top of page

Threat Roundup for January 31 to February 7

C45-2020-02-08-9

Indicators of Compromise (IOC) List

Indicator of Compromise (IOC)
Date Published
IOC Type
HKCR\RAVIGL4M 1 HKCR\RAVIGL4M\SHELL 1 HKCR\RAVIGL4M\SHELL\OPEN 1 HKCR\RAVIGL4M\SHELL\OPEN\COMMAND 1 HKCR\.W5PHE 1 HKLM\SOFTWARE\WOW6432NODE\7OGGSL Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN 7 HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN 1 HKCU\SOFTWARE\ATLTLCN 1 HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS
08/02/2020
Win_Registry
HKCR\.JG2BV 1 HKLM\SOFTWARE\WOW6432NODE\6381BA49F616F0D299E6 1 HKLM\SOFTWARE\WOW6432NODE\GQSXMYCRDP 1 HKLM\SOFTWARE\WOW6432NODE\6381BA49F616F0D299E6 Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN 25 HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE 25 HKCU\SOFTWARE\3A91C13AB1 25 HKLM\SOFTWARE\WOW6432NODE\3A91C13AB1 25 HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE 25 HKLM\SOFTWARE\WOW6432NODE\3A91C13AB1 Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS
08/02/2020
Win_Registry
HKCR\LH8Y07\SHELL\OPEN\COMMAND 1 HKLM\SOFTWARE\WOW6432NODE\7OGGSL Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\ATLTLCN Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\3A91C13AB1 Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109A10090400000000000F01FEC Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\K6TWCT Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\WOW6432NODE\3A91C13AB1 Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE Value Name
08/02/2020
Win_Registry
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9 Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PHISHINGFILTER Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name
08/02/2020
Win_Registry
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name
08/02/2020
Win_Registry
HKLM\SYSTEM\CONTROLSET001\SERVICES\MEXICOGUID 24 HKLM\SYSTEM\CONTROLSET001\SERVICES\MEXICOGUID Value Name
08/02/2020
Win_Registry
75E0ABB6138512271C04F85FDDDE38E4B7242EFE
08/02/2020
SHA-1
d499aaf6b7e484b7a5bf76df7a9fef3fc48e42a107020196b9c96e8637dab8db
08/02/2020
SHA-256
88f4d8d02c72f50d136c15678cf3be9e
08/02/2020
MD5
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\WINRAR Value Name
08/02/2020
Win_Registry
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5 Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\WINRAR 2 HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name
08/02/2020
Win_Registry
298b5a668c186cdf8fde2dc29e38d0921734b3322fe6191dabd79a12ce3440bd
08/02/2020
SHA-256
DAC9024F54D8F6DF94935FB1732638CA6AD77C13
08/02/2020
SHA-1
HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE Value Name
08/02/2020
Win_Registry
HKCU\SOFTWARE\MICROSOFT\GOCFK 18 HKCU\SOFTWARE\MICROSOFT\GOCFK Value Name
08/02/2020
Win_Registry
2a57280bffa1d45f7510ed16d397f568395d057f10c8de214e590f458f465682
08/02/2020
SHA-256
HKLM\SYSTEM\CONTROLSET001\SERVICES\MEXICOGUID Value Name
08/02/2020
Win_Registry
00004109A10090400000000000F01FEC
08/02/2020
MD5
7eb312b1de92aff32d189eef03650ba2b9bd710ca337bf24c2ed46dcdedcedc7
08/02/2020
SHA-256
74e990e02d30c7ddfddb15d7411124e46da01d486abc0f7439559bd19e56ad12
08/02/2020
SHA-256
18226c65547a1de83f00028171b8948b5c9fb33d194afd1f3f92fa5c90fdaf45
08/02/2020
SHA-256
4a8dfad4d821e5f74b9f11ff82131fd533b14d4039ab1d52164a73fe08b5f05a
08/02/2020
SHA-256
bbbfdd70c93b7728b38eb826b85c70e212d9ca355347fa61f10bc6488103f650
08/02/2020
SHA-256
54b553f3ef10badaccb9ef6dff73c4c6f29a35685694e6afa8d90643acd78791
08/02/2020
SHA-256
ba02e51162dd1ec07a955f706d09dcfe5a860adaae0e990fe1fc3809d28c0143
08/02/2020
SHA-256
66bec557cf492d9014a3be80c31d53b29bc78e98d9485ef4f78de853e194c57b
08/02/2020
SHA-256
Download as CSV
bottom of page