Cisco Talospublished Dec 8, 19:24 UTC (Dec 8, 2017)ingested Sep 10, 06:19 UTC

Threat Round Up for Dec 01

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article911 words · extracted from blog.talosintelligence.com · click to collapse

Friday, December 8, 2017 14:24

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 01 and December 08. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

Doc.Dropper.Agent-6394293-0
Office Macro Downloader
This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable. The sample was unable to download the next stage so no further analysis is available. Interestingly, this sample attempts to callback using a Tor service by using the onion.link proxy service.
Doc.Macro.Obfuscation-6389653-0
Office Macro
Emotet has slightly altered the VBA macro obfuscation used to hide its obfuscated PowerShell commands. The obfuscation technique leverages a large number of unused VBA APIs relative to the overall lines of code used.
Doc.Macro.Obfuscation-6394435-0
Downloader
We have discovered another trending pattern of Valyria downloaders delivered via malicous email spam. The macro code barely resembles common VBA code at all, save for a few keywords such as AutoOpen & Shell. The bulk of the malicious downloader code is deobfuscated through a long series of cast arrays containing upper cased strings & string splitting via the Mid function.
Win.Packed.Agent-6395107-0
Malicious packer
This style of packed executable has been has been seen recently carrying Firefox credential stealers and Zuzy
Win.Trojan.CeeInject-6394235-0
Trojan
These samples contain the PoSeidon malware. PoSeidon is a Point of Sale malware which gathers credit card information.
Win.Trojan.Delf-6394424-2
Infostealer
This infostealer malware family targets Brazillian users. It pretends to be an update to Adobe Acrobat Reader to steal steal data by getting access to the clipboard. It also tampers with keyboard and mouse activity
Win.Trojan.GenCNs
Trojan
This family is a classic trojan and it has a dropper behavior as well as an adware component. The samples contact many Chinese websites and other remote website. Additional files are downloaded and executed and the sample tries to inject code in another process's address space.
Win.Trojan.Tinba-6390856-0
Trojan
This banking trojan steals sensitive information from the user such as bank account login information by using man-in-the-browser attacks, web injection, or traffic interception.

Threats

Doc.Dropper.Agent-6394293-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
6vt4gbkwnjfnyo6g[.]onion[.]link
ypg7rfjvfywj7jhp[.]onion[.]link
yztnv4ha5rapf6gj[.]onion[.]link Files and or directories created
N/A File Hashes
0099b9221eb92408f0b8bead5d703b5c7ecb11962f49f5e67f60725427318236
094842414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653e0b9f
0b81075cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f44d8c6
0e9b2c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf17263
14a415384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf53db3
2e6523b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d63966
365d356b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e74ace3
3ac9e97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aafc78bb
3cae4325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676ac6c7
3cc669528549cc7394074ac3ffbaa6cf3eed14436a1653d70f54ca2b3d5cdead

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Screenshot

Doc.Macro.Obfuscation-6389653-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
seoexpert4rank[.]com/yfu/
inade[.]mx/KoSZG/
1000id[.]ru/JtcKoSROv/
www[.]ra-lang[.]ch/gNFQe/
nts-tech[.]co[.]kr/RI/ Files and or directories created
N/A File Hashes
93900a04e4d7c629e03f3d510d249f1c8497cf94d818e0ae5913b685e467be6b
0a6d8c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82446af
baf01275b874c04687f84d78451e41231b31bfc0e71995e124830ba63379fedd
5dbf9dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c6d3df
0f236dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a99c6e8
d3e06e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4b4c6a
a44450c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8d9f49
46217dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577e8fbb
4519c2f4fc0bc43cace2e70e464c00e7302e003262d7e6f903672becaba9e8ed

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Doc.Macro.Obfuscation-6394435-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
91[.]121[.]175[.]92
185[.]125[.]46[.]161
95[.]213[.]194[.]234
62[.]109[.]26[.]193 Domain Names
smart-soft[.]pl Files and or directories created
\srvsvc
%Public%\95857.exe
%SystemDrive%\~$7369835.doc
%SystemDrive%\10001.exeFile Hashes
1879023e70e891830300f667e1d08f5d3712d313108795c0fc2234942fc525f4
189f27929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c80d84
2054a559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdbc5f04
33a689526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb46c2a7
33b2b1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775b34cb
404acc127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca38a52d
6591be6105ffedee758410af2d9e6ae849cae900aea514facf42642b6743a62c
68d539f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd684855d
7364757fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae78c633
a658d88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be26574fa8
af732649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5a949f
b0010bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84a7ddb
bc8bb9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792ac92f
c7d07eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575e6757
d322b11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e4854683
d35c4be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a36062
dcc5cc23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f0f324
deb9f507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf63c73
df79ffd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5adfe26
e1fe9f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43cbcc40
e3c59888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212f712b
e67446529af580230d0f007e9805a93978885a440dc68029744d951db5b07914
f348c2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aae6415
f68502a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f80e28
faa0729ac6b3dc7cdfbeb5c042e4d9ff95ecfa51d1c3efdaf79560f9c27956b8

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Screenshot

Win.Packed.Agent-6395107-0

Indicators of Compromise
Registry Keys

N/A Mutexes
3749282D282E1E80C56CAE5A IP Addresses
52[.]76[.]169[.]66 Domain Names
www[.]loki5[.]info
hkfb[.]01power[.]net Files and or directories created
N/A File Hashes
085dbab7e810819bff0abe261e1d7015cbb4de4bb54261d547a7fa91e4d09d88
95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80
df77604366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858fb15fc
3edef9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d0498f
111df72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d452a009
918911a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3fdbaa5
89d660f623dc3b4a64986709076b0923c85a88d23648156badf61897d40970fb
4fedc2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360e8987
1b011c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de76648c
5e243d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd632666c122
a3c28f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf969998866fa1
b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f75a630

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Trojan.CeeInject-6394235-0

Indicators of Compromise
Registry Keys

<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyServer
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: _FileId_
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: ObjectName
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: Type
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: _Usn_
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
Value: ObjectLru
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: AeProgramID
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: DisplayName
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: AeFileID
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: AeFileID
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000095A9
Value: AB6
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
Value: ObjectLru
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: _FileId_
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: _UsnJournalId_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: UNCAsIntranet
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
Value: WpadDecisionTime
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\11000000005DAF
Value: AB5
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: _ObjectLru_
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
Value: ObjectId
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
Value: WpadDecision
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
Value: WpadDecisionTime
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: ErrorControl
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: _ObjectLru_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
Value: WpadDecision
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: AutoDetect
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoDetect
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
Value: CachePrefix
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
Value: WpadDetectedUrl
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: _ObjectId_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: DefaultConnectionSettings
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
Value: CachePrefix
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
Value: ObjectId
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyEnable
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE
Value: _CurrentObjectId_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
Value: WpadDetectedUrl
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: _Usn_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
Value: WpadDecisionReason
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: AeProgramID
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: SavedLegacySettings
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
Value: WpadNetworkName
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST
Value: CurrentLru
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value: _UsnJournalId_
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyOverride
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
Value: 10000000095A9
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
Value: _ObjectId_
<HKU>\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
Value: LanguageList
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoConfigURL
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: WOW64
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
Value: WpadDecisionReason
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: Start
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
Value: ImagePath
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
Value: 11000000005DAF
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
<HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\SmartCardRoot
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\CA
<HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Disallowed
<HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000095A9
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WinHost
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CTLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Root
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CRLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3a-57-d6-05-63-ab
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\Indexes
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Root
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\My
<HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople
<HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\trust
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\Indexes
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\TrustedPeople
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Root
<HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CTLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\TrustedPeople
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\Certificates
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\11000000005DAF
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\Certificates
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CRLs
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\CA
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLs
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Disallowed
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CTLs
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
<A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}\3a-57-d6-05-63-ab
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\trust
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Root
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\trust
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CTLs Mutexes
WinHostWD
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex IP Addresses
144[.]217[.]254[.]90 Domain Names
linturefa[.]ru Files and or directories created
%WinDir%\SysWOW64\WinHost.exe File Hashes
daee59ee955587d378dd6dc11af1a702d554c7926a9f42bac3752732c33e9317
1a7de2ac4b22ca77acef5afe8e8b45dcc5150deb3408c8934221cfbbaee0655e
fe33dc8941a6cd8ef4f64af295c2066eb0974966dfb355b5dd57e0c277261033
62a22fb0f59578de3679f70a41c2971b384167aebb032dd782f1d23d27015aa3
b7ad41fbecce918894c0645aedbc60e4ac8daee24405b6a4957c98a728a14b9a
58e226e02f8dded4b24ae60d2524497083c3d0dafb02436df5209fa9e1061085
d065ba2603790329d31e35cd45538b693c77f9870d98c4656e490c1a5034a8fa
36d4800fb0bed77e59468ae9b732eb806d59999ec2832a72e0209473069af5b1
3507a76940a2e6c930882b5cde32d2f11ba48cc0e6bfd6e4771a973ebe9db5ab
952e29ae44bb49c78f2b3fcd8c13e22181bc0a610e36723e41b79f8c1147649f

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Trojan.Delf-6394424-2

Indicators of Compromise
Registry Keys

<HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: SavedLegacySettings
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
Value: CachePrefix
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
Value: LanguageList
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
Value: CachePrefix Mutexes
IP Addresses
191[.]252[.]186[.]108 Domain Names
N/A Files and or directories created
\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.chk
\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
\Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\slideshow.ini
\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat File Hashes
04c3a321d00b8f54ae242969ede062ae10b8906ba5d7071fd0aa4f3b3b4ef73e
248b6182fe5aaa120a6ad009595a93bf9431cbcd3e723ad711aef9b2d4562abf
3b221118a4c2716c6c76ddc1b6b01866fcc2643d7c29e38279d6aa2dd27d60a7
3dde0bb92308140701cb61711dc7e7298baff68668d96d2db9390e2b691efeb9
44e27c54ae3dc4c4c228dc10389d2b28d1230a8933d61661271f4eaf65925b1f
482142f886ed2ee2610e2740695435e0488b5c7d6081daaeffdc93c87b6e2f93
4bdae37fe1f8dab61a16f406f08a3bbe1482cd1387351f23b29849e1de64875d
67ed3caf144d2b2dd0e8f0b6ed4de1e0ee4052e152cf32fdc22b9a3f8c935e67
75eecd86ca4cbc10e60a6b5dc85964374fd91b25f0ecf08dcb7cd96d726ec581
7a41c90ba46f40af093491c1f03fa64b36c6a10603c29a9af78540cde8440d60
8486ba3a5d2ae2297118de5f39770fb89227752bbe3e59f951cd0ef0bab8c5b5
9b6087e9607aa0149beecd97709d27cf2e3703fded3f7d31dd613a6d3f23ccaf
b17f8e85944768cc88c0a3b7103290c6eab820348103fa7a8a412af945e1d1dc
b7c8faa19fb394f42733df9c1bc7c5f0a5313ead7b0ec870c0db05f6e3baa910
c14055b23eb3a90e163962c9c70df3338bca68b67a615531ef40c6e8f8f6eabe
c45fabfd7e6f52fa519d8215ac1d569ca385bb4552eae82e63da4befa319f1d9
cc1eadad7810c4c94cdeebd63b7e54604253c4651c3a31bdf27dc96c189baa10
d44dff94eaf9ed08c7f4ef47e69e0a9b308ce49c8bc814b94b2c95c92ba53fc3
db1181dbda2b6053b008568b8f2f7b8a98cc3bd30fbea83ac8f69900d657e56f
f1db091fff240dd3d49f0d22d4809db237fda042cb7ddf7afc81a0430f5c4b8c
f6bad3bc203c29350726c32d2aad744479de84bc72e1ffed0ad8392e5dde43d0

Coverage

Screenshots of Detection AMP

ThreatGrid

Screenshot

Win.Trojan.GenCNs

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
Value: Type
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
Value: Count
<HKLM>\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\189271E573FED295A8C130EAF357A20C4A9F115E
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
Value: Time
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
Value: FullScreen
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpInterfaceOptions
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMAINSUGGESTION
Value: NextUpdateDate
<HKLM>\SOFTWARE\Classes\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
Value: Type
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
Value: Count
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
Value: CacheRepair
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyOverride
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
Value: Type
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
Value: Blocked
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
Value: LastProcessed
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
Value: Count
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
Value: DhcpScopeID
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
Value: Time
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
Value: CachePrefix
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpDomain
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
Value: Count
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\iexplore
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: DefaultConnectionSettings
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyEnable
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
Value: CacheLimit
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNameServer
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
Value: CachePath
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOWSSEARCH
Value: Version
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
Value: MFV
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNameServerList
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
Value: NextCheckForUpdateLowDateTime
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
Value: LoadTimeArray
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
Value: CompatibilityFlags
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNetbiosOptions
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
Value: Collection
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
Value: Blocked
<HKU>\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
Value: Blocked
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
Value: Time
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore
<HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\PENDINGRECOVERY
Value: AdminActive
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value: DhcpNameServer
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpSubnetMaskOpt
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\52DFG.COM
Value: NumberOfSubdomains
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
Value: LoadTimeArray
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
Value: Type
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
Value: Time
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
Value: {6C9F4A61-DA9E-11E7-BE93-00501E3AE7B5}
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value: DhcpDomain
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
Value: LanguageList
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
Value: Type
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
Value: Count
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
Value: {00000000-0000-0000-0000-000000000000}
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
Value: NextCheckForUpdateHighDateTime
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
Value: Time
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\BAIDU.COM
Value: Total
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpDefaultGateway
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
Value: Time
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
Value: Type
<HKLM>\SOFTWARE\WOW6432NODE\JAVASOFT\JAVA WEB START\1.6.0_41
Value: Home
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: UNCAsIntranet
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
Value: CacheOptions
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: SavedLegacySettings
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\52DFG.COM
Value: Total
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyServer
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
Value: DecayDateQueue
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
Value: Window_Placement
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
Value: Count
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\BAIDU.COM
Value: NumberOfSubdomains
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMAINSUGGESTION\FILENAMES
Value: en-US
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
Value: {17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore
<HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoConfigURL
<HKCU>\SOFTWARE\MICROSOFT\MULTIMEDIA\DRAWDIB
Value: 1024x768x24(BGR 0)
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
<HKCU>\Software\Microsoft\SystemCertificates\My
<HKU>\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKCU>\Software\Microsoft\Internet Explorer\Toolbar
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Root
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKCU>\Software\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\SmartCardRoot
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\SOFTWARE\RegisteredApplications
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Disallowed
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\www.52dfg.com
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHist012017120620171207
<HKCU>\Software\Policies\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CTLs
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\pos.baidu.com
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKCU>\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CRLs
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\52dfg.com
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\trust
<HKLM>\Software\Microsoft\SystemCertificates\trust
<HKCU>\Software\Microsoft\Internet Explorer\Main\WindowsSearch
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKU>\Software\Microsoft\Internet Explorer\Recovery\Active
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKU>\Software\Microsoft\Internet Explorer\International\CpMRU
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKCU>\Software\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKCU>\Software\Microsoft\SystemCertificates\Root
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
<HKCU>\Software\Microsoft\SystemCertificates\SmartCardRoot
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\TrustedPeople
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Root
<HKCU>\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CTLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLs
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKLM>\Software\Microsoft\SystemCertificates\CA
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\TrustedPeople
<HKLM>\Software\Microsoft\SystemCertificates\Disallowed
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\Certificates
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\cpu.baidu.com
<HKU>\Software\Microsoft\Windows\ShellNoRoam\MUICache
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\Certificates
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CRLs
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\CA
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
<HKU>\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKCU>\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKCU>\Software\Microsoft\Multimedia\DrawDib
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLs
<HKCU>\Software\Microsoft\Internet Explorer\Main
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\CA
<HKCU>\Software\Policies\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CTLs
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKCU>\Software\Policies\Microsoft\SystemCertificates\Disallowed
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Disallowed
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\Total
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\CA
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
<HKCU>\Software\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Root
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\trust
<HKCU>\Software\Microsoft\SystemCertificates\Disallowed
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
<HKCU>\Software\Microsoft\Windows Script\Settings
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CTLs Mutexes
!IECompat!Mutex
IsoScope_2f4_IESQMMUTEX_0_274
Local\URLBLOCK_DOWNLOAD_MUTEX
{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_756
UpdatingNewTabPageData
IsoScope_2f4_IESQMMUTEX_0_331
Local\VERMGMTBlockListFileMutex
Local\DirectSound DllMain mutex (0x000006A8)
IsoScope_2f4_ConnHashTable<756>_HashTable_Mutex
!IEFileUpdater!Mutex
Local\InternetExplorerDOMStoreQuota
Local\URLBLOCK_HASHFILESWITCH_MUTEX
Local\ZonesLockedCacheCounterMutex
Local\https://cpu.baidu.com/
IsoScope_2f4_IESQMMUTEX_0_303
IsoScope_2f4_IESQMMUTEX_0_519
Local\https://pos.baidu.com/
!PrivacIE!SharedMem!Mutex
Local\MSCTF.Asm.MutexDefault1
{5312EE61-79E3-4A24-BFE1-132B85B23C3A}
{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}
Local\!BrowserEmulation!SharedMemory!Mutex IP Addresses
106[.]39[.]162[.]36
61[.]135[.]185[.]23
117[.]27[.]232[.]35
106[.]11[.]30[.]202
104[.]27[.]97[.]74
66[.]102[.]255[.]61
116[.]253[.]191[.]237
106[.]11[.]30[.]205
103[.]7[.]29[.]251
111[.]202[.]114[.]35
204[.]79[.]197[.]200
66[.]102[.]255[.]57
66[.]198[.]178[.]124
140[.]205[.]250[.]8
103[.]235[.]46[.]191
140[.]205[.]248[.]60
120[.]132[.]3[.]45
106[.]11[.]93[.]16
66[.]102[.]255[.]39
104[.]27[.]96[.]74
66[.]198[.]178[.]122
104[.]27[.]93[.]74
165[.]254[.]60[.]146
65[.]153[.]196[.]195
65[.]153[.]196[.]196
198[.]11[.]132[.]221
66[.]198[.]24[.]253
111[.]202[.]114[.]81
66[.]231[.]239[.]122
66[.]231[.]239[.]120
47[.]89[.]67[.]254
66[.]231[.]239[.]124
140[.]205[.]60[.]79
140[.]205[.]218[.]67
119[.]146[.]74[.]34
65[.]153[.]158[.]144
104[.]193[.]88[.]109
220[.]170[.]182[.]31
103[.]235[.]46[.]39
66[.]102[.]255[.]42
66[.]102[.]255[.]43
111[.]206[.]37[.]219
222[.]186[.]49[.]224
66[.]102[.]255[.]45
66[.]102[.]255[.]50
140[.]205[.]136[.]1
140[.]205[.]158[.]4
66[.]102[.]255[.]44
112[.]80[.]255[.]55
47[.]89[.]69[.]254
104[.]27[.]92[.]74
180[.]76[.]22[.]48
65[.]153[.]196[.]201
112[.]80[.]248[.]186
106[.]11[.]129[.]144
66[.]198[.]24[.]243
14[.]215[.]178[.]152
65[.]153[.]196[.]200
106[.]11[.]209[.]24
65[.]153[.]196[.]202
65[.]153[.]196[.]203
103[.]235[.]46[.]40
65[.]153[.]158[.]143
65[.]153[.]158[.]145
119[.]146[.]74[.]49
140[.]205[.]61[.]61
65[.]153[.]158[.]148
66[.]231[.]239[.]92
115[.]239[.]210[.]141
140[.]205[.]61[.]85
140[.]205[.]218[.]72 Domain Names
www[.]taobao[.]com
fj[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
z13[.]cnzz[.]com
pos[.]baidu[.]com
static[.]fraudmetrix[.]cn
dfjs[.]1235k[.]com
f11[.]baidu[.]com
cm[.]pos[.]baidu[.]com
cpu[.]baidu[.]com
dup[.]baidustatic[.]com
gss1[.]bdstatic[.]com
cnzz[.]mmstat[.]com
zz[.]1235k[.]com
cpro[.]baidustatic[.]com
fp[.]fraudmetrix[.]cn
icon[.]cnzz[.]com
sslshare[.]jomodns[.]com
f12[.]baidu[.]com
wn[.]pos[.]e[.]shifen[.]com
imageplus[.]baidu[.]com
wmjs[.]jomodns[.]com
ope[.]tanx[.]com
ad-sh-sz-zb[.]wagbridge[.]tanx[.]alimama[.]com[.]gds[.]alibabadns[.]com
zz[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
webb[.]jomodns[.]com
gw[.]aicdn[.]com
opencdn[.]jomodns[.]com
publish-pic-cpu[.]baidu[.]com
eclick[.]baidu[.]com
atanx[.]alicdn[.]com
p[.]tanx[.]com
c[.]cnzz[.]com
apisoft[.]df0535[.]com[.]cname[.]yunjiasu-cdn[.]net
www[.]52dfg[.]com
dfjs[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
ope[.]gds[.]tanx[.]com
bzclk[.]e[.]shifen[.]com
fj[.]1235k[.]com
f10[.]baidu[.]com
wn[.]pos[.]baidu[.]com
hm[.]baidu[.]com
sp0[.]baidu[.]com
world[.]taobao[.]com
u755[.]v[.]qingcdn[.]com
cm[.]pos[.]e[.]shifen[.]com
simage[.]gshifen[.]com
z[.]gds[.]cnzz[.]com
cb[.]e[.]shifen[.]com
all[.]cnzz[.]com[.]danuoyi[.]tbcache[.]com
apisoft[.]df0535[.]com
bzclk[.]baidu[.]com
7xjnh3[.]com2[.]z0[.]glb[.]qiniucdn[.]com
caclick[.]baidu[.]com
atanx[.]alicdn[.]com[.]danuoyi[.]tbcache[.]com
z11[.]cnzz[.]com
imageplus[.]e[.]shifen[.]com
ecomcbjs[.]jomodns[.]com
cpu[.]e[.]shifen[.]com
open[.]t[.]qq[.]com
origin[.]open[.]qq[.]com
jpaasne[.]e[.]shifen[.]com
s4[.]cnzz[.]com
ieonline[.]microsoft[.]com
flashservice[.]adobe[.]com Files and or directories created
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\thread-next[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\fb[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\avatar[1].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\style_1_forum_viewthread[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\ex[1].js
\TEMP\AppData\wwblist.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\checkonline.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\style_1_common[1].css
%SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@1235k[1].txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\px[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[2].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\forum[1].js
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{775A3D20-DA9E-11E7-BE93-00501E3AE7B5}.dat
%AppData%\Microsoft\Windows\Cookies\MTSHQBBR.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qq_share[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\bd_logo[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=1555995088,2202163700&fm=76[1].jpg
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\arw_r[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\stat[1].js
\TEMP\AppLink\sql.dll
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[1].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\fm[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\MWWX7599.htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\userinfo[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\jquery-1.8.3.min[1].js
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\showip.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arw[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\detect[1].js
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF4E88.tmp
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6C9F4A61-DA9E-11E7-BE93-00501E3AE7B5}.dat
%AppData%\Microsoft\Windows\Cookies\28944M2J.txt
\TEMP\gzcvaqtzdusmspytflzf.dfg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\showip.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\6108[1].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fj_btn[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\search[1].png
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6C9F4A63-DA9E-11E7-BE93-00501E3AE7B5}.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[5].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\noavatar_small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\log[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\20171206005032_61527[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\nv[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\share_btn[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\md5[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\favicon[2].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\58d12356-49a1-4b13-8946-cf0414ecedd8[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\arw_r[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V0100010.log
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-100646-1-1[1].htm
\TEMP\AppData\QS.db
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\59_avatar_middle[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-next[1].png
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\print[1].png
%SystemDrive%\gpoigmfsdzfgohtecxlq.dfg (copy)
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\style_1_common[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\seditor[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\fav[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[4].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\jquery-1.8.3.min[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[3].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[1].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pengyou[1].png
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\qmenu[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\ico_lz[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[2].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\highlight.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pc_ads_bear.1x[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\adClosefeedbackUpgrade.min[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\switch_width[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\background[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\oshr[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\df_logo[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qmenu[1].png
%SystemDrive%\Documents and Settings\Administrator\Cookies\[email protected][1].txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\bg_rb[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fastreply[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\i[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\53_avatar_small[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[3].htm
%AppData%\Microsoft\Windows\Cookies\IDOPFIC9.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\forum_viewthread[1].js
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{17DE33AB-DA76-11E7-800A-00007D8081C0}.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\kindeditor-min[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\list-style-119[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\2f57811a-a7ec-49be-8a67-fcae1fecd305[1].jpg
%AppData%\Microsoft\Windows\Cookies\AZ8N99IZ.txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\background[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\editor[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\scrolltop[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\px[1].png
%AppData%\Microsoft\Windows\Cookies\AISN47QD.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\c[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\vchm[1].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\tongdun[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=4262931832,9247409&fm=76[1].jpg
%AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\fm[1].js
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\common[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\stat[1].htm
%AppData%\Microsoft\Windows\Cookies\FTBCR8D3.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\stick.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DOMStore\R85DXRAK\cpu.baidu[1].xml
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dfg.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\coreMobilePc[1].js
%SystemDrive%\AppData\QS.db
\TEMP\AppData\wwwlist.txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\logging[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\bump.small[1].gif
%SystemDrive%\Documents and Settings\Administrator\Cookies\[email protected][2].txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\noavatar_middle[2].gif
%AppData%\Microsoft\Windows\Cookies\3BST8HRF.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\36_avatar_small[1].jpg
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\checkonline.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\style[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\hot_3[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\collection[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\cba256a9-f1e4-429e-a5c2-cade0a1ff7ad[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\profile[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=1130617034,1673256959&fm=76[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=725440160,1310097331&fm=76[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[1].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\open.small[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\qq_login[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\online_moderator[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qzone[1].gif
%TEMP%\dfg.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[4].htm
%AppData%\Microsoft\Windows\Cookies\GURHNPBW.txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{17DE33AA-DA76-11E7-800A-00007D8081C0}.dat
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\md5[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\weibo[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fp[1].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\pt_item[1].png
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\arw_l[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\default[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\pn_post[1].png
%AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\da98dd37-304c-4f34-8692-963ad9d3fb83
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\userinfo[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\pn_post[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\dm[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pn[1].png
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\jquery-1.8.3.min[1].js
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF274C.tmp
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\qshare[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\20171206005032_61527[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\tanxssp[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\settop[1].png
%SystemDrive%\AppData\QS.db-journal
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\wh[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\qq_login[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\hm[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\25_avatar_small[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[3].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\search[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.chk
%SystemDrive%\AppLink\sql.dll
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\comm[1].js
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\nv[1].png
\TEMP\AppData\AppConfig.ini
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\fp[1].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\hot_3[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\print[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\midavt_shadow[1].gif
%AppData%\Microsoft\Windows\Cookies\OL83W4WY.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\core[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[5].htm
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\pn[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[4].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\logging[1].js
%AppData%\Microsoft\Windows\Cookies\3QDRLGBW.txt
%AppData%\Microsoft\Windows\Cookies\BWJZDR10.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arrow_top[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\home[1].js
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\imagestore\aowwxkh\imagestore.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\locked[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\clear[1].swf
%AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\Preferred
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-prev[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\close.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\pc_ads.1x[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\cf2ca419-ddee-4d2b-856a-3354b551e5a3[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\o[1].htm
%SystemDrive%\287140881.exe
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\forum_viewthread[1].js
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\nv_a[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\common[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\232719bv8ve5cvzl1l8zls[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017120620171207\container.dat
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\arw_l[1].gif
\TEMP\ÈÕÖ¾\²Ù×÷ÈÕÖ¾2017Äê12ÔÂ6ÈÕ.txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\jquery-1.8.3.min[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\rar[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pt_item[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\ad[1].gif
\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DOMStore\ROKQPSRG\www.52dfg[1].xml
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\nv_a[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\namepost.small[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\pic1[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[2].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arrwd[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\31_avatar_small[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\online_member[1].gif
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=2144616610,2983434978&fm=76[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\43_avatar_middle[1].jpg
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\fj_btn[1].png
\TEMP\AppData\qblist.txt
\TEMP\AppData\qwlist.txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\style[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=4083043643,3990593241&fm=76[1].jpg
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\switch_width[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\avatar[2].htm
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\u=1199205626,971402299&fm=76[1].jpg
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\ui[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\icon[1].gif
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\thread-100646-1-1[1].html
%SystemDrive%\Documents and Settings\Administrator\Cookies\[email protected][1].txt
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\comm[1].js
\TEMP\093477fa334791163629386b655b01a8284cf9826760b2dd9c3046e370ce026b.exe
%SystemDrive%\AppData\AppConfig.ini
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\style_1_forum_viewthread[1].css
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\favicon[1].ico
%SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\df_logo[1].png
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\cb_pc[1].js
%SystemDrive%\ \ 2017 12 6 .txt
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\forum[1].js
\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\list-entry[1].js File Hashes
093477fa334791163629386b655b01a8284cf9826760b2dd9c3046e370ce026b
32529dd47d10c539f3b8334ba849decf6b7707196ab8bcc893dd3e4aa4399c3e
354c9f630336cce0332558d73ae8000b62f61ca3eb7462e21183546f0da613b8
36992980b5db3833a294748ce2abe530b9313dad5b0a8094bf9b10106ecbf250
3e47b0d23d7e39af6759ca207d3307584862fe4181a6a4a54ea38cd45ce8c542

Coverage

Screenshots of Detection AMP

ThreatGrid

Screenshot

Win.Trojan.Tinba-6390856-0

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: F9E7DE7B
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: internat.exe
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run Mutexes
F9E7DE7B IP Addresses
N/A Domain Names
N/AFiles and or directories created
%AppData%\F9E7DE7B\bin.exe File Hashes
cc235fb882372820d6232ba89455e5da28bc9b1877e528ac2397d280b0a7d5ff
baf4a030d51e688aebe5d190334f9751339e75b79c55e1ae9e277b7a33dd8808
17147dc9d03023c4772817b6904676eb9417be3294d998ba118bf0a9d1f0d6d6
afdcc240157e03a46e8141ee99b24e4d6bcbe37c2a8d1b30e6ea860496cc3352
eef6f6d965da6f45e376eb9e5e01451ea110466e4b02780625cd5170edad4119
52d0de1c298a088a0455941e1fe0e7894671db98338a34febf4f9870aa4f387c
bda3c8f957b7195dec6d5f2f4114022346aef9791ca434943876359d3d4f15e8
b3e98e2aed557dad670309692bdc0c6d7d580ea51933449ed01354bf2dd8ca3e

Coverage

Screenshots of Detection AMP

ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-1201-1208/

Type	Indicator	Context
domain	1000id.ru	/A Domain Names seoexpert4rank[.]com/yfu/ inade[.]mx/KoSZG/ 1000id[.]ru/JtcKoSROv/ www[.]ra-lang[.]ch/gNFQe/ nts-tech[.]co[.]kr/R
domain	6vt4gbkwnjfnyo6g.onion.link	Registry Keys N/A Mutexes N/A IP Addresses N/A Domain Names 6vt4gbkwnjfnyo6g[.]onion[.]link ypg7rfjvfywj7jhp[.]onion[.]link yztnv4ha5rapf6gj[.]onio
domain	hkfb.01power.net	ddresses 52[.]76[.]169[.]66 Domain Names www[.]loki5[.]info hkfb[.]01power[.]net Files and or directories created N/A File Hashes 085dba
domain	inade.mx	N/A IP Addresses N/A Domain Names seoexpert4rank[.]com/yfu/ inade[.]mx/KoSZG/ 1000id[.]ru/JtcKoSROv/ www[.]ra-lang[.]ch/gNFQe/ n
domain	nts-tech.co.kr	]mx/KoSZG/ 1000id[.]ru/JtcKoSROv/ www[.]ra-lang[.]ch/gNFQe/ nts-tech[.]co[.]kr/RI/ Files and or directories created N/A File Hashes 93
domain	seoexpert4rank.com	Registry Keys N/A Mutexes N/A IP Addresses N/A Domain Names seoexpert4rank[.]com/yfu/ inade[.]mx/KoSZG/ 1000id[.]ru/JtcKoSROv/ www[.]ra-la
domain	smart-soft.pl	.]161 95[.]213[.]194[.]234 62[.]109[.]26[.]193 Domain Names smart-soft[.]pl Files and or directories created \srvsvc %Public%\95857.e
domain	www.loki5.info	2E1E80C56CAE5A IP Addresses 52[.]76[.]169[.]66 Domain Names www[.]loki5[.]info hkfb[.]01power[.]net Files and or directories created N
domain	www.ra-lang.ch	rt4rank[.]com/yfu/ inade[.]mx/KoSZG/ 1000id[.]ru/JtcKoSROv/ www[.]ra-lang[.]ch/gNFQe/ nts-tech[.]co[.]kr/RI/ Files and or directories
domain	ypg7rfjvfywj7jhp.onion.link	Addresses N/A Domain Names 6vt4gbkwnjfnyo6g[.]onion[.]link ypg7rfjvfywj7jhp[.]onion[.]link yztnv4ha5rapf6gj[.]onion[.]link Files and or directorie
domain	yztnv4ha5rapf6gj.onion.link	gbkwnjfnyo6g[.]onion[.]link ypg7rfjvfywj7jhp[.]onion[.]link yztnv4ha5rapf6gj[.]onion[.]link Files and or directories created N/A File Hashes 0099b9
sha256	0099b9221eb92408f0b8bead5d703b5c7ecb11962f49f5e67f60725427318236	ion[.]link Files and or directories created N/A File Hashes 0099b9221eb92408f0b8bead5d703b5c7ecb11962f49f5e67f60725427318236 094842414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653
sha256	085dbab7e810819bff0abe261e1d7015cbb4de4bb54261d547a7fa91e4d09d88	ower[.]net Files and or directories created N/A File Hashes 085dbab7e810819bff0abe261e1d7015cbb4de4bb54261d547a7fa91e4d09d88 95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5
sha256	094842414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653e0b9f	9221eb92408f0b8bead5d703b5c7ecb11962f49f5e67f60725427318236 094842414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653e0b9f 0b81075cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f4
sha256	0a6d8c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82446af	a04e4d7c629e03f3d510d249f1c8497cf94d818e0ae5913b685e467be6b 0a6d8c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82446af baf01275b874c04687f84d78451e41231b31bfc0e71995e124830ba6337
sha256	0b81075cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f44d8c6	2414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653e0b9f 0b81075cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f44d8c6 0e9b2c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf
sha256	0e9b2c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf17263	75cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f44d8c6 0e9b2c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf17263 14a415384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf
sha256	0f236dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a99c6e8	dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c6d3df 0f236dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a99c6e8 d3e06e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4
sha256	111df72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d452a009	9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d0498f 111df72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d452a009 918911a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3f
sha256	14a415384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf53db3	c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf17263 14a415384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf53db3 2e6523b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d
sha256	1879023e70e891830300f667e1d08f5d3712d313108795c0fc2234942fc525f4	temDrive%\~$7369835.doc %SystemDrive%\10001.exe File Hashes 1879023e70e891830300f667e1d08f5d3712d313108795c0fc2234942fc525f4 189f27929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c
sha256	189f27929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c80d84	23e70e891830300f667e1d08f5d3712d313108795c0fc2234942fc525f4 189f27929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c80d84 2054a559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdb
sha256	1b011c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de76648c	2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360e8987 1b011c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de76648c 5e243d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd63266
sha256	2054a559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdbc5f04	7929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c80d84 2054a559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdbc5f04 33a689526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb4
sha256	2e6523b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d63966	5384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf53db3 2e6523b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d63966 365d356b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e7
sha256	33a689526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb46c2a7	559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdbc5f04 33a689526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb46c2a7 33b2b1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775
sha256	33b2b1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775b34cb	9526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb46c2a7 33b2b1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775b34cb 404acc127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca3
sha256	365d356b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e74ace3	3b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d63966 365d356b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e74ace3 3ac9e97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aaf
sha256	3ac9e97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aafc78bb	56b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e74ace3 3ac9e97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aafc78bb 3cae4325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676
sha256	3cae4325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676ac6c7	97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aafc78bb 3cae4325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676ac6c7 3cc669528549cc7394074ac3ffbaa6cf3eed14436a1653d70f54ca2b3d5
sha256	3cc669528549cc7394074ac3ffbaa6cf3eed14436a1653d70f54ca2b3d5cdead	325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676ac6c7 3cc669528549cc7394074ac3ffbaa6cf3eed14436a1653d70f54ca2b3d5cdead Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256	3edef9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d0498f	04366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858fb15fc 3edef9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d0498f 111df72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d45
sha256	404acc127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca38a52d	1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775b34cb 404acc127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca38a52d 6591be6105ffedee758410af2d9e6ae849cae900aea514facf42642b674
sha256	4519c2f4fc0bc43cace2e70e464c00e7302e003262d7e6f903672becaba9e8ed	dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577e8fbb 4519c2f4fc0bc43cace2e70e464c00e7302e003262d7e6f903672becaba9e8ed Coverage Screenshots of Detection AMP ThreatGrid Umbrella D
sha256	46217dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577e8fbb	0c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8d9f49 46217dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577e8fbb 4519c2f4fc0bc43cace2e70e464c00e7302e003262d7e6f903672becaba
sha256	4fedc2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360e8987	0f623dc3b4a64986709076b0923c85a88d23648156badf61897d40970fb 4fedc2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360e8987 1b011c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de7
sha256	5dbf9dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c6d3df	275b874c04687f84d78451e41231b31bfc0e71995e124830ba63379fedd 5dbf9dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c6d3df 0f236dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a9
sha256	5e243d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd632666c122	c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de76648c 5e243d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd632666c122 a3c28f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf9699988
sha256	6591be6105ffedee758410af2d9e6ae849cae900aea514facf42642b6743a62c	c127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca38a52d 6591be6105ffedee758410af2d9e6ae849cae900aea514facf42642b6743a62c 68d539f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd68
sha256	68d539f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd684855d	e6105ffedee758410af2d9e6ae849cae900aea514facf42642b6743a62c 68d539f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd684855d 7364757fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae7
sha256	7364757fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae78c633	9f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd684855d 7364757fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae78c633 a658d88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be265
sha256	89d660f623dc3b4a64986709076b0923c85a88d23648156badf61897d40970fb	1a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3fdbaa5 89d660f623dc3b4a64986709076b0923c85a88d23648156badf61897d40970fb 4fedc2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360
sha256	918911a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3fdbaa5	72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d452a009 918911a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3fdbaa5 89d660f623dc3b4a64986709076b0923c85a88d23648156badf61897d40
sha256	93900a04e4d7c629e03f3d510d249f1c8497cf94d818e0ae5913b685e467be6b	o[.]kr/RI/ Files and or directories created N/A File Hashes 93900a04e4d7c629e03f3d510d249f1c8497cf94d818e0ae5913b685e467be6b 0a6d8c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82
sha256	95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80	ab7e810819bff0abe261e1d7015cbb4de4bb54261d547a7fa91e4d09d88 95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80 df77604366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858f
sha256	a3c28f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf969998866fa1	d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd632666c122 a3c28f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf969998866fa1 b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f7
sha256	a44450c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8d9f49	e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4b4c6a a44450c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8d9f49 46217dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577
sha256	a658d88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be26574fa8	57fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae78c633 a658d88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be26574fa8 af732649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5
sha256	af732649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5a949f	88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be26574fa8 af732649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5a949f b0010bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84
sha256	b0010bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84a7ddb	649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5a949f b0010bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84a7ddb bc8bb9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792
sha256	b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f75a630	f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf969998866fa1 b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f75a630 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256	baf01275b874c04687f84d78451e41231b31bfc0e71995e124830ba63379fedd	c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82446af baf01275b874c04687f84d78451e41231b31bfc0e71995e124830ba63379fedd 5dbf9dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c
sha256	bc8bb9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792ac92f	bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84a7ddb bc8bb9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792ac92f c7d07eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575
sha256	c7d07eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575e6757	9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792ac92f c7d07eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575e6757 d322b11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e48
sha256	d322b11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e4854683	eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575e6757 d322b11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e4854683 d35c4be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a
sha256	d35c4be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a36062	11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e4854683 d35c4be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a36062 dcc5cc23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f
sha256	d3e06e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4b4c6a	dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a99c6e8 d3e06e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4b4c6a a44450c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8
sha256	dcc5cc23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f0f324	be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a36062 dcc5cc23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f0f324 deb9f507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf
sha256	deb9f507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf63c73	c23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f0f324 deb9f507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf63c73 df79ffd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5a
sha256	df77604366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858fb15fc	d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80 df77604366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858fb15fc 3edef9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d
sha256	df79ffd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5adfe26	507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf63c73 df79ffd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5adfe26 e1fe9f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43c
sha256	e1fe9f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43cbcc40	fd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5adfe26 e1fe9f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43cbcc40 e3c59888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212
sha256	e3c59888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212f712b	f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43cbcc40 e3c59888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212f712b e67446529af580230d0f007e9805a93978885a440dc68029744d951db5b
sha256	e67446529af580230d0f007e9805a93978885a440dc68029744d951db5b07914	888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212f712b e67446529af580230d0f007e9805a93978885a440dc68029744d951db5b07914 f348c2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aa
sha256	f348c2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aae6415	6529af580230d0f007e9805a93978885a440dc68029744d951db5b07914 f348c2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aae6415 f68502a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f
sha256	f68502a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f80e28	2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aae6415 f68502a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f80e28 faa0729ac6b3dc7cdfbeb5c042e4d9ff95ecfa51d1c3efdaf79560f9c27
sha256	faa0729ac6b3dc7cdfbeb5c042e4d9ff95ecfa51d1c3efdaf79560f9c27956b8	2a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f80e28 faa0729ac6b3dc7cdfbeb5c042e4d9ff95ecfa51d1c3efdaf79560f9c27956b8 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S

Threat Round Up for Dec 01

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Doc.Dropper.Agent-6394293-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Macro.Obfuscation-6389653-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Macro.Obfuscation-6394435-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Packed.Agent-6395107-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Trojan.CeeInject-6394235-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Trojan.Delf-6394424-2

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Trojan.GenCNs

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Trojan.Tinba-6390856-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys