emotet | e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NiggerDick.exe
Size

3.6MB
MD5

edcd9b037986143a8bad4985bf0e661d
SHA1

aa7ad22502f138c9ef68b6e66f50999ed94c7276
SHA256

e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba
SHA512

3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c
SSDEEP

49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

Score

10^/10

emotet privateloader xmrig banker bootkit discovery loader miner persistence trojan vmprotect

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral1/files/0x0009000000012264-6.dat	xmrig
behavioral1/memory/2320-44-0x00000000003C0000-0x000000000090D000-memory.dmp	xmrig
behavioral1/memory/2320-79-0x00000000003C0000-0x000000000090D000-memory.dmp	xmrig
behavioral1/memory/2320-361-0x00000000003C0000-0x000000000090D000-memory.dmp	xmrig

Executes dropped EXE 12 IoCs

pid	Process
2320	rig.exe
2760	MEMZ-Destructive.exe
2876	32.exe
2372	32.exe
2616	colorercaching.exe
1056	colorercaching.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2972	MEMZ-Destructive.exe
3008	MEMZ-Destructive.exe

Loads dropped DLL 14 IoCs

pid	Process
2876	32.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
2760	MEMZ-Destructive.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0009000000012264-6.dat	vmprotect
behavioral1/memory/2320-44-0x00000000003C0000-0x000000000090D000-memory.dmp	vmprotect
behavioral1/memory/2320-79-0x00000000003C0000-0x000000000090D000-memory.dmp	vmprotect
behavioral1/memory/2320-361-0x00000000003C0000-0x000000000090D000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	colorercaching.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorercaching.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorercaching.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D558A11-4B46-11EF-B8DF-E649859EC46C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ad4e6753dfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000dc8f150df3d811655631bad4e8c3df91ac932d8ba0ec1225caa031b4384c551d000000000e8000000002000020000000d12e3acf2cfb7c6f408fd735a11c5e382dfa129d5d1b2c90df1ecd7698b3024c90000000f800c649020da7d88639c685ace54238640f9592f2576e1d0505b51031a947be86113673a34e3a1bd1bff0221ec2a92f358ec2ecd4a886bd39db9072264d9c31b1db828acd846988a785df03e5eeec4dad1261bc573f2528e851a343a8ec96329678326d4f28e982b23a7fcedcab631539204f7b1660db80a8cfdf172b10ab216a075b2e27ac8321db43656af5243ce9400000009a2578ebcaf3c3a4c38f6c58807dc2ba8dee627c260993cf09ed4fe1a59b1185049f4ba3d15855cfbe8c4009e6e9c8ece9bb40d4d08999c9fa0cd267ffc345d5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428157054"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000651393eeeca803dedf355a0b191f2b9a634465c984a81d63d872cf9d6aadf3fd000000000e80000000020000200000002a130250ade25dbf895e225357f9097c2c9542b4a1f2490c8e92727dc21cecee20000000f721acbedd82eb5e3a1f9f9c336774072486a2a8e9b67ed216461b249e2cb8c440000000efc0edde61e6359860c7f2e99c7dfdcacebc674cd83f1c2cdf07f607765691907e2c445b8ae22f2d78eb16670ddf50353e7a2f9432cb6b21931be79259386553	iexplore.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	colorercaching.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0077000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	colorercaching.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecisionReason = "1"	colorercaching.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecision = "0"	colorercaching.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadNetworkName = "Network 3"	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35	colorercaching.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecisionTime = f0ecd94353dfda01	colorercaching.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	colorercaching.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	colorercaching.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecisionTime = f0ecd94353dfda01	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	colorercaching.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecisionReason = "1"	colorercaching.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecision = "0"	colorercaching.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\b2-2f-73-f8-ed-35	colorercaching.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	32.exe
2372	32.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2616	colorercaching.exe
1056	colorercaching.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2320	rig.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
2320	rig.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
2992	MEMZ-Destructive.exe
2908	MEMZ-Destructive.exe
536	MEMZ-Destructive.exe
2972	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2320	rig.exe
Token: SeLockMemoryPrivilege	2320	rig.exe
Token: SeDebugPrivilege	1664	taskmgr.exe
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
736	iexplore.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
736	iexplore.exe
736	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2320	2304	NiggerDick.exe	29
PID 2304 wrote to memory of 2320	2304	NiggerDick.exe	29
PID 2304 wrote to memory of 2320	2304	NiggerDick.exe	29
PID 2304 wrote to memory of 2320	2304	NiggerDick.exe	29
PID 2304 wrote to memory of 2760	2304	NiggerDick.exe	30
PID 2304 wrote to memory of 2760	2304	NiggerDick.exe	30
PID 2304 wrote to memory of 2760	2304	NiggerDick.exe	30
PID 2304 wrote to memory of 2760	2304	NiggerDick.exe	30
PID 2304 wrote to memory of 2876	2304	NiggerDick.exe	31
PID 2304 wrote to memory of 2876	2304	NiggerDick.exe	31
PID 2304 wrote to memory of 2876	2304	NiggerDick.exe	31
PID 2304 wrote to memory of 2876	2304	NiggerDick.exe	31
PID 2876 wrote to memory of 2372	2876	32.exe	32
PID 2876 wrote to memory of 2372	2876	32.exe	32
PID 2876 wrote to memory of 2372	2876	32.exe	32
PID 2876 wrote to memory of 2372	2876	32.exe	32
PID 2616 wrote to memory of 1056	2616	colorercaching.exe	34
PID 2616 wrote to memory of 1056	2616	colorercaching.exe	34
PID 2616 wrote to memory of 1056	2616	colorercaching.exe	34
PID 2616 wrote to memory of 1056	2616	colorercaching.exe	34
PID 2760 wrote to memory of 2908	2760	MEMZ-Destructive.exe	35
PID 2760 wrote to memory of 2908	2760	MEMZ-Destructive.exe	35
PID 2760 wrote to memory of 2908	2760	MEMZ-Destructive.exe	35
PID 2760 wrote to memory of 2908	2760	MEMZ-Destructive.exe	35
PID 2760 wrote to memory of 2992	2760	MEMZ-Destructive.exe	36
PID 2760 wrote to memory of 2992	2760	MEMZ-Destructive.exe	36
PID 2760 wrote to memory of 2992	2760	MEMZ-Destructive.exe	36
PID 2760 wrote to memory of 2992	2760	MEMZ-Destructive.exe	36
PID 2760 wrote to memory of 536	2760	MEMZ-Destructive.exe	37
PID 2760 wrote to memory of 536	2760	MEMZ-Destructive.exe	37
PID 2760 wrote to memory of 536	2760	MEMZ-Destructive.exe	37
PID 2760 wrote to memory of 536	2760	MEMZ-Destructive.exe	37
PID 2760 wrote to memory of 2940	2760	MEMZ-Destructive.exe	38
PID 2760 wrote to memory of 2940	2760	MEMZ-Destructive.exe	38
PID 2760 wrote to memory of 2940	2760	MEMZ-Destructive.exe	38
PID 2760 wrote to memory of 2940	2760	MEMZ-Destructive.exe	38
PID 2760 wrote to memory of 2972	2760	MEMZ-Destructive.exe	39
PID 2760 wrote to memory of 2972	2760	MEMZ-Destructive.exe	39
PID 2760 wrote to memory of 2972	2760	MEMZ-Destructive.exe	39
PID 2760 wrote to memory of 2972	2760	MEMZ-Destructive.exe	39
PID 2760 wrote to memory of 3008	2760	MEMZ-Destructive.exe	40
PID 2760 wrote to memory of 3008	2760	MEMZ-Destructive.exe	40
PID 2760 wrote to memory of 3008	2760	MEMZ-Destructive.exe	40
PID 2760 wrote to memory of 3008	2760	MEMZ-Destructive.exe	40
PID 3008 wrote to memory of 2348	3008	MEMZ-Destructive.exe	41
PID 3008 wrote to memory of 2348	3008	MEMZ-Destructive.exe	41
PID 3008 wrote to memory of 2348	3008	MEMZ-Destructive.exe	41
PID 3008 wrote to memory of 2348	3008	MEMZ-Destructive.exe	41
PID 3008 wrote to memory of 736	3008	MEMZ-Destructive.exe	42
PID 3008 wrote to memory of 736	3008	MEMZ-Destructive.exe	42
PID 3008 wrote to memory of 736	3008	MEMZ-Destructive.exe	42
PID 3008 wrote to memory of 736	3008	MEMZ-Destructive.exe	42
PID 736 wrote to memory of 1652	736	iexplore.exe	43
PID 736 wrote to memory of 1652	736	iexplore.exe	43
PID 736 wrote to memory of 1652	736	iexplore.exe	43
PID 736 wrote to memory of 1652	736	iexplore.exe	43
PID 3008 wrote to memory of 1664	3008	MEMZ-Destructive.exe	45
PID 3008 wrote to memory of 1664	3008	MEMZ-Destructive.exe	45
PID 3008 wrote to memory of 1664	3008	MEMZ-Destructive.exe	45
PID 3008 wrote to memory of 1664	3008	MEMZ-Destructive.exe	45
PID 736 wrote to memory of 2648	736	iexplore.exe	46
PID 736 wrote to memory of 2648	736	iexplore.exe	46
PID 736 wrote to memory of 2648	736	iexplore.exe	46
PID 736 wrote to memory of 2648	736	iexplore.exe	46

C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe
"C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\rig.exe
  "C:\Users\Admin\AppData\Local\Temp\rig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:736
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1652
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:472089 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2648
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:472110 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2504
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1664
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1584
- C:\Users\Admin\AppData\Local\Temp\32.exe
  "C:\Users\Admin\AppData\Local\Temp\32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\32.exe
    "C:\Users\Admin\AppData\Local\Temp\32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2372

C:\Windows\SysWOW64\colorercaching.exe
"C:\Windows\SysWOW64\colorercaching.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\colorercaching.exe
  "C:\Windows\SysWOW64\colorercaching.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
157082b65ad9c3f8dc7e23e0f0fe38aa

SHA1
a008731e3c20d507458ea6fa5d063a78a0a12d8b

SHA256
fc88707e5e8307869688fb96bdec9e85d630c5bea3eabbef0df67d7989fe1ad2

SHA512
fbb691afdef2fbedd432a8c84c0e0766534b626094d0dc96724d0c3e4e3d3047b596b409a85b33096e47f53efed5d8ad74a752569367751682916cdac85da145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

Filesize
471B

MD5
25896e222f5514fca82f66dacd2daaf8

SHA1
37b8a261af87de05afca4c1149c8027a01c88322

SHA256
06704b0c124973002bb187fe80cae31528c62d2348d3a3a83c1a11ef7538acb3

SHA512
a3337ae86d4a7244fbb346f44760ea5feea1421eda2fa25524039dee4917902f9dc8cc62b55a134c8a20453beab407ef5b10ceebb4a10906e1a86730d871533f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
fbdcf0314c61c9f8e44d47ab5e798dec

SHA1
b63437765c0ff9828b3bfa8d82b09a52b72b88ba

SHA256
82fdfa2c1deb7a535b40551f1f20e5052000aa7f03d99402142a7ec0c7cf6985

SHA512
cba1c7f254fa6e3ebfd3f875709a8430bde54e3e40e5c9f36d6c7c2eae2b77e6feca9e7ae3b1c1ed67d388fe5dc2efea9788b3397b5428a7a425fe1603315c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9f80d96e07317f49f5766caf259ccd8b

SHA1
84fe35697ce3decd8a95f939f045c6253a0428be

SHA256
7020f4274c1d1a7dbb9a9d2ac1b1defa264c4660332903e9a33fef210538397a

SHA512
8e05e48872990653bd8a5e8ec51888eb1a1e5e0d15ef0846eb98f8bb1b8c54f0e419978f11148971372138f350f05943b6661eea9461453188c38997992470dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

Filesize
406B

MD5
04a62b88bc5e54374dda46f2d4c22505

SHA1
00563a87cdee2600ae5f1f20e56411b9345baca0

SHA256
9c0615c1142ed789e3947b05508f6097954957e4f8fdd780d910440944fb4d99

SHA512
0d2dea756da1a6036e600ea67124035782f5d9c232ae847ec876690def195dcdddd979b3ca08025f6c33cfd2f82ee87f6788b0af31e3ce0103b56fdc2e04b198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9982dfabab58a27cbd21d1d4570389f

SHA1
a9b7e78faa7714ff97500ef5b1bf222634222c3c

SHA256
fe833177ff750d7a413213975bc30323deee129155cfcd6d5c7cc933f2d424f8

SHA512
5525597725350aa6b3768fbaf863caf37880c5e51285da7f7cf125fbbae98ca6d1e967a804b82d5c45722a64cbc0004cf846d84996f75d2e17832a4b7eda9790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d00bc56bb715c977923c8bda61abdbac

SHA1
6edaffd11808218c12e65433221a546e994fd352

SHA256
3cd9b2e8d602e9558b505ddc398472f119deac398ccb6a3377569fa2c1685da5

SHA512
1741f02a49734ae0ac103f7e78c8da0feae2175ec3ad6f840fde77d2d10a8dc166b18364fde18bc271bc07ce763374c7d4cea5952629f5c4ee85714daf5939c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d78061ef10393f12a78d5814dcf4ec25

SHA1
bf5e677f1353d3fcfc63413c8080e5fa7788762c

SHA256
775e7acf1cb284b4ab2a52ec687b4c1c66e238124b022f04596eef7752091755

SHA512
2e60c5da23ba2f5253874aaeaa33d39ca6cb4df5652b61c37d13e05d97ee1cea9fca6fb931ad4dd87d53657ac32acb13f4c5b2b73307d692ec577d710679dad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55a97a18383fd054301e8ffaa2379d3

SHA1
41b13e77f1c62b1e48c28355e6ef88a43123f401

SHA256
8742f5c809a517372f72c16fcbb11e09115a18ddbd4a91167944811e0375c95e

SHA512
a95f4bce096f94ab5f685d5fd432eb9f3767347cecc1788413526d0e486b72d82f2ff1680864f3913e8e51f65f13dac0b3619062d8ccc1b11544e5d1cbdfaca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76457c6168b378721855f5de6043be92

SHA1
6c6e558660bc922ea4566c728dc7a399dfb42bb4

SHA256
0ea110765f5acb92cdd157cc24716785a49bf68b0268b70b43111ca22c614d6f

SHA512
b90a5181ea79c2a3a08c0804eeacef3f0198295d80f010950c174de1550a406768dfabcef096ba73193152220aafdb32471490e9be261e8c8ba7f0b1ebb263b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DRZZVUJP\www.google[1].xml

Filesize
95B

MD5
cf0c5fdd471f2e829ce33b9e942cbcf3

SHA1
37b694432cdb13efb90f97e43c783c8a6c1a94b5

SHA256
8017e03e7f85969d791cc5ec1c68b034ff5fe8662ed762439b7b7659e63f200c

SHA512
f228884c0a0197e40fe96ca37026118ddaa09ff74e0b2460276a971ba96006390708e5e03f17ac857cb7e0c6d91627d843e802ad61f534fb34ec295fd46fa2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

Filesize
5KB

MD5
65b0608d8a5c484012f2c9697a971d8d

SHA1
a1f8dd83231018f3838a421788381d34d027a1ef

SHA256
bed990744295505fe94f967ba2bc8b3102b5a452ddaa7a7873d1a9582a492c8a

SHA512
abb535b290cc86ee1266667437d8a92618a9e5bbc14ed82b2c96bbecaf9192823e1b8120ec5f1c494af3020c6ad0092ca98b56b968904eb10530782dda7261bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\FkNC3QKrILcGiXc94rAauJyMGAHApQ6hAvp8TCXOiCY[1].js

Filesize
24KB

MD5
e073ab2d33b1bfeec8a8f5f05d071129

SHA1
b5bc61b7253c1f91fc6c60625a08d14edc2322d6

SHA256
164342dd02ab20b70689773de2b01ab89c8c1801c0a50ea102fa7c4c25ce8826

SHA512
502831cebcefb1e09863689742720de1e655ddff4754cda498ee79a40413d82b3c95967b204f7c5e672f4b80445cc73955e7ab5c404de816bf232d00f21893c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\api[1].js

Filesize
870B

MD5
e9dec22fcfdf664ec4fa785cc2d8317a

SHA1
65b176ba5ab9cac538af82ea4f580c3bf22d0305

SHA256
0f0a70b4ff4a326079d0a1063ae8905940ca4e2529ba64169d42952966f9f693

SHA512
5781361dd03e3a896504f1c8776a9d862ecd103c67925ae0762fd32128a29730887b336fdf2e4dc2ab5f28bf8a84f1e8a98f94ec7d38191044a56251a29d0b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\recaptcha__en[1].js

Filesize
531KB

MD5
2ea96f82197c227ad3d999f6a6fcf54d

SHA1
dc1499948a1822d16cab150eaee16f4ab8c028d8

SHA256
e1d667d61bb50e0a815101a7d0d7f379b7219776fee856eedbe965a049db8d44

SHA512
dafee1d415487b796e02ef295073382aac48ac76e90c749028a9241bd44ec04ec2ee34163b8177f94d01e9e9d87577ec34c18d780a9f17b80923106d992749a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\webworker[1].js

Filesize
102B

MD5
487a5328afcf6c20ddc11ca1b46a4a44

SHA1
f37e030501a0a3ff828bef96481ac1c71043999f

SHA256
de9539c3628315c1a7d33dc3e09dd75767bce3868c188cdc7c90ff207da0fec3

SHA512
71e22ba1a7bcab2f7ddce3153eee1cd961de32a9000c94a59f097cecac9918e94b4cfbd944081a1df4a594f20193bcb39fa7323b3e519e5d5956c342908dc53d

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.exe

Filesize
1.2MB

MD5
568d17d6da77a46e35c8094a7c414375

SHA1
500fa749471dad4ae40da6aa33fd6b2a53bcf200

SHA256
0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615

SHA512
7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D03.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DA2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rig.exe

Filesize
2.4MB

MD5
570a9cc9fd20159e92707abe69676299

SHA1
864cb610c0c80cf8ff00fd4aaae9b05fa63fd990

SHA256
ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f

SHA512
ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K46VZU3Z.txt

Filesize
125B

MD5
56d169201f7d5b1633a07d7990bdd96f

SHA1
9ddb35168cbc28024cc04a32ffa32778543822da

SHA256
c357603801bdb6dd752eba3ebdb3eaedca481e3573cad4569045eaf6e8a85e2d

SHA512
f10fbdae86d696a3cd3b0cb2d7f4a0bca8967b8ecfcdc4812ea8608ee6bd885b698b6435c904f84863c4b434b8b93d925da0eca5c0ad6e5f41f9791bb7b34da5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TNY5J3YS.txt

Filesize
123B

MD5
7243d167f28400309c79e585e7dec4eb

SHA1
7a931f887cd050d40857a04c6cce739fea8cad5a

SHA256
a09772dfc61f0c6b0a898d3775d72af92ce040b8897ad8d52bef30ccfe41a3f3

SHA512
a1858297864688714e95af0c60326af5bd4f4d3372a41f232ba6915ca86a8cbf25a32c49130c14c3a952bd9d86a61420cc02f8e88b4f127decccb9a14765d724

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/1056-60-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/1056-56-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/2304-0-0x000007FEF5723000-0x000007FEF5724000-memory.dmp

Filesize
4KB

Download
memory/2304-1-0x0000000001210000-0x00000000015B2000-memory.dmp

Filesize
3.6MB

Download
memory/2320-35-0x00000000004D0000-0x00000000006BF000-memory.dmp

Filesize
1.9MB

Download
memory/2320-38-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2320-40-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2320-44-0x00000000003C0000-0x000000000090D000-memory.dmp

Filesize
5.3MB

Download
memory/2320-36-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2320-361-0x00000000003C0000-0x000000000090D000-memory.dmp

Filesize
5.3MB

Download
memory/2320-79-0x00000000003C0000-0x000000000090D000-memory.dmp

Filesize
5.3MB

Download
memory/2320-78-0x00000000004D0000-0x00000000006BF000-memory.dmp

Filesize
1.9MB

Download
memory/2372-33-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download
memory/2372-29-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download
memory/2372-61-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2616-50-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/2616-54-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/2876-24-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/2876-20-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/2876-28-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/2876-34-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download