c0136758390523b557d711711ddee8ebfa121235f623dc219600f10dd9276c73

Target

homepage.html
Size

53KB
MD5

33174948136bdac83104aafa6e3d6eb9
SHA1

fdd1581d4157c6d140933dc77114699490152461
SHA256

c0136758390523b557d711711ddee8ebfa121235f623dc219600f10dd9276c73
SHA512

beb1391f8631618a22565e123a830b9dc86316c45aa41f5288fff0f955ee00f7c00ac59fa0da9e7ce831562e4302ee3ad971e4422641407880dd81e382f41c66

Score

10^/10

google microsoft phishing product:outlook

Malware Config

Signatures

Detected google phishing page
phishing google
Detected microsoft outlook phishing page
phishing microsoft product:outlook
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

SystemSettings.exe

description pid process target process

PID 4940 created 2424 4940 SystemSettings.exe sihost.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Detected potential entity reuse from brand google.
phishing google
Detected potential entity reuse from brand microsoft.
phishing microsoft

description	pid	process	target process
PID 4940 created 2424	4940	SystemSettings.exe	sihost.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SystemSettings.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	SystemSettings.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEexplorer.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953644"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com\Total = "59"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\News Feed First Run Experience = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08a7b37ac50d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30953644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000aa709e6db35e4b2f15a0fa87f1b42599d31236dd510fbb72d1cc0af7f9fe48ee000000000e80000000020000200000006548e9117d7ecc22d0b85d71a30ccdd9292eb6d69858330e6bcfe42e1b84de67200000004aac7f8c83c296726473de33aa1e48710bcb44647be55aae965e3febd82959dc400000001663edcfe8ccd214a859e0b5606d3f094656165ebc7077c96c9aa754bcdfb1c9d33fcff348a57e067d32bac7a6268400e43d618c35be570f58f25680548a12bf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "64"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "1780"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000078c8752fa9e662303cb64a2c53b68ec5df0d936a935e0649da3e07b20a2732c000000000e8000000002000020000000bf99a3cf9cac769928f62f5f9d6f4c6bcdfa38199f781ea78e4055d8b439f896c0000000cf7ee8930c455cbc71d4df87284d118a9537f6a846755e7291f2ff55ac9d3598f0475c9f38b8769a1061697f61cb0842dfaed9269682d927eeb7f55757cc1be3f9e0051518b7f8f0f80f41aa1c1f652b21222c2acc927ce87e871f315446373f3ac5f71cffec5386f94b633e940f32d4f0a172202463163530e90a83cf841686ca928282160be4e326ec705965d509c3938c120cc44947d728b85ca5d623bf93c32ace8a09d9e77103990cb2d0431060256ebf4101b51675506f8a61a2b16671400000004217759531c57c627b63eb80c5c8cb8d6e7d519c2342bb39bfac1ec9a079cdeb2587d487cc6b1a1598a09a7a87aa8ab287800bace3410a69605bd5d5bcb37841	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\support.google.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\googleusercontent.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "43"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "1780"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\1735262824-atari-embeds.googleusercontent.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "64"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "662804379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1780"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\googleusercontent.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\eus.rubiconproject.com\ = "59"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5320E656-BC9F-11EC-AD90-7A7C173711D6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "64"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902d4332ac50d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\googleusercontent.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\support.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com\Total = "15"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1885"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "23"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce10000000002000000000010660000000100002000000076175281303f59cbee22d892cf73d4e4410c07513a4f558aa4554fff55bb02ab000000000e8000000002000020000000914342b8e25f40f9303af832c348f44c439d0329cbf8fc6ae9e8784bb951389720000000e3f7dc9c913cf318d62fbd54fe3c856fe88c0871d12b30565c72403180b6ce144000000036716696ed8817a6c2987dd910a41c67462b3dd9369134fcf1db26172f5e6a1c1236de58ae70c8e96a10d6914ce9c02e833d0f62b3130b81535fdbb7dc6c39c4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\support.google.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\eus.rubiconproject.com\ = "15"	IEXPLORE.EXE

Modifies registry class 62 IoCs

Processes:

explorer.exefirefox.exeIEXPLORE.EXEiexplore.exeSystemSettings.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1809750270-3141839489-3074374771-1000\{05788CB6-BAD1-4256-86AF-69C77A8B3C06}	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1809750270-3141839489-3074374771-1000\{BC44AF18-9DD6-4E8D-B106-A83DDC0EB691}	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e007180000000000000000000002f492640692fb846b9bf5654fc07e4230000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 2b010000250100eeebbe17010400000000005900000031535053537def0c64fad111a2030000f81fedee3d00000005000000001f00000016000000500061006700650043006f006e00660069006700750072006500530065007400740069006e0067007300000000000000550000003153505330f125b7ef471a10a5f102608c9eebac390000000a000000001f0000001300000043007500730074006f006d0069007a0065002000530065007400740069006e0067007300000000000000000065000000315350538727bf5ccf480842b90eee5e5d4202944900000019000000001f0000001c0000004600690072006500770061006c006c0043006f006e00740072006f006c00500061006e0065006c002e0064006c006c002c002d0031000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemSettings.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

1392 explorer.exe

pid	process
1392	explorer.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

iexplore.exemsedge.exepowershell.exe

pid	process
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
624	msedge.exe
624	msedge.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe
2064	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid process

2064 iexplore.exe
2152 IEXPLORE.EXE
4444 IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

AUDIODG.EXEIEXPLORE.EXEexplorer.exepowershell.exefirefox.exe

description	pid	process
Token: 33	1660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1660	AUDIODG.EXE
Token: 33	4444	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	4444	IEXPLORE.EXE
Token: 33	4444	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	4444	IEXPLORE.EXE
Token: SeShutdownPrivilege	4444	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4444	IEXPLORE.EXE
Token: SeShutdownPrivilege	4444	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4444	IEXPLORE.EXE
Token: SeShutdownPrivilege	1392	explorer.exe
Token: SeCreatePagefilePrivilege	1392	explorer.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exemsedge.exeexplorer.exefirefox.exe

pid process

2064 iexplore.exe
2744 msedge.exe
1392 explorer.exe
1392 explorer.exe
1392 explorer.exe
3164 firefox.exe
3164 firefox.exe
3164 firefox.exe
3164 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3164 firefox.exe
3164 firefox.exe
3164 firefox.exe

pid	process
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXESystemSettings.exeIEXPLORE.EXEfirefox.exe

pid	process
2064	iexplore.exe
2064	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
4940	SystemSettings.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
1840	IEXPLORE.EXE
1840	IEXPLORE.EXE
1840	IEXPLORE.EXE
1840	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
3164	firefox.exe
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeSystemSettings.exemsedge.exe

description	pid	process	target process
PID 2064 wrote to memory of 2152	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 2152	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 2152	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 4444	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 4444	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 4444	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 2696	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 2696	2064	iexplore.exe	IEXPLORE.EXE
PID 2064 wrote to memory of 2696	2064	iexplore.exe	IEXPLORE.EXE
PID 4940 wrote to memory of 2744	4940	SystemSettings.exe	msedge.exe
PID 4940 wrote to memory of 2744	4940	SystemSettings.exe	msedge.exe
PID 4940 wrote to memory of 2744	4940	SystemSettings.exe	msedge.exe
PID 2744 wrote to memory of 2476	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 2476	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 1484	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 624	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 624	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe
PID 2744 wrote to memory of 116	2744	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault41d6425ah77e9h499dhb7f3h3840b2a70d14
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xf8,0x124,0xfc,0x128,0x7ffaa96a46f8,0x7ffaa96a4708,0x7ffaa96a4718
3⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18257602438849202359,4408742657626589243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
3⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18257602438849202359,4408742657626589243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18257602438849202359,4408742657626589243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
3⤵
PID:116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\homepage.html
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:17416 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4444

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:82982 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:82988 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4264

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1392

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\winver.exe
"C:\Windows\system32\winver.exe"
2⤵
PID:4112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3164.0.1764804818\1020539063" -parentBuildID 20200403170909 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 1 -prefMapSize 219989 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3164 "\\.\pipe\gecko-crash-server-pipe.3164" 1792 gpu
3⤵
PID:4388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3164.3.1070465894\1761541414" -childID 1 -isForBrowser -prefsHandle 1552 -prefMapHandle 2432 -prefsLen 78 -prefMapSize 219989 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3164 "\\.\pipe\gecko-crash-server-pipe.3164" 2476 tab
3⤵
PID:4624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3164.13.147696981\1697522943" -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 3656 -prefsLen 6860 -prefMapSize 219989 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3164 "\\.\pipe\gecko-crash-server-pipe.3164" 3672 tab
3⤵
PID:3508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
727B

MD5
0b3a9e2a3af5e088c454ad6b601c1368

SHA1
d127642e756c983ec6bbf893f9a8ee8869585b79

SHA256
45f4e01985e6716b6a9c7bf07febed64955696eec1100a1e98170729fc26222a

SHA512
ca847cc4325097185f6ae1951ab0be031bcd36b157c91ae8d8f032adaa01c450e6c0160569e1ebf80791eadae6cfb0d807d0d84c83428ed8f22a72f1e29dd9c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
3b74a248d065cdd9e025ae1f1291b34d

SHA1
a0f26453d6445b5fec7b878ca37e8d2854b1ded5

SHA256
0131df6bad08b234364d2ccdc47b7d0caabd2e393d1bf6047d954669126b5e45

SHA512
e3de6a9d236f8bcd94ec261f2560e16faff2c5744ca6efcaffbf50db5e05a8a8732d882b67e8d8c7001e41448083ead80276d951f9431a1e69aff4cad5b64f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_88A5FC05A8F0044AAB7466A21FAB8207
Filesize
471B

MD5
751ca49beccc0afe12c87e880a232c8b

SHA1
4136bb2bf29e0015263be23d2e39a8e4b183455e

SHA256
abf98a325d80594ebad343a2efd0b0b404740826c43799d5952eae32385faf89

SHA512
fd4c3bcf6195369c0cf4a6063229b348115d02e18403fe2ec45dc41aa3c56b86b4e44244da37c3f6098fc3099f02c94f3c83543ed9b28fee07a7a57d7fd84bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
6bb4921fbefbf22378ffa33d306d6cc2

SHA1
cfc78d35bc2ecf34ac09e3408cc9a171ea28fe5d

SHA256
5edf2e74445c7880259800cadf93272ea137e572d6ef2a039890006b2e7b8f0e

SHA512
88f6194ce132e2f2d0664f2c5ceb0f9d8ed15d363689407100b9aa96733eba1b94ca3bb5633e4435d7da9cd718ba8fdc70980ecb181a4e720aa9196d4a1f277c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1
Filesize
471B

MD5
f9cdc357b47ee659851e896fdd3bee2c

SHA1
8b98506b24ffab6be4bc681e0fc339f9b9fdd2af

SHA256
ae70c5478a481483f448693f09bed2c332ff6cd4b5b8fe7566708218ea0d0b84

SHA512
915e1719df4c8d858573e3b7a42ddafdd058b4bf0e48db5b1e999af87942c329c7cc268ec2ab2a1ac3e4591177c0ea623b123bd47c63b7f721ac89e081683f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A07532D6AAE6A04052D31515DB38D1D_DCD87F7A5C361C1E4D810B03225CB3B4
Filesize
1KB

MD5
c3dd694fc768a5711628d15d75909e0e

SHA1
925e1f4249f69703d73fadbf95135f67a824e520

SHA256
4ad4298f81a96040ac34068897301d88275363c08e7723936eb5a57090a2947c

SHA512
c2f9a91064649d9b17b56974aee807ec24948540cbe6a2260a0813a274867645310a867ab05b75e93c8ad2a9aae7e2a6b711ce181e82d488e61da2502b2de380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_28B342308FF8FA663AEE6E969DB5133F
Filesize
471B

MD5
3659da58aca35aa63a838968324ae410

SHA1
fea0040fbc8694a21ec84468664def8ed916de72

SHA256
9c3c9d024db931cead12218c92d29f255353769a10f6c44405a02def8f4f2695

SHA512
6e552d6f814ef00695fb83c8913d03032e02fd83b02037bab145371cae863f9b0cc4e5a089c57e9d3fac754f82193ce4f5c296816c026413777dd864335e4f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_3F3735D4AB3FFBF23B98C1A37AFAC9B9
Filesize
471B

MD5
021f38ff0742c2410d145767e44998d6

SHA1
4ae11de82778ec4cdcd1a56d4cff3bf2554de7d5

SHA256
59c21f6a4a827f3569107061e3647356343e30bbdefeb65a0f4255691b37600b

SHA512
14cc28fb7d1e2f175da1ba5f74004f3a9eb8c47fb905aa4ad7d63aff9f7340c3d688255d9695fba6b4609431f388293bdf81110954105542139f673625e83a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_D16F31A2D4D9B41F7A67E9243F6F4818
Filesize
472B

MD5
98dcbdf753364766115e700eb6051602

SHA1
75f39f1eba090812401b993f3a532bf3f55485c4

SHA256
18d21c29ccb92cdde98c16215482dc1cd108648c9198c756fe6dc086c52c7c4d

SHA512
babc94d273314e6a9c2ca794d9cbe7001e46b885a4cf483743b1388c486a2113979436f95bb785c459b4662eac0c6694db398849c5e1209bcaea1202f7764c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
471B

MD5
49cec540e54dd5754c06644651359378

SHA1
b91b5a6de4c62fd9162a14761e78a4c022716483

SHA256
52bab5137c3bf7bb6bba690de523948cbe422da0705f49adfd3de3ff6a44e047

SHA512
f027356796990d41a30a8eaf5092d7b0f8c494509bd4c2d70322bb901fcdb9d7cb65e1a6b8436569a9adc681716290fecd04f303c1d9b6c59adfeac4cab1f144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
5a11c6099b9e5808dfb08c5c9570c92f

SHA1
e5dc219641146d1839557973f348037fa589fd18

SHA256
91291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172

SHA512
c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_ABCC3A7EC76A400630E307F752CC5A0E
Filesize
472B

MD5
9ec97a0cb27854d3e177c99f4b0966ff

SHA1
a58622d49d8d1444f9b310f607cb31ae5b6bd431

SHA256
b359d686d484661c6e8d74f5a01c223ce6a78f13453f03d684c5c01b2bfc3fdc

SHA512
f7d58f62d33d0a2a352772b75f9dbc3ad6bb2c89eeed19a2145f7972ad681be5739db5a4c6691f8efd97cce8fc78178f248b17c2f6e557b276e3daee49554a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_2E104049DF7C89BBC415F12CCD180CB2
Filesize
471B

MD5
465ace803d856f0f73c86d80029956f7

SHA1
b35d8fca80982aaea52f9bc1b92951c084edd50d

SHA256
718c329982b9659ff55d4de9a261fc3ee6f1838b44fada7b3331979ed940f3b4

SHA512
8ff2b2264ba1e2ae50fe5f6a6bdfbf76a3d3bb5b44ce9e6e34b622f610f156959444a665dc01664b6705b69671debed1aa1613c0b9d88930675b46b866882d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
402B

MD5
7f85b60297a77a5a4548240d34926af2

SHA1
56202080a147042df95a8ee746b9f66fe54edaea

SHA256
7859609984ca46f57d2ea382dc80488dfe980f08f57e88280097c6fa890c2a9a

SHA512
ce76b720c67bc8c4ab6c62a98f0b83b049cf8d4887d4a837fa3d8ab5ddbedd7a603d475d95989d0382fa2c39ad73e0e5f85f2604919c0fd4e2c35127880814bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
35588c4d257d1bd9f46a09e01a44a77a

SHA1
a6acfb242147f5115f082d6e71e46e59a8032877

SHA256
8a1210ecdd349e5c09ba8ce35bafe6a2aced3864e8786191c7ccd3a58f5a96f4

SHA512
39d2c7ec69431556f1fce33c2bda22bd292f0ec22ed45ec18132d5b1199fc2b1076ae086f73471a35c0598ec8fbd14ef91fa71742d49b02a0e78a425f36075f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_88A5FC05A8F0044AAB7466A21FAB8207
Filesize
406B

MD5
20e6b150db19b2293ffd27371de8fa8a

SHA1
905b7e0ba631219b5b1a4241fab301574447c5aa

SHA256
bbea28e425efc8bead35ae067bced5809785ffb5eece87fa213a3ab1c4ee25b4

SHA512
7866aba1f0323be1c6ebd9ab018645b9bd1bc2a0102b283a133a7cb5b7149de83ddb751decd05b05632922f8bf632392f8c2d9ced6d0ffe8e5ef2856f2bbc132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
438B

MD5
ab9ba9ed0cb712675ccf8163858809ec

SHA1
c97a5425ea4253bf64f58dc01de8a3e17d3236b2

SHA256
f2d4335a9f7186faf460c1c1fb347a7c6469d9bfda49fa859e83f1d294b8fdf1

SHA512
19f37446002f5b6c0a35dc191bdf3f50dd49484081f51cb3d4cbd641b73d5d3fea8a8588722634c87d12c42e306a2c61b87fb3650513ca23b031e2d30a478ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1
Filesize
430B

MD5
da1d6d5dc4e3f82c005e66c4866988cb

SHA1
cc3cb70cef06409c5ccf5281faeb3e7b96b3f464

SHA256
14deec684ffe4834f47450d4929882c78159ad5d92d4b1bdd5438a14fd5af498

SHA512
16b669d5b99e796fa0b78d6f97a481422a5459ae17bd9946c9109e63572d8eb7620cf4322b4bb3e108458be3c2350026514cef291fce9f57157c8f19f34f7881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A07532D6AAE6A04052D31515DB38D1D_DCD87F7A5C361C1E4D810B03225CB3B4
Filesize
494B

MD5
ddc44aec8935e56dafd26a9d53d5f907

SHA1
bd2417d29b4a8a9da61fca839843bf17365342cb

SHA256
532f286894356eeb074901297592e17a952645579c8b90394c4667ff7b0d3469

SHA512
9b714ff0b0b5f71870ea17b88bc88b740805ed4ddb0361cf38cc54f3eb5e61082bc530516e4dabd07178cc81a14d58d161f8ddd4651352ad9915132830b88462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_28B342308FF8FA663AEE6E969DB5133F
Filesize
410B

MD5
e4de36eb96fb57ad273d65a757739f48

SHA1
070fd88f89c3bd0ad650faafb62777487be5a0b0

SHA256
48f13bf12084490b34a23ca2ff233a859b24ee1a35d151e0dfe1466b9278a0e5

SHA512
1247356159e83f53c3dd430d39649516afb19a4c2de8dda6cdeabe1b4f0a2cd67536beea8c1fcf9904bae92b0f473405049d190f5338be2c26ef6dc418812bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_3F3735D4AB3FFBF23B98C1A37AFAC9B9
Filesize
406B

MD5
0b0fc9964c9f84bbc4b666c214d0a72b

SHA1
b1374804c13e87df74ea0333f532bcb1519bcacf

SHA256
7984dd58c6e46d27ba7a6e11fd93921cb4e9a7df600de9a14ef3d2f2106b3c2a

SHA512
ca26c96c1f948f8748b84d188ce8f7d3e4dea9cc88e7d2c50a50f4f867aaf2c8d5de341706a8d6d8a51c8d9908186bb01d8251d99a17d9bc8c3e58a69a8c5776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_D16F31A2D4D9B41F7A67E9243F6F4818
Filesize
402B

MD5
8461e69bb607a5236eb3ccc8e2cfc77b

SHA1
5d70de4e161af13569bde8f80f04193632833bbf

SHA256
e50c4e2f7b72ab560a62511a683acdc021533df58251be71c65352d9aebd8284

SHA512
d3d6b22641b049add7f6e349a565efa4757d060fff79638330d6044208b6ed90b01ad4dc7e1ab8dc8f3280a5ff266037e234aeeb2fc56a83f9271024182ef9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
396B

MD5
ca5718cb599ffa9456f62dc328a2db6a

SHA1
224ef0b8b91173e9c4103705bd004db87eafc388

SHA256
9408148a8212a3dd4d22523c7b369cada7db7e2817c139ba46f525b634b35f04

SHA512
cd419aba7d82e2968599676eec0715489e6f6b6f0ba7307741ef6ff0514c99e63bb5d814dd834b64295f39dab62fc83e2d5d94d55c1095255e8cf6b2241c9656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
e83160184ce150f51895d0f622691cfa

SHA1
28bdfba1aafa5fc4e0d3e08135c07c5a54114215

SHA256
7316dd0633f54be3cde8e65956478da99c81b64ab67aebcdb77bb5d75d2b1517

SHA512
4840c837f140bedbe90418e7cab1dc5a43f1c356cf399804892610125a46c743ee40f54e7ac35f9df8c28605795dc72fd400a097fef8c419fcd4bb0aba216573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_ABCC3A7EC76A400630E307F752CC5A0E
Filesize
406B

MD5
f20d9ceac3d3380805a206d207bf0402

SHA1
5ad14d980ed796d7563c26590ff6d66b0548b349

SHA256
5e928f7c9817745ea7c57e40aaf91c19ba2c80964c319889dbbb99348471ea42

SHA512
b152b3f8505fa249dbfa2998ce4277c7e44e07cf7a866146ee3931b90a962f1f0a9c07ded796d42f6ada942612b9b5c775cd19f595df61b60f9d2b221a47045c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_2E104049DF7C89BBC415F12CCD180CB2
Filesize
406B

MD5
f90e8b2f7d2e666a5da12a17ee617aca

SHA1
c534bcb68dbe9d6c30c0e1cf9e75ae0c406e8817

SHA256
8431f1cb12fd7bae0993e51d978f9b30bc8b0339ade4e346699217d3c8d52678

SHA512
f202d2938322a87428d2ff300ba5cc6782577029f95e2c7129d7445b8ca8c53c4902e8e69fce41d0d0649520a532b8854dabffdc711c92974cf449561e476fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
1KB

MD5
0b8cc9ee16d5d90bcd99cd871939a6ff

SHA1
b22abd1c56693930623620f18cd4c3513263846c

SHA256
72decc73b5f186fedebd72667d9b145ac77546f098049688dcb29c690273fbae

SHA512
4968a3f48e75f401b2aa58c7231efb38145c32d4ea129a4a5a32178394f6d001d4eb49a1395e25b653ddb692ddd028849fe2253522263ada2a4c727fbfed8b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
35KB

MD5
e941679cc2ecc32f9a5aaa8f005d6f3b

SHA1
bbcc8842c22873821b40b4435fc416efc4b86f1a

SHA256
c2d04fbac9fe5e0b25e5a4556dc2192d9cde31b918e9f725b47e4f96c7433dd1

SHA512
2bfdbbc3a6eef7247aa5ff10ebd880064b6885244adc164f7161eebce161db8eeb11f94ba8c083fd7d4edc13a9fb1961766468b4fa934fcf951b0fdbe999d504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
44KB

MD5
efbe7156f893bbcca8e108cd99208a52

SHA1
d7f986f44976659ce3ca01ffa8a62a88d6499973

SHA256
41bca22d7196e24877723a15d29232ded38a1f8008c392fc700fca9e2647964a

SHA512
ae74937d050b7e1dbf6276ed194f1a962923d3f5e0a367510d0d5668168fad15a315b632eede8783bb0889334943e59cc55f702af79bf249a84bf55aa17214b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
44KB

MD5
efbe7156f893bbcca8e108cd99208a52

SHA1
d7f986f44976659ce3ca01ffa8a62a88d6499973

SHA256
41bca22d7196e24877723a15d29232ded38a1f8008c392fc700fca9e2647964a

SHA512
ae74937d050b7e1dbf6276ed194f1a962923d3f5e0a367510d0d5668168fad15a315b632eede8783bb0889334943e59cc55f702af79bf249a84bf55aa17214b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
49KB

MD5
9830556d712753439bee004e584de5bd

SHA1
6f5d1b3318e0762376839ea45650ed20160a3f18

SHA256
6d10abe2c43b12ec61a2030922a35be6625ad03cc16a9605334991c41aef4689

SHA512
34b314f7ebbaad0a9ac41989bee3f91be06d50793ae5038f05af92284423524c2359c026509085154a449a36fc7ce24f56271b347f720994912548b48ca806a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
67KB

MD5
734293b646d39b3d6d29b0511a0aa2f5

SHA1
17f3b4179cca05cc4fa8e2f5ef4e78a68649bed5

SHA256
1ee3b3a4a0e9f728dae0d6d88fd5ebf340bb82522e6480b91b87dbfc2507b756

SHA512
a13fdb2da48f5f70d29b450d9ec58749d62bf82ea53fae233c54228c178db44e0fb114f1d8e901d451e1ef3b2dbc0249e161aaf2dbef7736172b6c79c87c3f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
347KB

MD5
f4ab198a4b1fd014f8fc3a7c4d7a46e9

SHA1
4c9647bac87733a26a8f8315d5ff498aa7e5d646

SHA256
a19f56b9dbf267aa37aeb4e2130c92c5b4ced956355358684f110ae45efa8f5e

SHA512
fba7ff07e8548a9e95eeb734e624fd8111812f6c32418315279465ea2f8c6e60413bd0502343f5c2b28d2f3a78af55a0756eb4f6b530ee1aa2a26198bdcd3d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VJX7YH7\ConvergedLogin_PCore_N1XSfiYDhQPZjBMRueRwEQ2[1].js
Filesize
377KB

MD5
3755d27e26038503d98c1311b9e47011

SHA1
5708eb9e8e083c144e74c1a2c77f0d308743fd93

SHA256
8ec72f198f19e9a656dca1c2cebde23f5a7ff40868b9c27776af8a4edd2b59c9

SHA512
18bf3abe2e4f6d69d119a6efb5f26d3cdbbdcee19d476ac387bfff17e19dd9e307f80ce78348879a1158ee8d1bd02ac0e64015b5accbfb08c6bb1884bbe3d49b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VJX7YH7\converged.v2.login.min_zmhwgv_kbcs-aml46kcgfg2[1].css
Filesize
107KB

MD5
ccc1d61affca6dcb3e68c2f8ea47207e

SHA1
b96cd62f76dbbd2ef35a9bb48445f428c5e1ed6f

SHA256
0b110c35df6ba7923eb2b80869f047fe3102e2f41ddc767627cb977f44e2ae75

SHA512
1a50ef5b07824a2983ec60a99cc55d2eb9a2d9c846c8f0ebc23ec8baadc7f3f801c48fb6f6fdca8e885cf41077924e79d9f6c7c69313c9f7b015e2ca9ab04b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VJX7YH7\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico
Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VJX7YH7\ux.converged.login.strings-en.min_aefjq41yjoic66cbocfwrw2[1].js
Filesize
44KB

MD5
69e7e3ab8d588ce882eba081a1c7f0af

SHA1
e6a711d964e538b614a0b8c8a57fad18bf3cef58

SHA256
957312a276680d7d833b81c6a237529fdc7808da3ddd5e02897f4448a6a6fc70

SHA512
d7d8a97fc101d7d0662515d3a859cfb0f58bc8efb3dcc6fafce307ab5f9fe16fffbe72b5682bf525ad68e220a42f5c10417c270b35a578d1e58767c1455f6c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8SYI24T6\49-small_e58aafc980614a9cd7796bea7b5ea8f0[1].jpg
Filesize
987B

MD5
e58aafc980614a9cd7796bea7b5ea8f0

SHA1
d4cac92dcde0caf7c571e6d791101da94fdbd2ca

SHA256
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

SHA512
2dac06596a11263df1cfab03eda26d0a67b9a4c3baa6fb6129cdbf0a157c648f5b0f5859b5ca689efdf80f946bf4d854ba2b2c66877c5ce3897d72148741fcc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8SYI24T6\49_7916a894ebde7d29c2cc29b267f1299f[1].jpg
Filesize
17KB

MD5
7916a894ebde7d29c2cc29b267f1299f

SHA1
78345ca08f9e2c3c2cc9b318950791b349211296

SHA256
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

SHA512
2180abe47fbf76e2e0608ab3a4659c1b7ab027004298d81960dc575cc2e912ecca8c131c6413ebbf46d2aaa90e392eb00e37aed7a79cdc0ac71ba78d828a84c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8SYI24T6\53_8b36337037cff88c3df203bb73d58e41[1].png
Filesize
5KB

MD5
8b36337037cff88c3df203bb73d58e41

SHA1
1ada36fa207b8b96b2a5f55078bfe2a97acead0e

SHA256
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

SHA512
97d8cc97c4577631d8d58c0d9276ee55e4b80128080220f77e01e45385c20fe55d208122a8dfa5dadcb87543b1bc291b98dbba44e8a2ba90d17c638c15d48793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8SYI24T6\signin-options_4e48046ce74f4b89d45037c90576bfac[1].svg
Filesize
1KB

MD5
4e48046ce74f4b89d45037c90576bfac

SHA1
4a41b3b51ed787f7b33294202da72220c7cd2c32

SHA256
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

SHA512
b2bba2a68edaa1a08cfa31ed058afb5e6a3150aabb9a78db9f5ccc2364186d44a015986a57707b57e2cc855fa7da57861ad19fc4e7006c2c239c98063fe903cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JMSH2W2H\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JMSH2W2H\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg
Filesize
3KB

MD5
ee5c8d9fb6248c938fd0dc19370e90bd

SHA1
d01a22720918b781338b5bbf9202b241a5f99ee4

SHA256
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

SHA512
c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VBHSBN4S\Me[1].htm
Filesize
2KB

MD5
e86ef8b6111e5fb1d1665bcdc90888c9

SHA1
994bf7651cb967cd9053056af2d69acb74db7f29

SHA256
3410242720de50b090d07a23aee2dad879b31d36f2615732962ec4cfa8a9d458

SHA512
2486b491681ee91a9cd1ecc9aa011a3fb34b48358c5d7a4d503a5357bc5ce4ca22999f918d40ac60a3063940d5f326fc7e4e5713d89d5c102de68824e371b3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VBHSBN4S\convergedlogin_pcustomizationloader_b0394dd6769758088538[1].js
Filesize
106KB

MD5
866c7b8f8d4c92fa38842bd93e4a3141

SHA1
e04ea6b86cbbd34f668b848b1309bdcb8eede313

SHA256
00e0b0e42240d1362f7306ab3bd7ceb34fcb365f37d8d1a60a40e6bd2716a4a3

SHA512
ed7840829045bbe5d29ce61270b2644c0cd7871320bdad2699bae4cea891674144a840e670ff3bb4b958e18dbea79b0d70b27711a51d537d398a867ea7661c41

Download Submit
\??\pipe\LOCAL\crashpad_2744_LDFBZDBPPJSAKECY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/116-165-0x0000000000000000-mapping.dmp

Download
memory/624-162-0x0000000000000000-mapping.dmp

Download
memory/1484-160-0x0000000000000000-mapping.dmp

Download
memory/1484-173-0x000001335BD10000-0x000001335BD86000-memory.dmp

Filesize
472KB

Download
memory/1484-172-0x000001335ADC6000-0x000001335ADC8000-memory.dmp

Filesize
8KB

Download
memory/1484-171-0x000001335ADC3000-0x000001335ADC5000-memory.dmp

Filesize
8KB

Download
memory/1484-169-0x00007FFAA8290000-0x00007FFAA8D51000-memory.dmp

Filesize
10.8MB

Download
memory/1484-170-0x000001335ADC0000-0x000001335ADC2000-memory.dmp

Filesize
8KB

Download
memory/1484-168-0x000001335AD70000-0x000001335ADB4000-memory.dmp

Filesize
272KB

Download
memory/1484-167-0x000001335ACF0000-0x000001335AD12000-memory.dmp

Filesize
136KB

Download
memory/1484-161-0x00007FFAC85D0000-0x00007FFAC85D1000-memory.dmp

Filesize
4KB

Download
memory/2476-158-0x0000000000000000-mapping.dmp

Download
memory/2744-157-0x0000000000000000-mapping.dmp

Download
memory/4112-174-0x0000000000000000-mapping.dmp

Download