ammyyadmin | hxxp://www[.]ammyy[.]com

Analysis

max time kernel
110s
max time network
112s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.ammyy.com

Score

10^/10

ammyyadmin flawedammyy bootkit discovery persistence rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a324-572.dat	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Blocklisted process makes network request 1 IoCs

flow	pid	Process
124	2304	rundll32.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation	AA_v3.exe

Executes dropped EXE 3 IoCs

pid	Process
1748	AA_v3.exe
2072	AA_v3.exe
2624	AA_v3.exe

Loads dropped DLL 5 IoCs

pid	Process
2072	AA_v3.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	AA_v3.exe
File opened for modification	\??\PhysicalDrive0	AA_v3.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A82946818BB0433A7DC1AFD2189B16AF	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A82946818BB0433A7DC1AFD2189B16AF	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	AA_v3.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 98dd7e54b0fcda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D4AE361-68A3-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431385582"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005498f8ea4968cdf80e012c60a3ccef975bf2f735bb59b9a39e18bc97f21b252d000000000e80000000020000200000001ba3d9581768813c0c36aa984bd5d8d7c10e547056a8c54c00d8c4512dcf81cb90000000eab27f8429e814dd9c20888922c1adc8a319efcdbcc5d8037b6d99470f8498452fd606ba320ca28946961b1844c2e3a4e99e630c8b4097c21df80f33b85950a71ff213442407057fa16f96b9958ccad2b26f32263e94a03b4efedf0a398b7bd889ba274bed8db040cbc5678f08e09a7f21d3e566f92b30d1070c29723657a82a5f15a8d86684896efd119d65687655d5400000008f0272d4e6116f69735d1d7f96b96416cf909425c7f362034acefd934b259001d2465ae6cd04f47d13c6b3a2b9cc0b227b64648a07dbd741892f3dab038a01dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005b5108b7b2b02bc5a6ca023111b0ec8689185b6e0ca4b4db3aeab9e62756e7bc000000000e8000000002000020000000d72773406070d707faffd199a8a05a7ac7aad246763cbdb7e914cd22b438c622200000003b92fca29800a0aa211c08e3f0390ddc5a0c60e9590e5e09622599bb45ea317040000000a15f99c0a102f5321003140658491f552986840f9c83a485c35802a5611405181c8ffa54a2e4fb59080b1bbda17c09121c07878d9d139375246ac761aaa00d40	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b017e564b0fcda01	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}\WpadDecisionTime = 202a785eb0fcda01	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-fd-53-ca-e5-b2\WpadDecision = "0"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-fd-53-ca-e5-b2\WpadDecisionReason = "1"	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-fd-53-ca-e5-b2\WpadDecisionTime = 202a785eb0fcda01	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}\WpadDecisionReason = "1"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = fd187d46d7ebe0f5e41b020775b45179e8665d1faba0d083fa304d4abc5ca32f909819e1744f2ece8c6e74a538c21bd05411d6425a159854cf71d5a5698dc6a7b4d2581d	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}\WpadNetworkName = "Network 3"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}\WpadDecision = "0"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-fd-53-ca-e5-b2	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A73345C-0EE5-42AB-AC74-24145B799F6A}\1e-fd-53-ca-e5-b2	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	rundll32.exe
2304	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2304	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2624	AA_v3.exe
2624	AA_v3.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2624	AA_v3.exe
2624	AA_v3.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2788	2432	iexplore.exe	29
PID 2432 wrote to memory of 2788	2432	iexplore.exe	29
PID 2432 wrote to memory of 2788	2432	iexplore.exe	29
PID 2432 wrote to memory of 2788	2432	iexplore.exe	29
PID 2432 wrote to memory of 1748	2432	iexplore.exe	31
PID 2432 wrote to memory of 1748	2432	iexplore.exe	31
PID 2432 wrote to memory of 1748	2432	iexplore.exe	31
PID 2432 wrote to memory of 1748	2432	iexplore.exe	31
PID 2072 wrote to memory of 2624	2072	AA_v3.exe	33
PID 2072 wrote to memory of 2624	2072	AA_v3.exe	33
PID 2072 wrote to memory of 2624	2072	AA_v3.exe	33
PID 2072 wrote to memory of 2624	2072	AA_v3.exe	33
PID 2624 wrote to memory of 2304	2624	AA_v3.exe	34
PID 2624 wrote to memory of 2304	2624	AA_v3.exe	34
PID 2624 wrote to memory of 2304	2624	AA_v3.exe	34
PID 2624 wrote to memory of 2304	2624	AA_v3.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ammyy.com
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:1748

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe" -service -lunch
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\AA_v3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\ProgramData\AMMYY\aa_nts.log

Filesize
4KB

MD5
418e362de6239db558e0b92ae20210fc

SHA1
74aaa407188ed0a0f698f6bffdf6f4b226db8885

SHA256
0e6ce465d79b3f9ec0eaa38cac45eeba38171e8883b08c071fd27ecdc89a0fd8

SHA512
422e757496bf20f1b00663c816e772853cbb8c198bed674f0a11c041d043ef4c5a45d29c93b953c91e629f8c1b2c5df6cc66aa7b4e0aa6a08cc825194b4f2df0

Download Submit
C:\ProgramData\AMMYY\aa_nts.msg

Filesize
46B

MD5
933352c4d3043610084b53f528bff588

SHA1
e377b6d2f9f789e1678f5dcebc4a821242de2391

SHA256
eea575d851157a6eab3990d6bf9311cbbc10bf0dfa2d0a6d49312ef5b6696085

SHA512
f9e5558cb4f7581c5b1108e2c37ff2689a2c0d5458dd8ec4f84725ecd13827816b5560bf7ecd98dc28aaace0ffbaac59acad2867e4d9384c973f907c6fa276bd

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
327B

MD5
c981fb0c326a776abd0a85c5357a542f

SHA1
d48be5cd95d506413236f55ffdf6e7b14ea6fe31

SHA256
a28e913fc5d5c25216876224e858c1cc5320d8bb192bc3ae4289187de42db5af

SHA512
cca0029afe5a2c950aba72c3c725b23675112233ca23a87560932d0b1326e012b9418147a28adccff6b24650bd16e3b27dbc5d5e8c17d27114e01e7044e48715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
3649a6280c82509df4135d7670cc432c

SHA1
d98bc4a2aa708bbf8ff923b66505739703b90446

SHA256
b47c8a4e4dbd95f63d5e7cdcc649888227b1c0f00ed98c091495dab3ebbed51a

SHA512
72f98be3faf01dca2b224414b2d2f5bd99b10c4d2f93f472a0022f3d7c4c07e939754c2d8802cc4cfa5d36b2015152fa8b7605ff274386b9c2dfec56aa3eb44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
36c103335d2cd8f23a00f7b9c0f8a07b

SHA1
4b2c586458a915c2662c08bd079bbefaa6e92710

SHA256
1590c4578a10c31a24ccd217939fd8916996b1d3ec0fea2760cd089e906d9ba2

SHA512
b7b6a7920c33219096685517edd7d638936fe624233e880469326be381cb1744fbd8ae74b51e0486b0ac4750e16e80c92797cc6d0d5340db67220a495229fde0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7b3541e7077716d565942760e7cdcc8c

SHA1
31f74105642ae3beb6ed0fafe2ab6c574ce7be53

SHA256
d22a296b83d461cfe358525ab5ecf6e5d7a1789708717f56c2b21543065f601f

SHA512
c8f673fad28d03ecefacd4b3712d32d1a982b0dcdd8f39c90d88a09595cb90d5042c219f63cc92574e417792b0705d6f8e30ef3f1fba835170f9965d2100eaea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c266f915be320161cf1aca5b840a51

SHA1
22bf9e7a52bd0c59ddf3ce6cfe43d4a27d92a193

SHA256
8a5f5d88d9d88c02eb9b82c9c4fadd6e4411c1ae607139d89cd0afb3a986e7f2

SHA512
39e5fbbd3b03ada3677cdfaa514cc01f747b067d44a96bd079a7d64849e7054eb0353a14f4cfa9fa0386e5aaf837bec86d58005fa2beb763d5837b8397b9005c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ef62f831b04bd46115f6e7adc2cb4ea

SHA1
dbec16666fbe53223d6cf1bad549fa3edc8116e7

SHA256
1e90f71e2c2f255affe29159bcc54eae4d3b1c77091622fb4c1073118c506ab9

SHA512
f9ec92cc9b84c02fa1e3c0ee4d33f15a4cf17e13ce950577be57a95cdd745e852bf08871f00854f2201cb5f87e3e2b27b6ec8addc1faf0292ebd7a70a6f2632c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3736871c0c8257d132694d04c453b113

SHA1
afabe0b969e70082c246b7bc941eb056237d7fca

SHA256
b606b5087840d3addb28dfd4158ed269c6a176748076b1913b610550e98534cf

SHA512
c1a4821215e9436e9389cb554acb95062550222f5433704693bb435dbce40b4bfb62e2f633859fb4af63ed2b5b58f0f1033ff5306ae23bc2e71407ffefcf747a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
975483c1cc99dbafbe852d11192879a1

SHA1
57c3008cdb77e073d65cbd3a5d3e69317ccf0a4e

SHA256
6160303df77f8a4cb4a567f836e77b70a1a6adcc48d3adca218546e02b931dfe

SHA512
f372e51de048b91c26dda12c99affff3b2dce91235e49cc7843b96d6acfa2dae0e07c4eb821fbb94d9f941a4f08aa2c7d09e4be849580b666dd876e5ec1c9593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be62a92a1163c82c2ecefd931820f72

SHA1
8870ba2c91fe6c6f8fc5f73da9fa16ad9021378a

SHA256
7bdf3658cd8057b90fa6695f8195710f82b5e11f78b073f197d173094278922a

SHA512
beb4686ae5d1d53a66cc1e124c9c0ad1af09501f5615f2a590ab017f22b39e548f865b6f6579881605f0420260edda1891f3845a3c77cb9f72cff9d087e3fa30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37631fe99770e91a97b9a6ca43fb396a

SHA1
f7f7dd98a97bcdc5c0b3e56efe9d28ab79d278e6

SHA256
302a39ecc74cf0a73e9839935a96128c4f5bdb930c94849d9ce9636802d66b72

SHA512
ca8a3c9991ed34b9daa6222e22fc98ecb49b8908ceb7f6e08e08950fa48ed173437e50052d0e3fc6d22c8d78e954a50ad03866d26ba71cc4b678a3f28d59a50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f1581920e9d9cacccea5baf4f41643e

SHA1
801ebf086ff0475d7f4bb89b891569a90f803028

SHA256
a65b327a025d6bd9ecd11a01bdfcf201df5c56fc568833921d711d6290dc34d5

SHA512
5bef4b58029d66461427ac103913d42fdac34c688b5c33f20e7119223614b44d9fb34943a8145c12b703b3caa3bc27a4821bd8ab700850f14d486d9b61c3bcc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a14eca347b6854fa15657682bb52051

SHA1
14ff20ef9bc07491c7df7279626013eb1506bc49

SHA256
91d21906e8c0df7abc5a51e526e127ad434dc9bf928a90f3d44acbe39016c878

SHA512
5d42b86b2912b4c3ddd32b4009ced1faa504eaa88577e01547e923a0d6cb35aa72520fea1bb6110ac4c4c67ab9cb196ee6d6f57b329b07d94a9a4d8c65547a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eee3659dcb44631a257ab7979dbac07

SHA1
ec9940949121e7be3745bb395196f1e64ccc7394

SHA256
55bff072bdf4aea4b0aad99e81d547b340c0816d6cd1cdf5be0f60d1498215fd

SHA512
114dad1cd293f251cdeadd3b42cc84681a80b3c40733ca18de4b8e9da31ab7fb0d63fec676ccf33bfe89c0d6af9e2896b3cc8e733e452049c4c0fdecc90b5c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d748a898fec102f56386cbd6e648717

SHA1
0fb93b2065d76efa0c2e254a6ba3dfab4dbce2ed

SHA256
9c433afaf3590bc60126dce24b7d141ba35fe1ec8d12176b3291800916e02d02

SHA512
1686b3e69cd267b6a3e7a93bea2f55b0500688892b88cbfb8dd03f8eb1aa594f30179602f3edcbec3336fef0063d61945283371bff193e3dd2dd0420b37776a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03f8af0c321ec19088a0c1ed70cfd640

SHA1
58074d2857d1659e105e7d26704e3ed762f8ba0c

SHA256
da709392ebba63f81c75dd49c1d6f9648e2976cc7d1848c7ac2037bd3f0661e0

SHA512
87c7cda2ab1e0dff0cbc620239db84c1e630dd19585a838481939c0419cd5005ebb1bae6e81811ddbf8a09a865b3bdf8f338e5778771569665b2cdf2d52b18de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d765002755e30874c7ea9da7bac9296b

SHA1
8397859b6e1db6817e94c59e4250a3839536e9a6

SHA256
e7e03f97d1d8496a9fa028945c77445a30dcffa2944158c27358eeedab4c5db3

SHA512
9e79fad2de48abe49eebbee3063fcade5f15c83bdcc83f74b2afc7b56fdd4d22f38badc9ba010a71aee5219844e93d011547b8e43e6c25cd7799de866d813e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68cf848bc39bda2bb85141a0269b4e6a

SHA1
37cec5d661beec745bb72c22d5c7c1e2877e66b5

SHA256
f9d3fe20485ab7b9161ab9d948d7d478ecb802a98e4ecfc08bcca174c9453d45

SHA512
872f36ed0482a8f8fe55317919ed5a720194f29528929338611b825b31d119c2de5e27f88597dbc10eb64d038d3a81d13cd36923d070943722a7ca7eb1a466f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e1be6bf298f03d2227db98e85231482

SHA1
c50ff886810d9e0660d9b5119cc739cc0c47693c

SHA256
a681fad2426a8ae0558b4c1307e1c3e02de5bdc9bd713bca9358080d2d359a1b

SHA512
dd9f4b3d57302a8e74d149c792ca2a4812db437ae7addd9dbedbb02aade73c2343ca8528525dcb7d0c914e4a04abb392532c59b1698deef14a702f88ee3ff016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffd8a0b30cc08df3562216b19b37cc9c

SHA1
46fe7ea74b648bdd3ad3922010b8705976b74857

SHA256
efd0ceb4100b6dcd4d3c6d4fc99125b1dfb05e18bce681c655eef2b10838cacd

SHA512
8319f810bdf463aba131276f0ba8f0129382a057eb25c56e179fe70879ca49aaf8b62a0928be3b66e5e7cc809930ad89656945f8acfc22193e6d09b576329190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e740f4bbd52f0de86647fee497980af

SHA1
388c245533ebaf877289cfe6a0a366d6ebb8d03b

SHA256
ed0bb891a702928b9f6986b7604809f6b064cde14f6a784f189da9d23683cb6b

SHA512
3e69f954d832d0de6f772d1ba8635878e4aac567781757d4722bb1bea71055156b7297c3389e3e8cc937ca1f9af53392a68b31cbd75b71d8fb782a6825395450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efb64dfea81200c2d8efac2ca3014f8

SHA1
313baaba7e40a10e9cd3d196d7d8a1116aed0d60

SHA256
0ab205de2ae7f39b41fe718848fd122bb9ac6461d47865843f6823c40fc612c9

SHA512
27e1e043d9882e5f435077e0de03fbf73be1862c4ce5ae7f74bbada6bd8842afe7336e259094dae3cf72b140fe3c6ae05671718497ac5566d634d6e4fe97a8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ef70f44c40159e952a28954deaea6be

SHA1
f9b135c66db82fe3ef711893f30417b900107796

SHA256
dbc6fefd32b8481e1e62c1a6ffb95dd4afce807396db867486847e07e3c5918f

SHA512
106568a620109ce9ad16eb433f61ea7bd2a938c553e3f11b009c90bf122bb5432cd36a55a0f0fe1348bb7ccbcb2cb117a1124845bf148b6ef2bde592bb8cfd9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b76017fc705194eef6cd3de6906a6cb6

SHA1
cd6911e1e66dd5e592d15d0593ef2780a3063c60

SHA256
70ef12a3340fb8ea77f5f0da6587d324e59b72665f125aecac24984ea4d05619

SHA512
eedb3e0a707c9d042cfae9bc6953fde660be2346310b2b217df625bb5104a898cd2b960c9bcbf97ef3e87ec4ac681b66640e52b2bf2252c95bffafbdd6a44cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
845d2dac07dc5be2af68b687ae165c0c

SHA1
4cdb9f4977e6a09e6849fff8d25d2d306230260a

SHA256
5657f2aa6c3b9d0fd0274be085458680687d65e328d543d3b46eb4301d446000

SHA512
18679d542e7f8364881115032a991de719052acf80b50be7fe746b36de0c515c47d9e07ac6241566f4c9029d90cbefaa01e800946a417a2a416bfd0edb446827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96035c56a4a944ad43c8c01bbca43c44

SHA1
a5645da4604b897c39953f493fd6aec8c7b2ae99

SHA256
32357c42d5037eeda2ae0474ad54d2ad93575e82708a03b889e914ac42c26723

SHA512
f2e72ec1245eb252f81d243ee4262ad4e22bb60205187f6df49c58634eb003c8689767b5da7b849610a950ec1e75af1feddd8a2664b518113c71707cfa3add63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3b7efbbf3afd971228d85c39a7f8ed1e

SHA1
4323c2cdb6185d937096cab4d5709a4035d73b8c

SHA256
0177a13db067538b6ba972bc47e4cdf956ac5aa2b7d521897dce2d0b9fa6f3be

SHA512
66ff9524a1f5e7d0b261849e56cd0aec693bc9b314bbabc4807843a4b4a1c1d0b7ddd7c88ad9b2f8ee3cb2bc197e94983b21acedd4a01f2d50e67a59b4adc8ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

Filesize
3KB

MD5
c0768e459a6e312813f7f52ca08b7d73

SHA1
58bd5a1512f0d187d66a06b781b1860f11c6f722

SHA256
66dc21f696350040dd1cd98b576aed0943d731ab1e1528681b369986b0b19908

SHA512
6a6e1dbaf6d06e4ce011334e916c4ae28e2f1845f0b3ae4356573abc59149de2ef70e03a806f8f6a90dbdc1631ed2412763e6db41e75d5629ff5017a7f1808c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\favicon[1].ico

Filesize
3KB

MD5
7af57b731dd3fbbdbfc21610c1cba625

SHA1
7598fb50b822a4e8f599a5863b4a512ebb1c861f

SHA256
2028c61fbf6045ac1766d0c467b762333cb40b7facfc3ccfd58bdcd1fffc361e

SHA512
863d7eb23969339d0ed3f9877cfde3e41aabed3f91bdcb53e034d3103b290f5f66da625f1331528c0546c4286fdb9fd9a6576d40359cbada696cdc56cb67314e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\cb=gapi[1].js

Filesize
67KB

MD5
ed72d618fe48f6fc42c19a4b58511e72

SHA1
80a2da4af91d56ec81c7b672afaaaa72c83a4414

SHA256
5bfd37a756bc7772aa6c520102870dafe2d3b808c562412e30f122a7908f8ad0

SHA512
5378b71a33f67309f788b9fce32daea44051e7e9a6aa326bdd783456ee9eb2f4817aec2ad1e837afc1853acba59080b0114d32c040ea731ebd703f0a84dd7ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\AA_v3[1].exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C89.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C88.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF4080FE08A91214C0.TMP

Filesize
16KB

MD5
acedfb6908b6f9d210d7c66ed738276f

SHA1
0effbe92e282837a82d94df48915b75c8019dea5

SHA256
6bd41b76dbe13b609eca82f4b19dbaf73c95d7153d5fdc7d2bd8989be8f11989

SHA512
e4cec9d0cf33d7986c4e0504d6ed2da79ac2b0ca7e68ae17624204487282f7860d079feb04d95c93eb95fd9246022a7f6977ecd4767064071d104d9d241778f8

Download Submit
memory/2304-655-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/2304-1225-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/2304-1245-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/2304-1254-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download