netwire | hxxps://1drv[.]ms/u/s!AgM5TBFnYP0Mh3c2VflmNQ3jqh3W?e=hKhwu2

Analysis

max time kernel
148s
max time network
180s
platform
windows7_x64
resource
win7v20210408
submitted
05-07-2021 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://1drv.ms/u/s!AgM5TBFnYP0Mh3c2VflmNQ3jqh3W?e=hKhwu2
Sample

210705-k55rt84zv2

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

iphanyi.mooo.com:3360

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
DNS Afraid
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
caster123
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Pay014_Screenshot.scr	netwire
\Users\Admin\Pay014_Screenshot.scr	netwire
C:\Users\Admin\Pay014_Screenshot.scr	netwire
behavioral1/memory/1760-98-0x0000000000730000-0x0000000000759000-memory.dmp	netwire
behavioral1/memory/1556-99-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1556-100-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1556-102-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Core1 .NET packer 3 IoCs

Detects packer/loader used by .NET malware.

Processes:

resource	yara_rule
C:\Users\Admin\Pay014_Screenshot.scr	Core1
\Users\Admin\Pay014_Screenshot.scr	Core1
C:\Users\Admin\Pay014_Screenshot.scr	Core1

Executes dropped EXE 1 IoCs

Processes:

Pay014_Screenshot.scr

pid process

1760 Pay014_Screenshot.scr
Loads dropped DLL 1 IoCs

Processes:

explorer.exe

pid process

1264 explorer.exe

pid	process
1760	Pay014_Screenshot.scr

pid	process
1264	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pay014_Screenshot.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\telecom.exe = "C:\\Users\\Admin\\Documents\\Telecom\\telecom.exe"	Pay014_Screenshot.scr

Suspicious use of SetThreadContext 1 IoCs

Processes:

Pay014_Screenshot.scr

description pid process target process

PID 1760 set thread context of 1556 1760 Pay014_Screenshot.scr explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1760 set thread context of 1556	1760	Pay014_Screenshot.scr	explorer.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = f0bd034af171d701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeexplorer.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "236"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dd003ef171d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "7105"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "119"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "473"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "6999"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "8498"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "6999"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "8445"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "8530"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "236"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "7031"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e450000000000200000000001066000000010000200000002bc56afcad761b06e7e4318618a8e93c14eed6419088918363c3275176d03aa5000000000e8000000002000020000000654a555126b11701688fa045d9da0031d6b759c4a6f00fbc180c8e16ed6f9baa200000001da7cac8bccd71c92cc7b9f18f17d1fd9e88787cf6af20b2c3d2bb114c943bfd400000003a4dd0a42397c54ff1f1b591486816f7f6b17fe7e72d31631d7b17916568d82bf3db5ad19a955211751fb0667e64d7812543d7a67e3c177c93870af265b83a92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "449"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "7024"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8506"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8445"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "236"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6999"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8464"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8530"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "204"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "204"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8129"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8530"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "119"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "441"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "7105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e4500000000002000000000010660000000100002000000011e09e0a9e0ba559ce150b64d957ef7b7124e6c21353fe428111c1dacf33e8b8000000000e80000000020000200000001a667adc1fb8b719a294f7d91c19490adf342436adae729d1bbe200a102d9f5190000000ad4f378bc3a874ef5b36fb4fb39e399187bf426f54f1b3317f5bc02aee91f6fad64fb5ae54f5f3442f92056b1d778b599ccdb3120b6bda8e5b9b915e9f2ee8510b637946f1283173fc657c4d81f4b148cdfe9a3363ffeb40c7f8cae66a08e5f7d863bb8764768451d99c454572a54f5597f973c245babd99efb9be12c2385ab2814f2b8ef8b137239a636ae7f0be25be40000000e637daf5a3eabf08012bfbf0e7810a3d453def7ed1d430425a1b5fbf6e15ab13a21ca750700919e1dc1a5d742bdc9cdac3d927fbb300a9beb9835a997473922e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "7031"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "7031"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "7063"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "8445"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6370AEB1-DDE4-11EB-A5E9-5E661A0063E2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "473"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "449"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "473"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8464"	IEXPLORE.EXE

Modifies registry class 64 IoCs

Processes:

iexplore.exeexplorer.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7400310000000000885257611100557365727300600008000400efbeee3a851a885257612a000000cc01000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4c00310000000000e55258b7100041646d696e00380008000400efbe88525761e55258b72a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description pid process

Token: SeRestorePrivilege 944 7zG.exe
Token: 35 944 7zG.exe
Token: SeSecurityPrivilege 944 7zG.exe
Token: SeSecurityPrivilege 944 7zG.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe7zG.exe

pid process

2032 iexplore.exe
2032 iexplore.exe
944 7zG.exe

description	pid	process
Token: SeRestorePrivilege	944	7zG.exe
Token: 35	944	7zG.exe
Token: SeSecurityPrivilege	944	7zG.exe
Token: SeSecurityPrivilege	944	7zG.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEexplorer.exe

pid	process
2032	iexplore.exe
2032	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE
2032	iexplore.exe
1264	explorer.exe
1264	explorer.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

iexplore.exeexplorer.exePay014_Screenshot.scr

description	pid	process	target process
PID 2032 wrote to memory of 1804	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 1804	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 1804	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 1804	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 564	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 564	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 564	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 564	2032	iexplore.exe	IEXPLORE.EXE
PID 1264 wrote to memory of 944	1264	explorer.exe	7zG.exe
PID 1264 wrote to memory of 944	1264	explorer.exe	7zG.exe
PID 1264 wrote to memory of 944	1264	explorer.exe	7zG.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe
PID 1760 wrote to memory of 1556	1760	Pay014_Screenshot.scr	explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://1drv.ms/u/s!AgM5TBFnYP0Mh3c2VflmNQ3jqh3W?e=hKhwu2
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1804

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:1979399 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:564

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Pay014_Screenshot.rar
1⤵
- Modifies registry class
PID:1532

C:\Windows\explorer.exe
explorer .
1⤵
PID:1684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\" -an -ai#7zMap17967:76:7zEvent10540
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:944

C:\Users\Admin\Pay014_Screenshot.scr
Pay014_Screenshot.scr
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
4104dec10f46331a50ae76885f2a34b2

SHA1
d326751c6c7262bc0935487ccd55ddb8ea9338b2

SHA256
685ec210653e37bcb77c7abf9269925f845425c6e5aa40b47b858e958fc64269

SHA512
bd88b7fcc42a90639e8e58ad7bed0ccd11493b6176f81ecabdd60a57fc89931a8baa53011f382df1931af8de13da4a5d60446531f31df4809b9e2bf684cc8842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
4f94395d18e1920fefa958f5831a2166

SHA1
59dbb3c3672b50347262007715bf8757b30f93db

SHA256
efd3c799478f3e81335a0ff5142584702e87f42c7cfd75b8071ecdb1f77abe97

SHA512
8383428dd226d0ac640c081d2912686c33cbe765b054b33e88f10e55dbe174c2777fd98a868b9b8a066368361a9a8afb05e7fbc82ba3bc807d6510fd6e852619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
2902de11e30dcc620b184e3bb0f0c1cb

SHA1
5d11d14a2558801a2688dc2d6dfad39ac294f222

SHA256
e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

SHA512
efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
b554ab50c685a0e61dfbf8dc587a4b34

SHA1
66dd907433101527ae5c44a647a13813995036db

SHA256
c12d3b11b7891389c1879b30bdcd9f7a0bb886de4ecbb724f73764592449c64d

SHA512
4f2dec3831c249aac1041925fe855e6d6916922a718c1e8e4f2d8db4ac3efb17ed193ffe55506ccea0995bb6e01f3f5da811b98a99ba70f8a40b2a8126e5d096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
cbf049b2d6965a98403fe1d11c0bcc67

SHA1
7c1a42b4dc34940f7183fb89ad0f9b057fa6a04d

SHA256
2e7ac2b21e7e9d3253fad022b575b7e8eb5e20613333fdaf0f2255fa406f7cc5

SHA512
f0f782dc7ae01cb7d08a69cff9254fe834d4dba00c0cf48470e1967408acac4f3f0dc3063fa7179b6f4edefd6fa5ed2c468edab29666e0ab31569c7bc5edf7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
756e4482037764b787d3d4efd96f0350

SHA1
db39fd66d1abf4cb99d702d615d3dd71378907a5

SHA256
d5d87d15d8d5ecc5bcc1d79b317cb8683457a4408e2b82d163a21304965e58bd

SHA512
c9bf57ca8fc371a97bf5a0a6a246cc6af50f72547d3ce1375547dacc6d12eb8993b8fbac4748f39f6fdb6da7be9f7628280650bf758bed2f45a23ea3bec6e3fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
0483f5d5428a30b94951c1d03ebc8416

SHA1
02752dcb8f22ccfdddffa5e283ee01b29f20cc88

SHA256
56847e87258e3133b365ece16fc82b6135eb4033a19c2c90b6a7847a0be452fe

SHA512
2bfac55e89661b3389f97946710e88d4a267c9d103d3e0cf71ff591d51869822d6659e7d95ee3d147a089852c208785ce3e3b97646fc350d067537914efcc29c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
0e2fb0bb2fc5c7997bcd267ee97ccc08

SHA1
76890dc3c053ce7ce6f78e7b9fc34cb61dbd213b

SHA256
bdc7a3b7f20cf7288064ec58f599f6fe8235b16cb227631b63208f0669cf43a9

SHA512
6d019fcde4466b0e089ff0930076a4457a6188dfbc28f57ddd5ba9503bd2c57b5bd2f70ba2f2620e4381c22d3c9d39c80424fcd023224a405c83928ce80d99ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
92cd982aba2ddb7ef5ac65409d2a89a2

SHA1
8d07266e9e35ddf22e12cf2a979a2c0a7d837d9a

SHA256
b01120cb15d048be0553cb109dd053480d0c180b3e55bb9739e5b36c85444173

SHA512
5611d35cdd0b56c8493d36091f92edf8450c0ce140c34572d179f732c2390595f0a2f2a7dfc1537963e9797f1258828c6d4902883cbce056ae848ba1e2294418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
f126e8ea7f71ba073b3b3cbe3db92e18

SHA1
90e8b13b608b44ab11e2c8729abff03d2975cb75

SHA256
d4ea0d2ea198c038069337cac8a5d99738324823f24d44ebd68a7860816c9892

SHA512
53c074eb987e8caa21a7ec477ca67b6e4723469734df55c035c9672476509f03d67387bef41597dac062ad309021ac9245bae7ccd59f7cee7875e34c8b129d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
f126e8ea7f71ba073b3b3cbe3db92e18

SHA1
90e8b13b608b44ab11e2c8729abff03d2975cb75

SHA256
d4ea0d2ea198c038069337cac8a5d99738324823f24d44ebd68a7860816c9892

SHA512
53c074eb987e8caa21a7ec477ca67b6e4723469734df55c035c9672476509f03d67387bef41597dac062ad309021ac9245bae7ccd59f7cee7875e34c8b129d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
1b3ea40bd32fbb8670805326140fb996

SHA1
284378538949183c4319e1b52e7e26bae31db009

SHA256
285a7a78055de8190c80eb52c3d55ab83826f517b76628b2d12ed5c10cf9ecbd

SHA512
6786a6708fdbfce0f4a2091e2e6366593bc9732027627b50974970536faa75042ce47cf47b1cbc57af390c8679e15574ca08c3c7e5baac9ef298e72e9a896587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bq3gxmw\imagestore.dat
MD5
67210933c29ff94923580b0a481d6d60

SHA1
9eef1435c3d219c5f403b19b3b92c5ac2cf88ce2

SHA256
cea3ddd6fee2ceca946ca3b9e679510d8b104e36c21637632f7f903301f19b96

SHA512
e47a6e88635f34c41d07d4d18297241ac9c2415b93604a5f42b283959f82c42b8c43a70a168cce17881a34cd3b4e8b4c6009a1d41da647d877c2a3f9f763c40c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B4H8BAD0.txt
MD5
bade7aeaf52333b9ba228101eec62a01

SHA1
f21e7f468ec773b97ed90bbed0db7131289f1049

SHA256
20b59d16c022cc00fef892e4d56bec686cb61a52d7adde8a88bf5c3841ff42d9

SHA512
cdac0e1eceab0c613d7b495e76249ba234b8c8c0d32330379ed7741afc38d91939bbfe7be7186811db7bfb084cc4e0d90955f8833fa465bed1ceb4ef4e8cfed7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BS5HASJT.txt
MD5
be974d649b17eda7db22b91dbd738bb2

SHA1
33b33ad16b6a74a3a6b187f396706ce86491308e

SHA256
de6d744137f1beb865d388ac280850f8eed71831cff0f8745f3a4871cfc6abba

SHA512
fb15b14b4cafd03fa2fa9b6279509427f0f0a234e95064f80081f318a82a93c13929212639f88290cd4ff8264284bc77ff12deb6158b3b20e8ff641d20910ff9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PSQLDO5E.txt
MD5
c5fd7a1f0a0d4d502d907af1b52d1794

SHA1
ff0141eb1f2988fe9f4c8347f872704bc3c91b1e

SHA256
73961fd4a5b0430c3f3855d97a70d65989190ae80dbeb55b04454151cfc3addd

SHA512
7fa5c2f89fb3d3cf0fb6eb04db9cd49ae5a6f570438315dbe4d14d394eb69fb963c10adae8f4945884f689d0ac8e91baa964f2f756de1c4f150d0713beb9d47f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TB0H2C3S.txt
MD5
a4c1d15f7ca0df2f2c1f03cf63579035

SHA1
51174f109556d716da156d72ca33a6aa0506663c

SHA256
6627f9fa3d02ac16b0cd5c9c65edd12777bd7638be3b1788dfd4e92af95c91c1

SHA512
21cb525ba564fe46e8e2c608ad52065c615e5578488cbd9ed4ef5636744a128ef2058d8e7251bf4d33e66e5ba4e3812367bd667fc12181f48ed3e2716d56e8f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V150VFLV.txt
MD5
c9e8f4d9f93838c0ccaa89a030c763ed

SHA1
ff51038b8b179dd8d57c3956f13fa3a15dfed640

SHA256
e2d2ffd5cac5f656ae1d35f0557eb0255949032ea969eeba0195a76ef397e28e

SHA512
608c5d30ecf3844eb731308e978cae7419de04928830dfbac33f48cf96a7bf1bafddb681bd962d0219da7e8575deb7c12ae555bedc4203cebce3abd8d795e4b6

Download Submit
C:\Users\Admin\Pay014_Screenshot.rar.20nxdoi.partial
MD5
21c1c662cc174c82cb768ffff1ca27d5

SHA1
35f3aa06e56ff709683d70842505b15363331088

SHA256
fe822a928a2a772500437c4eabfaf6b5af07fc7bb510e33956dcd8468550039f

SHA512
fb7485d607dc8d4c82c97a9a4bf2d48ca75072b44e59a73d1c5ad5d27b9e9175ed54fe8a2d21cd9fa484bff7c6d77f404c59c3877ea5c61df4f589637a814496

Download Submit
C:\Users\Admin\Pay014_Screenshot.scr
MD5
e56903f300876fd5df505a60f5967a31

SHA1
292fc1e81ab323b7de82a791d4f6bdd316605a7e

SHA256
40993feefb8af3c4a93426f9ff21815b24fa093fa650a9f46beae791e54ce8ce

SHA512
b760c9a8f74baba1782b972b288f3a27d27fb17cbe928a663472827fd3735a82e32f59fccf6a1a764ea397e49db561602c9e601f33656f93a494cc6c141e4368

Download Submit
C:\Users\Admin\Pay014_Screenshot.scr
MD5
e56903f300876fd5df505a60f5967a31

SHA1
292fc1e81ab323b7de82a791d4f6bdd316605a7e

SHA256
40993feefb8af3c4a93426f9ff21815b24fa093fa650a9f46beae791e54ce8ce

SHA512
b760c9a8f74baba1782b972b288f3a27d27fb17cbe928a663472827fd3735a82e32f59fccf6a1a764ea397e49db561602c9e601f33656f93a494cc6c141e4368

Download Submit
\Users\Admin\Pay014_Screenshot.scr
MD5
e56903f300876fd5df505a60f5967a31

SHA1
292fc1e81ab323b7de82a791d4f6bdd316605a7e

SHA256
40993feefb8af3c4a93426f9ff21815b24fa093fa650a9f46beae791e54ce8ce

SHA512
b760c9a8f74baba1782b972b288f3a27d27fb17cbe928a663472827fd3735a82e32f59fccf6a1a764ea397e49db561602c9e601f33656f93a494cc6c141e4368

Download Submit
memory/564-62-0x0000000000000000-mapping.dmp

Download
memory/944-88-0x0000000000000000-mapping.dmp

Download
memory/1264-87-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/1532-84-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Filesize
8KB

Download
memory/1556-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-100-0x000000000040242D-mapping.dmp

Download
memory/1556-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-93-0x000000013F210000-0x000000013F211000-memory.dmp

Filesize
4KB

Download
memory/1760-95-0x0000000000670000-0x0000000000680000-memory.dmp

Filesize
64KB

Download
memory/1760-96-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1760-97-0x000000001ACB0000-0x000000001ACB2000-memory.dmp

Filesize
8KB

Download
memory/1760-98-0x0000000000730000-0x0000000000759000-memory.dmp

Filesize
164KB

Download
memory/1804-59-0x0000000000000000-mapping.dmp

Download
memory/1804-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/2032-74-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download