32ac64aad1c7b86f24b34ac815314b5ce085b698a8c07ca35a35b5b6e06ac935

Analysis

max time kernel
11s
max time network
12s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ST_External_Loader.exe
Size

19.8MB
MD5

9db1a30398521441b138523142a497c3
SHA1

aa69bfad573aad9db5a7a626730dbe0b62455097
SHA256

32ac64aad1c7b86f24b34ac815314b5ce085b698a8c07ca35a35b5b6e06ac935
SHA512

2221440d675514fe5061da9dc2b3e3e47dec6240da31d36166b4bd946da7bd03871fbcb6c734777afc7cd22272a8cbdbf13ef929c98c22088190cfd5c06cf483
SSDEEP

393216:s3VgprYo2N1J8nXzrorjPB4I44aqJsLIAazsNSNUy:85J8Dro/PBMsVsgNUy

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\vgk.exe	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\Taigei64.dll	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\drv64.dll	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\vgc.sys	ST_External_Loader.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BAIQIWfUpUGgY\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\BAIQIWfUpUGgY"	vgk.exe

Executes dropped EXE 1 IoCs

pid	Process
1316	vgk.exe

Loads dropped DLL 1 IoCs

pid	Process
2296	ST_External_Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
46	discord.com
55	discord.com
56	discord.com
59	discord.com
60	discord.com
61	discord.com
62	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2296	ST_External_Loader.exe
2296	ST_External_Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10509"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "331"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD5DEDC1-28D2-11EF-BDE5-DEDD52EED8E0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10515"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD70F8C1-28D2-11EF-BDE5-DEDD52EED8E0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "407"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10515"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	ST_External_Loader.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1316	vgk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1316	vgk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2852	iexplore.exe
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2956	iexplore.exe
2956	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2852	2296	ST_External_Loader.exe	29
PID 2296 wrote to memory of 2852	2296	ST_External_Loader.exe	29
PID 2296 wrote to memory of 2852	2296	ST_External_Loader.exe	29
PID 2296 wrote to memory of 2956	2296	ST_External_Loader.exe	30
PID 2296 wrote to memory of 2956	2296	ST_External_Loader.exe	30
PID 2296 wrote to memory of 2956	2296	ST_External_Loader.exe	30
PID 2852 wrote to memory of 2656	2852	iexplore.exe	31
PID 2852 wrote to memory of 2656	2852	iexplore.exe	31
PID 2852 wrote to memory of 2656	2852	iexplore.exe	31
PID 2852 wrote to memory of 2656	2852	iexplore.exe	31
PID 2956 wrote to memory of 2444	2956	iexplore.exe	32
PID 2956 wrote to memory of 2444	2956	iexplore.exe	32
PID 2956 wrote to memory of 2444	2956	iexplore.exe	32
PID 2956 wrote to memory of 2444	2956	iexplore.exe	32
PID 2296 wrote to memory of 1316	2296	ST_External_Loader.exe	34
PID 2296 wrote to memory of 1316	2296	ST_External_Loader.exe	34
PID 2296 wrote to memory of 1316	2296	ST_External_Loader.exe	34
PID 2296 wrote to memory of 2764	2296	ST_External_Loader.exe	36
PID 2296 wrote to memory of 2764	2296	ST_External_Loader.exe	36
PID 2296 wrote to memory of 2764	2296	ST_External_Loader.exe	36

C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/staffbesting
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2656
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://www.staffbesting.store/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2444
- C:\Windows\SysWOW64\drivers\vgk.exe
  "C:\Windows\SysWOW64\drivers\vgk.exe" -map C:\Windows\SysWOW64\drivers\vgc.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd27d87e9ef0708ddb4dfdcd7fb0803

SHA1
c1cb002be0ee2ab253f2ac163c0fd5e777d470a8

SHA256
2a0598ec721d87b88721ae76b3919b5e7c851229dc4e8cd572a1d65bc87ef5e5

SHA512
5c7ae015a9f9f7ec427967813b1bc5b1b785aaea1c2d4c255dbc6f47a52bab0941a3bb9d802e3fa3398644336d84dab37d39a4d40f7cebea9706de94b7de182f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ce2ae81e8aa53b51bd70a6e4eb7d50

SHA1
92d433f9d40fd7f5a2af97be4de29122d85eece1

SHA256
0d88d621f814ed040ad11c1f4cacffe773d79ba7e1b0cdc596a188317438db31

SHA512
d5bf7374dbace71a6b59456ba51d0269874384e5bb09532d45943ddf9ea2b114430688aec6c8bad828a75bf36919533d7ffe3466593da903094c00569dfdd366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac895c9144e4faa27029231f6a852051

SHA1
5febf3123a367ed70977bb060d381c5364c1cbe6

SHA256
30b0aec688aea3c2ba07ca9d50d20a1a26193fea61c56be70250eca2e7478196

SHA512
bf06dfdfc73a3d897b3e0e6721ba71a00deca9c6b643d0584942df968778f8d020d689310567534606b70bfcf1868c56e32f894f315986cd53cb6b4a9f35db8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89dddf617aed55a0164de2f6684496b4

SHA1
e89942f12b21040c539a61a66ead89ee12818c0b

SHA256
e2d56fc5d558f2306de86fcee58db846c6d7894ea1aceab4fc812b5914982859

SHA512
1b156263e5d4726eb9db795e2205b7c5473782ebc6c45da421f3f898c88d3bc6a94000f7890207115b508548dc0a496d60e7a10e3474928dfb2516555a893cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73a8ce3c7b56b646c05572f73ff1235e

SHA1
3b973bd8006e45aed35f2a34f680ae1eba59897d

SHA256
0a38f2d8810040a4244e018fdd29a5eb412d14d16d0f0873e289f1ab3264b2d2

SHA512
9b241ff9a530d2d6f077f0a0dcc54411ec01be14af92fdcae525482a3b7f6a077253d28dd2e75019bead14c6417f65ff041426488abc55c6f3bcd4c37c6d1190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
415defd81ee333dc02958dfbd381afef

SHA1
34f17f0f01aba1d7b03c9e2c6594f0410b1939b6

SHA256
62cd56452ba0719957ec4a79609bc987befa9ac93d4acacbb8475223914f9244

SHA512
836305d79207dad8d91a7a0a59ba0be3e9c3f82eee3752055f430e3a63da00aa0bd5acfc8c11123c24c6b7a68561b74985cc3a9f09d20efafb7d348973aa254b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc469d61c209c22d92672448facfe796

SHA1
fe2b19f6b52bb5675b5c72b2107dd5d8910ae5b6

SHA256
bca5ac498368a0c6f499fac9b714d9f39744aaa849c1b76276dd1bcf4663158d

SHA512
edf3f55aa14fb7d4d46b7faf9e2de08cbc901390976414f37a51890490b20d5b5b90b7db706904fec8db8e8f347acf5f9ea2ab7e7d56a75d0d5f0cbaf6d0121f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ef393d718124a92626058425a76cd8a

SHA1
d78aa3d29b8dc6feca5765d0fe8edb330b168034

SHA256
83b2575208f8974fb5e29e6ff7f699251781ade72fd8a15c106ef8193e5840f7

SHA512
36874ca856849d04bf0106eebc7e8120959124d7b0a662161c7f560ad200ce3cd7ab23af09f8459db08ef0cea9c55cab4a427109ff1fb91ce5913cd9afc00eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b40a4fce69b4e969b226bba08ba551c

SHA1
3ed5a63c3da341604b59bab3774f89eaf5e22d48

SHA256
5ecca4157985fb0198f6725abe1e471e9418f42028370b1b86fa859c7f9bf692

SHA512
8c4ffe273390cca98ddff9e933606ed1a10ec0ba370c33d7d63a05f5502faba19e83719687a53c15680e4eb298cf325460c297bdab7c191c77531c0e4159efa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab46f4511139cc4c17f2177bd3da643

SHA1
4bf8f161c95115ffbd6774470e154fd9489737f0

SHA256
2bb8b5bf11a8a9cea55e2314f2ba787a570506802ffd23147d33599cbe7c0de8

SHA512
7e94ac7ed0d876849a43d33b2654fcaa9024384fd8ff825052f3da9fa2ee052396839113a9bc3893f5008720abdff33445e84b1216b64e64f385ad82fdcbbb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
6460aad8f1cbe1453a3ee4149a661115

SHA1
bc5e6822edc1af00b78af4b1d68a52d4512cee43

SHA256
ca247c2f0dddeb6d1b7800ca7de2a68d166f00dce4c18e21b8859d9f2d4dbfc2

SHA512
5b3de3585d0864dc0f107d507339bb9351e12684566b5e652b8c9facae0296c7a7a1da0150cd315d5ebb0b9a7ed357e01241a0d894edd23ce711e171090c90d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
229B

MD5
3d57a04d1123454435b158fb72c9f128

SHA1
ce90f54e2312168e84d7644882cc9d6d81c25750

SHA256
a321d2f0d6cd312a8a15c734b51fe05c5f34ad3293b56ab8eb2c553c716b9531

SHA512
61f93c89d0b1db79c8860d2a6b7e78538fa3d9fc4ca7548f4792d04465eabe09f29ad12dc94b7dbcc991a22403481bc39c68409d8e57cfcfae2dbdde0012241b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
229B

MD5
eb7dba519ce14e1d80ebe106329f1b65

SHA1
f52d2376ef763ac7c6e9885c9a4712e909fbcb2d

SHA256
4fb7743c0b5f096984d7405fbeb7c4b1c7b899bfd556f389ad198dd3f7b1107e

SHA512
d6e396f034338a30ebbdb915801598717f0d4b11ba44e0e131291919069a8bbd210aad7f96a832165816ac42a5330cab3e5fa5d73e9348248c4c1a7ee2ba5540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
229B

MD5
b5ae4ab2ce749cec4f25f08707ff1d77

SHA1
08b8507b4f96a3dde057dcf3ebe31246a88c921f

SHA256
d5932c586144fc6916c399773609adda58364a64360c22901d3f5eae3f093c3f

SHA512
d3d720b88ca68d712dc8d1fdc801b102586cd52663832cb11f14f81680c768268c8a28c2648adebc8e25ad483469a51c8fe866d55d2c442c75a925af1246a6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
229B

MD5
71c6fcbff0a3f3b575c0510ed2c20d69

SHA1
8fe3c052dd91a482af63eaa05cebf385792e70c9

SHA256
f25fa40d0e84df87d0f54cdc6f9aaf14a95cbc2624e9ef4afa31917e003258d1

SHA512
c4976c2d886ef1f056dba5e89634ae0069e2848ec7ff3b86ea4b2924e8b80a02edacab005fe6e1b86fc1e97546fc9eae44a19740652062c01e34b5152a65ccf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
16KB

MD5
f20f072b0de4a1daab9841a223646581

SHA1
1f9b8cac47f47420bc90f6455db3f6611d994786

SHA256
d06998179a05ea15c8bf4a74605aa42a2107b14bb9b436a1e4a0cc9beae11220

SHA512
3eb112ee8d8704cfecce7640a504c1d21df752890c868525f365bfafeb2c1983695b8f1f90bfee829948ea114cb1d018ccd1de587ce3f4d5c20ed160c837b99d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
990B

MD5
6301bb0628ed7963cfe7c99161ea9ead

SHA1
b0d9940a48a999d91ebd16978ea89d4b59860300

SHA256
d5db0c00f1e02b43687e8a12c211c9319e9cf9435dd3f8407dd65bd311261d82

SHA512
beae100fbbb39acb0a3a1a14212a68d55c5572829c1f561a4aa23d274078730eeb39b63cfd8518524cd22fb02c2572d747fbba18b285ab61b011ddef6b21f997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

Filesize
990B

MD5
ac438557a2a63dc32ea28c422332cdec

SHA1
3f4739d9ca297944295ebbe3341c44662e2b3070

SHA256
e1794e75ee8b27b658d10557fdc2f6cc000f68af0d345de45517fd445c451d57

SHA512
7030b78dacc3f1e082bb2addd30c1433d15d86ac9ac0f9ddf78e4b7e126e68360722f5da871832a1027b9521e1e7f970ff3672ea0a23cba1ca774f54ede3f91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD5DEDC1-28D2-11EF-BDE5-DEDD52EED8E0}.dat

Filesize
5KB

MD5
136c488f7175bd08a8a2c770acda6365

SHA1
da99ccc951e232c3fb930a7e9ffebb6eb81adf9f

SHA256
23c9f52f15cfd17641130790925e7bc778934645fb2b10107b7358eb61f18ffa

SHA512
60b895c3a46172bff2cc0b8b170194f2611f2201eee0768eccc39207f3b22a5deab79f95bec5d65ad6a45397107bb101c53752c9eca05a5abf4259853701c4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD70F8C1-28D2-11EF-BDE5-DEDD52EED8E0}.dat

Filesize
4KB

MD5
76a2d0a76af6eb0cfbc15604d7768e50

SHA1
4c55d6f20052dc5105bc085ff237007d6fcdffd2

SHA256
486828b03c43c729ff2b28bbba84315aaebeec8406d75e47ce17544224ef549d

SHA512
fc2840981969d668ae4260855671f8156c0d9bbd958f4c8ca2b2ac5ec67debca46bf712727b808077907b1482d628c70a383dcc8d6a5577f2fd8b6720f9bcb81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9yhbznx\imagestore.dat

Filesize
24KB

MD5
690f5c4502f5efe80c191991c16f1edd

SHA1
536070ef1ad260b86b732a1f0747190a54cbead2

SHA256
e9abe928f946cbac721309e58689f0a758d327b40143b13d1fccc6928f4fc29d

SHA512
8a73debb641089e162c1f256cfb0f92a8f311e6dce312438af4297a6628b927b918058c8463475856ec0991bfeadba1f17ba8731fdad0ab41e74d8ba6dbd66db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DODQ7AEY\j85XBmD3K-auBXRuR4gFy-YbXrRwDWE2e6ZsFqyJZWU[1].js

Filesize
53KB

MD5
c31f785afed7c3bd94e48286a26482ad

SHA1
f66156197cf74e58d6e0a327e8a1e6503fe63374

SHA256
8fce570660f72be6ae05746e478805cbe61b5eb4700d61367ba66c16ac896565

SHA512
8932b515493774d5587a01fe6d3fd08c404fdb694219898ee32a44ef00cd8773ceec0f46af1fb2834211a64a7eb698ed6d1ee7edbf70e80593997ce65113a6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DODQ7AEY\remote[1].js

Filesize
117KB

MD5
a06822cee12b4c9e516d0725f8af8858

SHA1
b7f87f66d1fab21fb1091e00e23d4af5442dc66c

SHA256
07f6df6c6575d5c49957093ed7c3986e7036f6763dda0982972b6120bfe60142

SHA512
d15bcf19ebe7d980473a2254a5c2eba9c5c74cc77d8f721fd9efcb56b14dce255fed649a81a40892bc65e7794170384d0dae5cca13927a9b2a75761ff671c25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\base[1].js

Filesize
2.5MB

MD5
4baef95dea52995a1695037852e4ea66

SHA1
8874e4883644a2e30e626a34becec8587577fc08

SHA256
b42cf83d76c3b2890a5beae078ac33ee3d054a31b9f47dc4f88cdc2086819d84

SHA512
4d26834698ae5e12b5327c903020c4ede8b6395d859fdb6c70a7d9f60c15958510c10a79908a96acda21966de6db8d2fa8f87a0265828e458abc65cff5162ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\staffbesting[1].png

Filesize
3KB

MD5
e26a92140b2753256b8adf9b89431ccc

SHA1
2513f7bf45efef4b1c840d0fa154078d73c6e7c9

SHA256
d04c5b19b0828d10fbe26d975103bfac88cae393a3183a8e1355811b79309c2f

SHA512
d0361dbaff7ecd47f256c93498c79d5401a55697d5fbfb709a305d26e9d8aa35f479046509cf7c2eaf5bff2db86c7016dc1f70f4431eba560a61c89f7eadfd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\www-embed-player[1].js

Filesize
325KB

MD5
cda0f0a481eb90a8955774d5e1df7cce

SHA1
3c8dc861e58cbc351db0e37fb4e7358293786442

SHA256
ce00a615b58d37b039c143d5591834274b19791cb2dead45b64da43faef521d8

SHA512
7491386b3f756d046236d2b29d0648c313a38a8f4e9871335d27601a3a2c09fc9f0785e24cea570fc83352a0da45906379b0293e8b58fc7333096f1e3d0de51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PJARS8CM\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PJARS8CM\embed[1].js

Filesize
61KB

MD5
4fef9c1e099df4cfd80e218072e66566

SHA1
ae23566c37e802116d2a28d2cbca4989ca12949b

SHA256
af31d58709c4dfa933290cae1293deb05294f142746cf2e6aa74080860b68eea

SHA512
3c889874f7b8c380ec45d1168e3764b83c2ce7b95311b0f1b2e8b1d0977b254d46cb896e501ae0ba72959e7e9284b3b4bfa6448adbd989f9dc63707ce1fe29ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
19KB

MD5
de8b7431b74642e830af4d4f4b513ec9

SHA1
f549f1fe8a0b86ef3fbdcb8d508440aff84c385c

SHA256
3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a

SHA512
57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
bafb105baeb22d965c70fe52ba6b49d9

SHA1
934014cc9bbe5883542be756b3146c05844b254f

SHA256
1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

SHA512
85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DB0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E6E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\drivers\vgk.exe

Filesize
134KB

MD5
34cfbe3ff70461820ccc31a1afeec0b3

SHA1
5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

SHA256
6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

SHA512
1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

Download Submit
memory/2296-15-0x000000013F4F0000-0x0000000141582000-memory.dmp

Filesize
32.6MB

Download
memory/2296-0-0x000000013F6D5000-0x00000001401C0000-memory.dmp

Filesize
10.9MB

Download
memory/2296-1-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/2296-3-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/2296-5-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/2296-6-0x00000000770C0000-0x00000000770C2000-memory.dmp

Filesize
8KB

Download
memory/2296-8-0x00000000770C0000-0x00000000770C2000-memory.dmp

Filesize
8KB

Download
memory/2296-12-0x000000013F4F0000-0x0000000141582000-memory.dmp

Filesize
32.6MB

Download
memory/2296-14-0x000000013F4F0000-0x0000000141582000-memory.dmp

Filesize
32.6MB

Download
memory/2296-10-0x00000000770C0000-0x00000000770C2000-memory.dmp

Filesize
8KB

Download