053e4cd8b2b5cde3c2d123b9a84b98fa5

SHA512
5404cb1d05b80e1fac396724b05593b5c1bd8bb83db0317cb782c663597b5f6a57c3a49bb72e333a745ec93cb3eb39e0236d76f921047d2ae0430faffc24c42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
169944d82a65340c83648c974f5ba1a5

SHA1
039e146cad751ffa12eb0814e70cd974ad4bad41

SHA256
d8d26eb0bab6533be33bd993e18ac22cb03a145ba009970cb149b4b688d8eef5

SHA512
871ec35c688241169e03d5b0cd325351023d90b6545fedbe10432edeecad745c2acbadb496927718439f74bbb814b932d8647099b34d67dc6c3b44a9b7101f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279b83c8ba7301f7f8eb80097fd6f368

SHA1
39260b1a3be49bcd75bd577206593c62c4029e6a

SHA256
2ab2533ef130c07bf8112df20ac38dc0d66f2da5294ff229c1386cd82b68917e

SHA512
4feff97bbdedd6c640b7a6b9ce981dcb3648dc51b31a3896ca1c38bed010142de466c47f404aa8377560a757a2a3942934e39a91072dde844c440ff7e50df5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
626ca5114fd7e1cac96fc5a7c7852720

SHA1
cda4ff8c28ca741f8541917dd7497c3f054def83

SHA256
fe93a391342916bb021f7ab12e36c9b6ff8723fbe51909ae138f1d43a5819b91

SHA512
6681ced2bd08754a5d0ad729afe08291071c7f8cf7f3ee6507f1e80b0947bc0d178147e59eaf15abd37f0b6ed722bb4dc46d02a5ee09e7d8f16addb870d3f812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00cc2fa74783deb48f89ce12d8ad5ee6

SHA1
7c7d2ef81dd91a6d44fa5422153dd410b656840f

SHA256
5101c9007ab9cc92cef79b81dd9086137ec6868fccd6b1abc7b8d9d6ef755b89

SHA512
a76911c60b803a0599ab49215f10eaada246d64debe522fcc701ad23e99f3ca77373a8659a34abb93f55346eee6aa7c5d6bcfbc6bd3f980826643950aebf7ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3bbc404005959d91e9bfb7961d42f4a

SHA1
1e106cf5a38643a195e947d23c814ce7ee5f0934

SHA256
9ea66498362d9de76dfcac3501ec048654515e3d1fdb1e80fdedd39bf2203269

SHA512
8b76f8c2b915997c1bccbb574ea4710e61de4e1ede830a7accfb5fc007c85c9091cc444c345010de813d4ee38e8638980d1cf7b336111150c902fb0557d9c75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804990a48d0ab5416cd7ef917eb88546

SHA1
09cb71a60e880502f99d02d2efc9b0031df0aeea

SHA256
46db16d8b57675894e5e5ef90ea76868f5bec0f84ff9bb119123d35c06458671

SHA512
715c5b1008cab3621455cc3f13d06ceb96129e522d396b22e28c537118140c82641a6971295a8a924d19f131fb277cee3ed80de124ac4de963c409a4429cb301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad74c2aa7343c9b24c0b42fdba265e2d

SHA1
33c2edb32ddb2dce8e5aeb4725d8a990bc0f0911

SHA256
706a6a7bd7bcc44d976e01748697934fba40f2fcc4bef527d63be2ae792cd051

SHA512
5762b52dfcff2b890dd4bc47d44097aa25cfe9351d89f84eb37d6494aec04574af4dea7ba816796c6b14331462e10fd79a0f220060d35b42af8aea1678b70ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5e011026854be88f0e9b77fc8e5ca78

SHA1
f1d87e27ed0be95dd3e61903c9d8235cc0d5dba1

SHA256
050a086a5ea2b451e64aa980fd365f7fd6eecfc4c36b7b27078abbd6275b48c3

SHA512
70d51047f88762e358c7daf8570677ee2d141bc13e51f5042748c5da7993f402dafb404b5d4e0529d9dcb277e62f379dd62d10a96d69a763cdd6758e79806d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a751def043c49d1bec184f1e960ec8c9

SHA1
db372e709899d783df147f54ff57c710fae007f6

SHA256
a290e1335fa657f13bb242a0466ee500aafab60c983c92c15315013a220f3597

SHA512
8c299d63fac7b2182c7738d572bbc031007d89b6c291868df016d04eb231314857c3910ed1cd4b0979d6e232da2913aa9098fb0e480734314969ca1ccb04f212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcad22a72803c71da3d69b652c79296d

SHA1
f96ed8eaf8baf59f676476b3503924e780fc1dc9

SHA256
e7740cf64f1c3dfe2654c1a38c78f2aa724a6cff4fa7c990bf3c03533d0d349b

SHA512
95da23d9354e6abe21638ea4d77826f9d8f694304cc27037eee5cb07ac5cfa98ef4c352f7b3325f88e78aaf09e63b6add1fc78928f99477a4ae914177171c708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c16bca2b5a5c3527d4af7716ff04f67e

SHA1
61ade6f4edb8c1c28de20944ca1f73175132803f

SHA256
ba7aeb3f317933445faffd9db99f0112718ffaa953bab20dabf3dbb67cf83022

SHA512
66756154b5715827952610c5e954bffc02822ff28ae6fa1578d0e027696641eb0a68caa5d0fadfa66c5f2ebd2557a8a951ee1f9786788b981499cbc4b1f5ce6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
805e44feeee740de1137e14b99df5e11

SHA1
6f37b808699235fe571f34780e246af5124d935c

SHA256
41118e530bc442c46a81da2dbc27f53836a474ab81ffcefc3558c6bf08315df4

SHA512
0e57f4c6a60accc14b22411e805d910374865d2b7eb142e360224797260bf52ee85b1e47bf2d75c6ecb9a48653f7c51723ec9f9da6dabb449284905034d5e939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7aa57a12b24fa267ee6d0560eaa8d4

SHA1
0bb697ae79bc21eceea5cbfa48cf740314846a5b

SHA256
fd1610b86ce6d266922c86293b99901b5a0c2867ebddbfcf7f5748aa28f24473

SHA512
a74e7bb3b704ae07057fa1f4e79ef05a1018131774d6ac9101bbf1fa2574de93f41ebc9902d1dc09b56e217b4258533a839977a44b2c57a865ef979c82ec8457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d8f54865fd6299366834fffe1e9d67

SHA1
a778b045d69e991b29523298fdf003307974d8ae

SHA256
2b7494330f95e0f2b41008c2555ec270f01d95af27af5bfa53550033576393e6

SHA512
ce9de3cfba7e71779184f6a58c0f8be3fbad18e392d9e908a4c2fc2ee1c569639fcd3222936b6d62b6ca86aacc5cadd6124fba0b1e4c287cb68b7367604c75a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfd474f7bcdbf825a1f29f763f677344

SHA1
eb7354d9c29b779d80db4b9439466ed727f9348c

SHA256
5fe7eb343b6a12aec3aba3c785be7780c62a179ec23255b855749ce8939b7369

SHA512
bc14d2076f0d7e1b6e3e3f25b19cd9817566f7379cad70ff76b36f936c0c430e6d5501f310e4cdb7d8e377fb308ca1de6755b2a65ee7323204557208ecde6bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e88c4ffa0dd2b7e4ae863c7a9f7961

SHA1
904b2cc638d8d4031f0ca5923037b4d43b8599d6

SHA256
74ee9ddf5c6c1ad38877a826488c7709a5267108381f037f9dc5202e09767a87

SHA512
9fb7e00da13e4418e2e563654d12385103c4e70bd7c755094c36878790eb528286ceea943760736f4fc711b595dd3e1757a116e320c668be134199d5ebd29ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
020b1018012a2117c2bc4d20e2ce4cf4

SHA1
ac7d9c60cb423991ebb97e973a4a48bc07838923

SHA256
f30222c26a84a0a13faf1b02d413e347c62b186b8403e08dcfa585b65a133b3a

SHA512
f8ccb3e38107a27bf76fb87ce8bd120b18062d0902e173b1dd138f5882531d66f3017f9d673958307cef13413fcdcef7576d60d226cac964e6f1d7b11b8ea062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4087863a9008fd166d543282d5fd880

SHA1
1fc545ac1f81498bc1557479388fe2422c6909ab

SHA256
ea4df9ed4eb4faf1904afdc02ac2647ce96c97938daa1ef80e0dcb4a63871973

SHA512
8f22456591ed78640b9b196afa5485a52e5282f2e40e9e7e7dd8d14f7726c54f81b1214734021b92ad926f9f6efa520bd6749c5309442bd22777553f52e6bfb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb3fea26b3f087f1b4c8069656ed47e

SHA1
bd310a965ba5330c3ce774641b350783ec76232b

SHA256
6d57c8f6d26ff6646abf2fe134af6b05b8f683e24d1d2019dbbf2e1628a2c649

SHA512
91ee753d8baf25ab2aefd35a5b3b26db110912ce348a10e115e712bd603cfd516b4775fc36ba5eb7378e2c3a325f6d95921b626af9da9e983ad845bbe0509a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b7125cef3f67cf061f8a9f250a4491

SHA1
2a17003fdc5f42cca7366a445cdcfac42f06db3a

SHA256
8a073b47fe386fed988a301122e6566cb550eefdcf5799fefb5dd3aa343e5b75

SHA512
e030c3c1189d0c158aefdc29f6a08ab79c13fbed5463689083a99253f180d0c0b89818db23ae185e317859a80e8cee6d6a7597e62453c2c09ee61014f1bf5846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5d85d1e8db7b85905da56a289ac4cb

SHA1
9cd12bbb7ae4f660c7878c8e0d621d3ff000f901

SHA256
0413351a034d04c89d80e3b159923f01cdb95a722466afacc2b62a39491e8b75

SHA512
e961fdb8d5cfe692ecbf46a18acbd99dc122ce98e3db0b79c7830dd4c811756de10f8a89b59d4f604c2f17a61d8e3c3f20d8e088b2fbd286526f7e5c9bdf8154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdb6c214dfe17c07eb814c9f037f3012

SHA1
e80de1e02b824a814ba6a003c6907a4f6350c8c0

SHA256
088527f398fd413b2f7dd2075beac4643257b3bfc6a04ed9a5a7e426a79c8222

SHA512
2b6fbe0cef81e031360129b79dd422ff86cf9da2f5c1967e6e94bb83e62fb35f7278a4ae7faefff25a7183668b7bed0079af67e4ede705f5f149a1b4b89b5787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e181a033f3e6c8b7f422061eb8c8985a

SHA1
89ea3a18dcb32c1f18fda0ed67f1816df1dd286e

SHA256
cda6d60307b47e5189e588d2e550b3a6fff578d7b3cc338303ecfda952388efb

SHA512
c7050a51947b145760ace4cae5502e6bde2e2808ec54ac09af207d49e1c393404f26c74eb4868ce6ba5d57034457008f5ce8b71a4478fef61dd18a93f8e915c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f213b3452ad98d80e8fb4dedbdb8b63

SHA1
992676bea5d3084b1d694b3e0f40ebe4811d665f

SHA256
15c8ddf009032cfb680092eca6d038c8941b524a606099c184d5ab03a4e66837

SHA512
462c4514ac119c7b02cdc94a6512713e3556e507cd1b5eacbbe01038d1b740a7348315a70a0834e07f0b87229e8a0206e60c807e6bdb17662c04fab350a38760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9633d1ab71fef13f4988b0b4bab82b2d

SHA1
470ad410ce086c06b3996dbf14ca290a66bbcfda

SHA256
50a7d564d4efbd980e5e73b9e15795796af9f36f59e4f9ff048485e11c2fc05d

SHA512
6a6644373c81b8ebe677b06e9152e44a617e7880fd68f3311350179931c13e759ab6aff85ce81c2012d9b567241947673d72bd5750e2dc32ba74654a1ec9a518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07417d76a81ee6c5a2a4da3999b16faf

SHA1
0f7ec3d895f91651413774de076a40bce8d0d390

SHA256
a9b13c542ccec0e8e44b9d65edaa7bbbbe0da6c3c084bf2ad93f1c9baa509e02

SHA512
ea909ad5379268994ec6411de2de1cd5b8e7fc4119418744b94caf3d08c1e68670bd11666f2a482a9168615308b77424ca90fc75ace60cf556a35f75d76f17e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9dc6c94d445e7e977e3afadeffcd519

SHA1
41fca2ecc157946816d8323d453725ceb9f9b410

SHA256
01fd776c753367dd90ffb81a463f5e8617782ff18cc797da5cd6bc45730a70d6

SHA512
50813d2f9b0aa3c3d7ea7dc4f6ab1e353dacf9f906d6b0456ab01f852f78f539b148096964aa463893dd8c3af96482caf947a8a5f5764f731758c4d2b962b87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a8a2b399672317913716b342e2f26c2

SHA1
4fa218a6f6e72ee0aa1a607b322cc8ea4a0da815

SHA256
bdefa464391f63a950d4f3b8a280c984c3b86985453901fb601489755885dfc4

SHA512
d43e5675d7a845987df3b87a8273594c67a3aee466b1d201fab5b20135c469e10f56b059ef24e3e57657d76db402ee33187231e5428c16f4e7c64d8f53c34c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd7277e25c683b4721ffdce6f43fbba1

SHA1
8d38ef876c62a47bda94d6ee12490a718ac8c807

SHA256
9cfd4c153ae4898d8e239c1db6ef70da56d23aa67f339353c65420dabc9bebc6

SHA512
ad664d72a151170dd3b19233049c9e278426df688f6ef1a86a45dabca84cf12be949d4cbc615dc8949da2c30f4ce406dae81255be1be8e774de84d59d4b340c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ab405c09825d5aecbe2b32d3de717c8

SHA1
dc5cc4127c51ac4b4b5e296aa65d424f2c5e9184

SHA256
317cca1e3be7d95c04666079ef06d598b269850269017d4dbe38b4584dcfab7a

SHA512
58266d154fc9dff541de951492ed22b1fc6b386cf7e41ac9961ab66747f9a0ded6e6e0a61efa0e9d113659edee665ef05b01d099ba6ea580d48299e11559802c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
869daa6fc957556a8e994f9b26beefb4

SHA1
34ba39efeccc7a0c65dc99f031f15e3165d51639

SHA256
530563ec15014ab7c3a1526ad6574d81c38f0d2148a234576dbfae9e5ce1093b

SHA512
dda82c9f5615bafc47cae84a3a444a98707c100e74e690723a1a46431adc1664792d01c3d0cfd99aecb447eac33abbe8a3fc8c76e2fec9393ee7fe9fe95c1316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\9ASZX2EK\www.offspring[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\P4VVOBJZ\www.youtube[1].xml

Filesize
229B

MD5
c05379603e044eb1692b193d30269808

SHA1
2551fe2f387636f5334943f9d9cae55a3974720e

SHA256
cdece80dd59d7f33c8ab7102aed47081c3f3bbee0e67d5f83d92b9c88e1e4f11

SHA512
0867cf677d07aa1dbbfe2d27da98e8a21719c8c092137efaf72df5dfaaa050d8f7c12e61f0b4431422f7432222e4b2e284311cb6d68597349cb642e8d192fc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\P4VVOBJZ\www.youtube[1].xml

Filesize
641B

MD5
95cdca7483b0e7fc517fb82467181793

SHA1
634108edd29bdd208da48fb13921278ab29fc3b1

SHA256
f2e6f93ba7deb3b98d8690981ae012b358ddf0a526166c2f99373073450b7535

SHA512
0a5843c2ee8d3ccc9e05c74fde36c6cd47365814064d989e11173004f7ea3d1093dbe2fda51ea9204914dbf94ed69d4ac9ea142524aa8febbed3de81ee523153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jqfjk0y\imagestore.dat

Filesize
828B

MD5
4311843fc3a4ee5d8f0cdb70d504a72b

SHA1
01689a6f9166fa9443d32e10467f3c4068c7b9cd

SHA256
bb9a39e4b3ae34e40bdcc5aeabef352a536bc09812876787baaeaa34c0aebc60

SHA512
abf4f4c584eb8e3a79ac04acdce77be2ce8b96129f1aa501941fcba8e18d8fb2d18ea69473fc47a9fc514e91dc2265a8019c3d7f3e3c1f690f9fe05786d38cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\favicon-32x32[1].png

Filesize
634B

MD5
28fed9826e327c719cb9df95934c17c6

SHA1
7f4c1760ac3ca775a1c6ba7d1422f86b2310d23b

SHA256
d5df0f4548cde24cd9b8d31f1bdebc30c3a4b7eb01af1314353aae659921745d

SHA512
c79d661c39c241913bc857e879922512a78d5a4411323ace4c4ab103d6b4804054047551e12aabb497aab7f71f11e9ecf22d60696b9d3b0c90fe6f92ba00712d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\88RU7EC4.htm

Filesize
101KB

MD5
7f7029e58f2bcf0abf9305c88db8bd6a

SHA1
03b13274b18a3f761a61e4df16e40bc7efa36ac6

SHA256
a0bd75c44bfc473712a94e42ced6fbfe066236d0d9c22ee1d0f0200b6c9fd49e

SHA512
1772648f7464975b63bbcad82b8d829d7d3e6735e30c502d0e8b78ce7f300b12ac8464e05e517bf3852703edb1ff81b84f2c61382adac684aa5834abf4f6f075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E41.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\raVe.exe

Filesize
235KB

MD5
d40a18b03a699f63ee469a7b39ae86a7

SHA1
45eb3a218beded8bc4faa70d6ef5519bbddcb749

SHA256
8dd1796ca7db68bc3e7daa76b17b71e162f287949185695cbbf33833ad1cc67c

SHA512
d4a3f67cee28cd146d9c642ae64f2f39be0d2e2c386f5a0c21eadd89a010a8b3997406f662ed598d2fbea600f1044235e1e485c165da2a6e06e86e2f3b75ec1a

Download Submit
memory/2356-24-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3216-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-37-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-35-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-34-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-32-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-30-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-29-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-27-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-26-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-2159-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-25-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-42-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-43-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-2337-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-44-0x0000000001E90000-0x0000000001EA0000-memory.dmp

Filesize
64KB

Download
memory/2356-255-0x0000000001E90000-0x0000000001EA0000-memory.dmp

Filesize
64KB

Download
memory/2356-342-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-22-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-21-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-19-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-17-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-16-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3226-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2356-3222-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3221-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-10-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3220-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-2949-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3219-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3212-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3213-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3215-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-40-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3217-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2356-3218-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2440-3224-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/2440-3225-0x0000000004370000-0x0000000004380000-memory.dmp

Filesize
64KB

Download
memory/2440-3228-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/2444-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2444-0-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2444-8-0x0000000001FA0000-0x0000000002046000-memory.dmp

Filesize
664KB

Download
memory/2444-11-0x0000000001FA0000-0x0000000002046000-memory.dmp

Filesize
664KB

Download
memory/2444-15-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads