qakbot | cb6389c030782452ce9db7d4cbb665de06d969ea03aa0fdd235a018d99398d04

Resubmissions

16-09-2022 16:18

220916-trxxfsbhfn 10

15-09-2022 14:37

220915-rzkkzsdda7 10

15-09-2022 12:25

220915-plm3vadae2 7

Analysis

max time kernel
509s
max time network
519s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Claim_Letter#630026(13Sep2022).html
Size

531KB
MD5

457691291b130861f9a0bd3713cebbd2
SHA1

e953e92ffdcc6c2a0690cac3609efbd45e36ef3c
SHA256

cb6389c030782452ce9db7d4cbb665de06d969ea03aa0fdd235a018d99398d04
SHA512

bd8178ba129530de28491bb86b730233b61dffff830d341b83264905af5eb61057c47e94540f403bde002f3ed30ec33cb1c5b11a5e2a4cdbd562dcc8eb04b71a
SSDEEP

6144:bmG04xlIE4w2SJrjY82oULCyIK5Uj+N2iZ+crS12IDkw1gof4lSBusVe5Mk/D0cH:zUUxi0ZAggof4sQr0cLGu

Score

10^/10

qakbot obama202 1663062752 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

obama202

Campaign

1663062752

99.232.140.205:2222

41.69.118.117:995

179.111.111.88:32101

37.210.148.30:995

47.146.182.110:443

191.97.234.238:995

64.207.215.69:443

88.233.194.154:2222

81.131.161.131:2078

86.98.156.176:993

200.161.62.126:32101

88.244.84.195:443

78.100.254.17:2222

85.114.99.34:443

113.170.216.154:443

194.49.79.231:443

193.3.19.37:443

84.38.133.191:443

175.110.231.67:443

191.84.204.214:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1608 regsvr32.exe
1932 regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

mmc.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1440 schtasks.exe

pid	process
1440	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 107f1a8721c9d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6081c59d21c9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://google.us/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "55"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "60"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "29"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "1118"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "1173"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "137"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url7 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://twitter.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370024856"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://login.aliexpress.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "340"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\Total = "1086"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C389A7F1-3514-11ED-8F62-626C2AE6DC56} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\doubleclick.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://google.us/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1223"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\Total = "1118"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "1047"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\doubleclick.net	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000008b6026265a2f605355fbd97a5f544d3bfe3b2f901600acd0c34a1442daab9967000000000e8000000002000020000000b05e02066cad062576ee07448caf169d5dc1d97dd871a4a4bcb8f3a67b4db128200000003228d017b3eddca3535f964b45e2133a39ae083cabdfbc00beb40cade4ff57c140000000622ddb71ee8d69704f0c658ce4f3502f08d5b537a2fe57d11b338c54b737bb00c555b47db39a05460aaa39352b1d573451350ca969594f21298eaab66d5ab558	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "137"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.bing.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\Total = "29"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\Total = "1047"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "192"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000004f9d5689100a5c604df13717ea2840e179442329f49e59ff3130b73aefdc83f3000000000e8000000002000020000000cebdb2a7b33ecfc19f2ea70484f55afd90b94304e78b6ffc09f2afbccf0bff1b90000000373c159d70fd560a6beb15473a867549c05c5e9e3483dc61a25974694c70a338dc0dd567ea8b0cde7194156e31189a1c84c5a934052814094603255a803bc17129b616490ad5e173c71f58395b8b220d048205df8e81695900dd70312ed4875ec57dd34cc6b73dc51cc1e3f33a4ca8df0365b14a8488b609fec801e59b0428d90fee644b6d28c488def7a6a8f83cbadf40000000ef81ae9dac9df7be45f53d38f233e4952cd1772c7d5d468759efb1d00581a6e78c9bef8771af3a69b5e38c40d1a2e16e6cabc140ecddd113236bd14098b1bbd5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = f0aaaa3522c9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "340"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "60"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\cyberchef.org\ = "1086"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies data under HKEY_USERS 13 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\50d6b9fd = 346cc17fb63705a46333ce4ae61127656d5dfec4cc500016a36e08b487dc5a6b7d7227ceb592161488edb5a3eba0216fe714acb1d316ff9be606171763e02a1a3a7cb62b9712e46b2ee7b7e46e13e217a6f9049a7e8873c078c3e50c4645b733698dda2725dc9509104cc0d14868	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fosloyjtscpp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\50d6b9fd = 346cd67fb63736a71445bb20b7de4a61873f1a716c04ca94878068b2bd294a8b131b68de1a455260381c85fec48a42d04c71fabed2ba98e783e15483e3d6fc7e0c5cb5f26e4b37c54aeed79afdea164d3d643f192f52a95582	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\670849cf = 135e124a967139fa5990ef2673c31f72f2e29a023c772945c807ac84	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\dfb42eaa = af6ecb93fd91dc5d2826b67813488fefb0326002376e4aa38a34c24f02f9e439d741d742448399bad8bd4f6e3609e6d01f45b51851c42580199d81ee2babb714d8c4968ee030b0abfa113261b54427c4c4deb0ad7431a4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\1a000645 = 2fabd22c1f787ec24012c0d642b3fd9ea498b66f1c9afe1896b2bf4f19899bb24f4f3970818de49d593046ffc232312ac9737d4f3b23028bd5a1998f32798cdae04c2d404aa025e6b843c6a2ffb34ff9dd4547f7fcd3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 8039851422c9d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\654969b3 = 11586c309b68c561cfb7632af9971298a9770c4ae19342a654f1e773a84063e42f1e350b3c57ea9bd57a4bfa243f0ea02397079bf076370032d0e011f896388678ec649ef83e74e6b8b865cd784acc2fd92dbfd19bd44de960b957847bffb3c425993942e94c37fa9dba8daed437bb4ef9f88740cdcb20bc007ddd47bf41a8ea66bd4e4fea082708c4f8eaacabca56876f9c3c3911ead580decb2d1b44021e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\a2bc6120 = 8af1eaa9d70b4ba89d6005f516220b8a5b92c47b19293027bfecbf36a02eeac215bb1215ad953323076583ab111b3be0eab1f02e04fe9c8b991c7429a5177f0629	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\ddf50ed6 = 31f14923ae7646af2bc87c8dc516a4120d1ec302527d518e04587a3908ef273a358e2b6267be9057149a4f400513d5e6527cb21611095a966686607da9f85b25a5bf8c974a5efc85b0188bba5e325b4e66d4ae539045b0428c9b1935ccb99102e458afa11a2660c01572d82b783f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\2f9fd60b = 5f025d5a633bdbba3ead01630fa51bfd69b484175088f37a9797edf5ad7b516e674b210f10913bbce0a662459b18d66ac7345b86f5a4248c97b35cc2911ed4aede30d665391902b809869b5f4af61b6ded8a60fe73a51dc45c6f094b2e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fosloyjtscpp\50d6b9fd = 346cc17fb63705a46333ce4ae61127656d5dfec4cc500016a16c0eb487dc5a6b7d7227ceb592161488edb5a3eba0216fe714acb1d316ff9be606171763e02a1a3a7cb62b9712e46b2ee7b7e46e13e217a6f9049a7e8873c078c3e50c4645b733698dda2725dc9509104cc0d14868	explorer.exe

Modifies registry class 64 IoCs

Processes:

iexplore.exerundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	iexplore.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

628 regsvr32.exe

pid	process
628	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1608	regsvr32.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe
732	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

mmc.exeiexplore.exe

pid process

1012 mmc.exe
1660 iexplore.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1608 regsvr32.exe
1932 regsvr32.exe

pid	process
1012	mmc.exe
1660	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AUDIODG.EXE7zG.exemmc.exe

description	pid	process
Token: 33	572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	572	AUDIODG.EXE
Token: 33	572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	572	AUDIODG.EXE
Token: SeRestorePrivilege	1884	7zG.exe
Token: 35	1884	7zG.exe
Token: SeSecurityPrivilege	1884	7zG.exe
Token: SeSecurityPrivilege	1884	7zG.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe
Token: 33	1012	mmc.exe
Token: SeIncBasePriorityPrivilege	1012	mmc.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

iexplore.exe7zG.exechrome.exe

pid	process
1660	iexplore.exe
1660	iexplore.exe
1884	7zG.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeIEXPLORE.EXEmmc.exeIEXPLORE.EXE

pid	process
1660	iexplore.exe
1660	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
1660	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
1012	mmc.exe
1012	mmc.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1660	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1660	iexplore.exe
1660	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeWScript.execmd.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exechrome.exe

description	pid	process	target process
PID 1660 wrote to memory of 2004	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 2004	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 2004	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 2004	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1684	1660	iexplore.exe	rundll32.exe
PID 1660 wrote to memory of 1684	1660	iexplore.exe	rundll32.exe
PID 1660 wrote to memory of 1684	1660	iexplore.exe	rundll32.exe
PID 1824 wrote to memory of 1896	1824	WScript.exe	cmd.exe
PID 1824 wrote to memory of 1896	1824	WScript.exe	cmd.exe
PID 1824 wrote to memory of 1896	1824	WScript.exe	cmd.exe
PID 1896 wrote to memory of 628	1896	cmd.exe	regsvr32.exe
PID 1896 wrote to memory of 628	1896	cmd.exe	regsvr32.exe
PID 1896 wrote to memory of 628	1896	cmd.exe	regsvr32.exe
PID 1896 wrote to memory of 628	1896	cmd.exe	regsvr32.exe
PID 1896 wrote to memory of 628	1896	cmd.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 1608	628	regsvr32.exe	regsvr32.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 1608 wrote to memory of 732	1608	regsvr32.exe	explorer.exe
PID 732 wrote to memory of 1440	732	explorer.exe	schtasks.exe
PID 732 wrote to memory of 1440	732	explorer.exe	schtasks.exe
PID 732 wrote to memory of 1440	732	explorer.exe	schtasks.exe
PID 732 wrote to memory of 1440	732	explorer.exe	schtasks.exe
PID 1708 wrote to memory of 832	1708	taskeng.exe	powershell.exe
PID 1708 wrote to memory of 832	1708	taskeng.exe	powershell.exe
PID 1708 wrote to memory of 832	1708	taskeng.exe	powershell.exe
PID 832 wrote to memory of 1692	832	powershell.exe	regsvr32.exe
PID 832 wrote to memory of 1692	832	powershell.exe	regsvr32.exe
PID 832 wrote to memory of 1692	832	powershell.exe	regsvr32.exe
PID 832 wrote to memory of 1692	832	powershell.exe	regsvr32.exe
PID 832 wrote to memory of 1692	832	powershell.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1932	1692	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1912	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1912	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1912	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1912	1660	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 284	1932	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2344	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2344	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2344	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2468	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2468	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2468	2332	chrome.exe	chrome.exe
PID 2332 wrote to memory of 2468	2332	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Claim_Letter#630026(13Sep2022).html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Claim_Letter#630026(13Sep2022)
  2⤵
  - Modifies registry class
  PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:472088 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:852

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x444
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\" -an -ai#7zMap16157:56:7zEvent12309
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\about\atWould.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\about\thoseBut.bat" reg svr"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\system32\regsvr32.exe
    regsvr32 about/thinkThen.db
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\regsvr32.exe
      about/thinkThen.db
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:732
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 16:42 /tn wfdphfli /ET 16:53 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFwAYQBiAG8AdQB0AC8AdABoAGkAbgBrAFQAaABlAG4ALgBkAGIAIgA=" /SC ONCE
        6⤵
        Creates scheduled task(s)
        
        PID:1440

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1012

C:\Windows\system32\taskeng.exe
taskeng.exe {D37287D0-FFCE-40B3-A4B6-E2F674492F45} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFwAYQBiAG8AdQB0AC8AdABoAGkAbgBrAFQAaABlAG4ALgBkAGIAIgA=
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" C:\\about/thinkThen.db
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\\about/thinkThen.db
      4⤵
      Loads dropped DLL
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Modifies data under HKEY_USERS
        
        PID:284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63a4f50,0x7fef63a4f60,0x7fef63a4f70
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1424 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1696 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3208 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1044,15459582096815593447,14280585138857121649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Claim_Letter#630026(13Sep2022).05kuh7m.partial

Filesize
231KB

MD5
ed7c15bf394e2fe2097b2bdbce47cd37

SHA1
da3d700b368d4779b22746faa3c987995d5fc775

SHA256
abcc81dff57f52e0c3e96f75ddddf71d749030115fd4663ac440ca62b0a0c5e6

SHA512
8f4a923e1bf13475c1fe7b4d17bfc2e298144b5f3f73b42ac58ee9efbf68bb098d088198820b6628c3c541ace44c7e2c7903ef57f6e70ded910ab518edc0994f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1f80d4f2f68376d7941fb8ece2f2a8cf

SHA1
162880b62ac1ea54ec3e916f35fe00ca4ec13ecc

SHA256
ed709bf1fa48623db7f6bea7c3d98f769180a1e1a7ba827c371bd74bdedef7e3

SHA512
072b64fc457fcbd8fc0c45cb0f88bfde043eb3956b431e78609cff48d1c38ab502ff659535424fc6ab75db5444fb047f167f108924cfea9869fe74a057618ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50465B7330E522E7BF0E619B27D666A4

Filesize
503B

MD5
a30b6e7346d0f4bb84188bbdf1e8d18d

SHA1
8b4f5ac7ad443cca4d9eacad6f77c8aa46185ce8

SHA256
cb9d1a61deb5a1d506823320f74c6a82dd68934b4bfcb089bf343db325e75879

SHA512
8f29a18a419aa2b6398f160dcb14bcd805dbd33cbaaf053bd1a37c7334fe4813c5dda78ce6f9cf26e1176526ab66371fa782ce4ff85696a26000688e2fb135ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
1KB

MD5
88d1983f31e8acde3c232ccaf80eccbc

SHA1
0906cbad7b043b7838f3384597e1f3f84cfa8c98

SHA256
2e5e206b190a3bb5f892a3270c6146014b775b6ef6c254d74643ef8c472602d0

SHA512
4bbda7d006aec718c2b3a817d2a57d4ce4003565d314ca6c8b53f57fd2257a466954d80ecf6113d3c632f14dfec5f7a9a2a771d3c2a60656e86d48f3abf8658e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
6c6a24456559f305308cb1fb6c5486b3

SHA1
3273ac27d78572f16c3316732b9756ebc22cb6ed

SHA256
efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

SHA512
587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_298E60D5E528EEA70E86195832615F2E

Filesize
472B

MD5
6e669093dc2c285ce41d74ad82e5c3d2

SHA1
1e65ded94e2b8c575979da362ce8dc2e304c5d5f

SHA256
5a3c12851ee84e69a6ff8f0707d036d36827c77011af12aeabc187220e0fc79c

SHA512
2bf7e1b4e43d6a15cbf68fca6b6a07a03a9c000b057c1aa565781802aa9c117e631110663e3932713eff12e8aa850aa4aa5ffff29df9e0bfdf263246110b88a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
5a11c6099b9e5808dfb08c5c9570c92f

SHA1
e5dc219641146d1839557973f348037fa589fd18

SHA256
91291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172

SHA512
c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_470C936623A215C85AB2B7B61C236400

Filesize
471B

MD5
0dfd060e0fb8dec42e8f52f8db247b61

SHA1
d6f33b6390aa9a4b34375d58009977926bc1fff3

SHA256
17e3d9698e2cd4caf0cbf66b71393b473300fb9a8a4b6f7b97f421e93d54ec44

SHA512
b117be2264aaca3d254a32dbb77e30d717a0f7bf9ec7384c342d400240610e0919893e99b8ec9c38d77ce5574e5ab4724bf9df07d8c4356c8c2de25f9469971b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_EFF084F82EE56FCF01151686FE997866

Filesize
472B

MD5
6971ad04397ebe0a117d03ae5c1de8c5

SHA1
5179eab2d14b4c8c52c00fd6bf2953fb98ad5b8f

SHA256
97a64e5b9bf5e3e347b23e4bbf41aa0fe6ffd379d50b379770f5c7347e6bb248

SHA512
c5d446ed760df3c723f89f2830409b038b2cd8a92dc0a75555b5e2caafabefc31da7ae2fca6ebc406113068a3dcf6055c5dd99798002f03d5b8abb350087ee10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_72B3AD20EFB36623F7BE1507C46F2988

Filesize
471B

MD5
b35e728044acc1d13d0b34cf326dcf81

SHA1
84bc9914e240b61083958e6c910eb0398352c758

SHA256
772df41938e3662e623dac94f0d996809e4e6183778b07d85520dc80cbbe385e

SHA512
afa51302363b0978043abbe31c9e6abfd6888a0bb3c6d1988c451fa7eaba1c824e24cbc781d2738d40b2c29de6b2e38af3730f260a8c242a52ce7a7533b1a033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_9DDCDFAB142B6C8690BBBA31E07BF251

Filesize
471B

MD5
d5a5d04d15c71a4e71821b6ddd4110e0

SHA1
7c5495f9d4165a90ce681ddd1b330675e55a4993

SHA256
545c765db5e55c1d89bc56d93a3cde1a3b6f5c9d741ad9b58253f9fd7ab24457

SHA512
0369229736473ac4c356d5a51a54b5cec14793234456992eb1476267dea9b73a25b979a374c6348cacfff9a564e55801c0577a1f47da52fc6ace2bec0a0fceb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_5334CB9450F370ABCF9F7C7C1E0E3E61

Filesize
471B

MD5
979014a2d4b501776633e545cb609b6e

SHA1
2389a69c87bcb1b5d962361cec5a71bd43ba0b3b

SHA256
26f3609adf40f444aa7770872be9a73c083ffe711a6caed25208c1fc00d709b4

SHA512
e11110dd8142119b34fcadd1023d394bf185c8ae73cff8a97889d92046f03056f4cce8f41b7917c6284a28ca2d6d33427ce94fafa7cb70b28fbbb097b3bbd55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_6C240E0D86504AE299C65A20D03460A2

Filesize
472B

MD5
39aa25d8411997d98f9093c19b0ccbca

SHA1
3cb31e92d707cd561897042ed1a09de5a79e7108

SHA256
f1b7b71241b580ec34281f5addc49d716eac9ecc46a3217e646c76e6dc8d4578

SHA512
45c682e16237aa8c7e159c0c147cfa9e9d14b51c0d2a83de909874f42f0ba92b1d43af4771d4adeb1597d688c440976e995b3b85ef3ef49a49fd1f3e6f79627b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
94c3bb5e26dbb4b86dca9ae3063b7230

SHA1
e8ef0e2fcd31133b4f16e6e97b6b18ac206b8961

SHA256
14e9a9e978588e7fc5a51809531019892bb5989e07bcf6648998dba89597f666

SHA512
8b43a458eefd47344b8e7373940a572a9479aca38fc5ca9055234af2d112b47cb3ce2bb73844f779c9807756b2c2722b2904427f427a8bacb176aed766154018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
61afa593ccee30e8501453b29645cd01

SHA1
a8887676bbf7d8c6b72bfc9673f174fd906bc44c

SHA256
51cde1bca5fa5c0d874034f1bcada1b9b4fb0fe781380b4f923ca352ac7081ea

SHA512
ab967a305015a2657931b8f3d153b3f6ea3be0045edfba60bc31e037748fc859f548c631451398f236de68ac761a2c7e066e45bac7117ae20e0d3de1a9a1106b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50465B7330E522E7BF0E619B27D666A4

Filesize
560B

MD5
015d445f14148ce899bf2034afb1c864

SHA1
ffed6467e7a863e60eb9d973d236cb48da2b9b17

SHA256
47fcb32de7af510be953b35163a027e351b7f48c2bdd7d487f068071555f8e42

SHA512
3f4b273d54ed07a5c0fbc2a58027c064f9c19ae4a9028a88c1a80f3383e85e425005bd17af7cf30badd05f5586432dee1bc908f70ac3d30466091cc1fc764999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
416B

MD5
583e4f06b90e10c0bf447befbe04112b

SHA1
90cf58f69e66fea3d5def01299179a9d76cf5fa2

SHA256
b85d84721f082d7a5e64d74626b21aca56f5a951224d83f364f61d3939922a00

SHA512
bd5d4d5f42e5f47dd626be34b7682f283ef7d0baa43ac312b83331a4e7920213ef55d2d5dfaf3dda6136098af71fa85e08333977bed09148b17abdb864079c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3a4dd3d0d743936591daefebe040d4a

SHA1
16f5070c42d4753003d1d093913981ed63d42102

SHA256
90d9bb91a616e08c245d0f8ce72f184e5f5a00f0a29143b6b01c845f240c4035

SHA512
db16a86749f0f651c36420f4b61a0ac6376eba067bd7d17f88417b8070d487d6b9155ad9628bfd2d80f863aae58731402ff1478751b327354043d97439f824ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
9253450b89daf37360afc2ed0e7590c6

SHA1
ae94ebb6fd838f2bc6b2d9de23914e815f3a47dd

SHA256
473a69026a39ee3dc9164b5b6e4743dfee39a1e3cc22073262339e26cae50684

SHA512
814851e37d65a41951e0363f2c6836b5bbf088a58adc2cd8787405c4de2c5c22dc6147b73f6b4286cc4e5b740a7f17f0f7f57668c213d3c02d284861e38ec202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_298E60D5E528EEA70E86195832615F2E

Filesize
402B

MD5
96d9f9b27382943e9de86f0570816c89

SHA1
d013876f1988cfe3cadf29c0541bdbdae23b05b6

SHA256
e085d9f29302bb9f5406855fbadeb9f2976af8c1f751a23fb377ce525d5ca3f0

SHA512
eab8c664aecf9a329927e75219db9df798903d0cc603bc19bfe14da7ff3eb6e92ed9ca74f1e2c7eef6ad31ca1a343376838ba29b47ed38ad843e8662d9f5daeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
8dd54b2409e01987a38cd23b74729fda

SHA1
72bc4463ef812d08daa10b9d7b36b9fbf0d5a615

SHA256
31ff911458deda688ad080946d2a5ad405ea44a2a9a760603e1b1e6c4a2919da

SHA512
3a30e8fb7cdd72888089ca38afdd87a093e7e00bb936e71e367994116decce2c50719d0d8bc7ffd8a1e7caf35e20e86eba242945261bdddab83731d0d4bafffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_470C936623A215C85AB2B7B61C236400

Filesize
406B

MD5
16e438ec5564608e315a677ef4240ac0

SHA1
9740526b9ef79c50b0668abda3bfc25c686d52e9

SHA256
38628a9b37d958c0448e4ac2e60eb45838903ad688b3a414bdc5c9a7f34f8f07

SHA512
423bda4eae435c6f803574dee49602df73606a2893237479d32e973a64660ad3311ecad85cfc2fe697ef931b2210e0a9b11eb57419f8222072700f22c255727a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_EFF084F82EE56FCF01151686FE997866

Filesize
406B

MD5
35f1f8d14d89f23a0c2d552ba63cdee3

SHA1
78b13d3dc9d7240fa3ef67c65b01f6114c8cd62a

SHA256
70d41373d44c03a47278094e639e70cbdaf42b901f3c0c8fb5b74c0b0d6fd2e9

SHA512
f1d3d9d825ac440d9a128f9ba32f7ba5e084164f9dda614ab8fab9610c3c40c4cc2baef3dc698b8b49efc25af335be5e70ea5f07af3486d751418eddb9134339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_72B3AD20EFB36623F7BE1507C46F2988

Filesize
410B

MD5
c7839b993534814dae9bf7106cdc5d67

SHA1
5fa63d502e8daf25ba1d6caae0ef67852003fd24

SHA256
f60226169d3d4786b8bcda0b2a274354e7a4e5b865ed598eca1f0f08f7a5d578

SHA512
d59a9dde480adb21ed1390ef330dd0a5ccda8eb9085c7cad67c2ddb7a14a0143ea98de9f17296f39aba90f09af6745f1afc916bcaca4c46af318ada188a887b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_9DDCDFAB142B6C8690BBBA31E07BF251

Filesize
414B

MD5
fa23506fa70e9ef3312750d10a1a661b

SHA1
744fb99ae33659d5d305b7e46bec58b987dba595

SHA256
146dc8d92f1d370960598d1f27cb3b8ef8f53e17c85b0037aae4f191c11fcb8c

SHA512
a3b4bb847a804f16735ab1603239043a65b4df4e0784b4350213135d9b49b599f329dc0e0c7ee453e0b92cd87a1396b89cf5238f3aac5da0bec3cc32ac97fe0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98b691a1483d9bbb9e437830bcf03c69

SHA1
9b8b4f7b5103d625d9bb3a8eb31b403fbd83c929

SHA256
918513a9b79c8bcf42272410060b92208f2cdbea8717cb866216bd25c2928c2c

SHA512
e455c5c0df9c68b41d9c342117f62d06c7926528dfd7620eb6c7201022f13a5498196f2542257ceb28e922c8bfa42f0bb4075d3b498f0481a052be5c39349f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_5334CB9450F370ABCF9F7C7C1E0E3E61

Filesize
406B

MD5
d53d2c22e9672bb2686f087ba3e4ffd0

SHA1
82eb9735a37d0a2a9306486bc5cded0854e15c39

SHA256
7e78f7c083aceecd8e8189684723d5373146b59819d3b9785dfe0bca5e368c8c

SHA512
41ee3225a0fe29633a1aa75209cc6d185be435fe20e481d518d1afc9735c9e4bee97445eae7a8cf052c843d413604abac51b75c79a18cfe72f93fed5e9f4065f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_6C240E0D86504AE299C65A20D03460A2

Filesize
402B

MD5
42b70658d8cc5b2a7a7750629985962d

SHA1
c98bbdababf5bc91c28c8452da3c8dc4efb41578

SHA256
6ace0f7a00411bbd1c0a1919a3af8533f42a1c543200ea01bab538d5d973fd84

SHA512
afcda42ed894d0184f6288d9e50d6e0f2e9b3cb4c91053ed72bcee49c0bbc4959a4b464d95aa21303234f01bf2ac10d9a1c3f081e1959737ea2291f917dee2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
14KB

MD5
be02311a8a0b575d0eccb4393e5873fb

SHA1
7dc41d17cc6a4630bb06d58e297061d21f80ae9a

SHA256
3bc6f233a7f14ed6079bd0a5b9e6e10bc36bcbe85351929e1b9b544fbd5c80d7

SHA512
213039425989d59210bb5599c4c613acaf9fd8d8eb58b106fef5a579d3ca18837f4ed80f01b7bed84e32c4e8ab14df3ad15406f7cf00adf23caef3dd792e1438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
14KB

MD5
be02311a8a0b575d0eccb4393e5873fb

SHA1
7dc41d17cc6a4630bb06d58e297061d21f80ae9a

SHA256
3bc6f233a7f14ed6079bd0a5b9e6e10bc36bcbe85351929e1b9b544fbd5c80d7

SHA512
213039425989d59210bb5599c4c613acaf9fd8d8eb58b106fef5a579d3ca18837f4ed80f01b7bed84e32c4e8ab14df3ad15406f7cf00adf23caef3dd792e1438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
18KB

MD5
219221f730f2749d3deaae5ec1d3e34f

SHA1
b4eefcc24e92381ac1b3efc66147283f0607c27d

SHA256
543be08130daa4e718b8dbd97eaef6e8ddf7c54f7159c3393bbe9890936cd155

SHA512
88695262acc7037a514c9bcb5770189f1e8f0b3531b2f71d38cc30636eb8f1660c7dbc456708614ebcb5e8059077e9092b24feb3dfd9f4b064c04e4c8d83affd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
19KB

MD5
a7af7f6fc5d8d6cf189e8295a5f86806

SHA1
5b5c4462741ffdf7523210e4b9763afdac78e13d

SHA256
6f07834ba23a9a0270cb44229aa53159d0160c08e2dc13224a5803dc5a5367d8

SHA512
29dc366af7122cf7159242915b214eb9ee98f268db3965c9d60ce78779481b0188de6435bde9146296ecac37fe6a3cc51fa509b224274da536aceb2333e15242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\favicon[2].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AD00XWYX.txt

Filesize
1KB

MD5
b21eba930ddd0e697f7460602fc8f4b1

SHA1
c57228c7896af283ddc875e090c2e479d7161015

SHA256
b19f62c034a1c09cab2de476eb2aecddb0ad310c91f48a7c3d8fe069efa483da

SHA512
d8441c3c37427d04ead2a875540538087efe1dd5bb159016bb9d368340ed364accf6be7bed1baa6b3ca3128af2222220a3859ab0ecf683b6460c38585fcd2d36

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AOZV4ATM.txt

Filesize
411B

MD5
0249ad33f89c38a22fd6c3f93ad485f4

SHA1
f9d32165b863bccad7a20ccf2a57f7ff20bdacb5

SHA256
18a036d36a082f39174c258c6cfa097c3f56b31234d4e12660d37eea85dd00bc

SHA512
3f2363c8f13ddd375ccd749bc4731f35f4e41a7ec589da1a8c47792e84c301e2f137ce48be9a3249a9e9f4398698202e055270c237b5e6d733dba009fd50ce48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CKVSA3D8.txt

Filesize
1KB

MD5
18f86a44b8260389880a49b3c2ee037b

SHA1
17c919ed2426dc1b846dc60a27f13bf2ea8b063c

SHA256
f9bc6c755f3410dcea42d57300ff69253771602cdeba4f5fe86d7487dc7acdc2

SHA512
69aace02c5185fdfe1e3d567bd258abb127d3faeb407fa81366d7be29e453d522095a1c83d6668be0ca249a8143e0351fdfb46612005277d796e3887a54acf35

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DA51YZ2N.txt

Filesize
208B

MD5
17deb8982d07a6e466e1cc6d4ca0cbef

SHA1
e62a24e3219ed7ab64a60c21b6b3842cd9308b93

SHA256
ac0c2795648c3fab312eb99491b8bf0a156f6c1cc85647c61079946520ccf2a1

SHA512
93b333e9b4272edaac8a062304fc4acb164d62b5bb2ad428b335b58b4f46aedd3c715e6df38c14b1be0a303e5fb560b7398b059293888c0255b81d8a612816e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KAMDE26D.txt

Filesize
608B

MD5
8c84f38756b466b013f129a70562f78a

SHA1
052542626a06833e278eae5fffce7ff5ef97a5f3

SHA256
a049f368fd5031900fe73987e489da81c0bf6a588712c729b05b06a52c2bdd5c

SHA512
2870f7ebdeda752ef1ceb1366205b092ca22a8ab028c73003b06ff4a2d3779043efd5c69d5011f4b0dfa0973d9b67523ef1da36ed1608a860415140de175bf1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PDSCZMG0.txt

Filesize
1KB

MD5
538fc2d4124d9abc56f03bad50aee96b

SHA1
1cacf817ac2eeb0554862cca585851eeea335475

SHA256
ec33e7949a7cf46cbbe7752d919abe26f26b5af0fcc7188dc7ba9385c47ec740

SHA512
f4e10a9e3de43c6c5565efef766d517b4296bf1f2a855110a7ef8dc0bdb81faa57f1046202d1b9601193672a954a86b63b483b3e00630bf93ad55e5c7fff6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R15EML0G.txt

Filesize
1KB

MD5
985efe056e06fcba67d2b110c053a742

SHA1
ecdae9f8fca771ce03dc7e46ca29ac8fc874059c

SHA256
c2e92657e16994a14c9e634e8089ed47c66ba7b591358af073cbd8bc8a056ae3

SHA512
be04440fc67b5f02f0bef2f1a3b29b3978d3ea9555e0508a246247588fe2dd46c1bcb1abd71b882c8a54382bfa60c93eb24043c81b22fa6420dcc84ecfeb0da0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RQGYSAYF.txt

Filesize
1KB

MD5
82af5192e98131b5358e5868e7da3c62

SHA1
73d018c0f3847302f68306ed53cacbdaa4b95604

SHA256
042797054eaaadfff74d611ad7966d7f60332b0c6a8006eb1e81e7cff9075386

SHA512
aa44b16abd7ee3912a772b16576afdfc23167d526354cf21db5aa87a6edaa71b9d5e6a31cca8a5fd62c696dd6302e35b98ed629b1f6c5340ba290778e9df488e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RWF8878E.txt

Filesize
563B

MD5
1b6379f27f65d9aad84cccbd664153df

SHA1
56c10c8ebb7bb9f410690805ff69bd9f13eeed25

SHA256
43f228b5d0cf733bc8ccc64d8aa6dd74084e334e18b298d58cda26cced01a4aa

SHA512
63d738f991391f95b4b413880f7f66f505856830ca250d771db4b62689f50cba5daee2bbe11b1085a0f37c7e7d1b8102ea9c4a8ab86b3af673ead189d6fdf483

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SVOPBSVS.txt

Filesize
563B

MD5
2489b5accf07df82f607b7a86d7b66ed

SHA1
1bcaa420d7c310bac3b41361c339fb4eb26cd5b6

SHA256
52567e4dee47a943b99f71476a78ec147027dc8e319deb486225096a0604ddea

SHA512
e117da992f8c8cd320236921025a1c7b6c031e66f4c263e4e0cf1b608fe8d4d9e80d70fd8206245940e02d1785ceb597bc627dcf2b6598cbef853045ff94edfd

Download Submit
C:\about\atWould.js

Filesize
210B

MD5
bf71cb14aba0545a1a4389be3743cdac

SHA1
de0e676b805fb0109c9b4b91782bd49a0e95db52

SHA256
b4def452e61c2cea600973ece4142202dc4b7b85e44b15ebfaee1c2622ec172b

SHA512
b1125771fd5975ae60a0a52bd751d5f12415dfaa0e421fbc58f82e8758a18bef70096e455155110612e12f520a61abe6ac007f8602d2d33350cb08453f6fccb2

Download Submit
C:\about\thinkThen.db

Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
C:\about\thinkThen.db

Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
C:\about\thoseBut.bat

Filesize
42B

MD5
a18848ec167091416095dde93ceb1d55

SHA1
db49f5af0a25f78f1b135745279d8d5950c6f58e

SHA256
1b6b03b9567783ffc5a3fd8e3e46de82044918e9300b22be488a9a5575dc7acf

SHA512
4e6e69fb1972a8895cbc6e8710cddca7764a9f08e034f14e9c3ba9d0cb2d93ab16f0f90c82bfd70ae612a055cd9b96df4ece4a7eab874991cc28b4fd90657c81

Download Submit
\??\pipe\crashpad_2332_HOJBYERSVMKRRQOY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\about\thinkThen.db

Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
\about\thinkThen.db

Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
memory/284-115-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/284-112-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/284-108-0x0000000000000000-mapping.dmp

Download
memory/628-65-0x0000000000000000-mapping.dmp

Download
memory/732-79-0x0000000000000000-mapping.dmp

Download
memory/732-81-0x0000000070CA1000-0x0000000070CA3000-memory.dmp

Filesize
8KB

Download
memory/732-84-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/732-86-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/832-94-0x000000000128B000-0x00000000012AA000-memory.dmp

Filesize
124KB

Download
memory/832-93-0x0000000001284000-0x0000000001287000-memory.dmp

Filesize
12KB

Download
memory/832-87-0x0000000000000000-mapping.dmp

Download
memory/832-90-0x000007FEEBF40000-0x000007FEECA9D000-memory.dmp

Filesize
11.4MB

Download
memory/832-89-0x000007FEEE2E0000-0x000007FEEED03000-memory.dmp

Filesize
10.1MB

Download
memory/832-91-0x0000000001284000-0x0000000001287000-memory.dmp

Filesize
12KB

Download
memory/1012-83-0x0000000004118000-0x0000000004137000-memory.dmp

Filesize
124KB

Download
memory/1012-152-0x000007FEE3D70000-0x000007FEE4BFF000-memory.dmp

Filesize
14.6MB

Download
memory/1012-78-0x0000000004118000-0x0000000004137000-memory.dmp

Filesize
124KB

Download
memory/1012-77-0x000000001D900000-0x000000001D919000-memory.dmp

Filesize
100KB

Download
memory/1012-76-0x000007FEED240000-0x000007FEEE2D6000-memory.dmp

Filesize
16.6MB

Download
memory/1012-75-0x000007FEEE2E0000-0x000007FEEED03000-memory.dmp

Filesize
10.1MB

Download
memory/1440-85-0x0000000000000000-mapping.dmp

Download
memory/1608-71-0x00000000001C0000-0x00000000001E2000-memory.dmp

Filesize
136KB

Download
memory/1608-73-0x00000000001C0000-0x00000000001E2000-memory.dmp

Filesize
136KB

Download
memory/1608-69-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1608-68-0x0000000000000000-mapping.dmp

Download
memory/1608-82-0x00000000001C0000-0x00000000001E2000-memory.dmp

Filesize
136KB

Download
memory/1684-56-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x0000000000000000-mapping.dmp

Download
memory/1692-92-0x0000000000000000-mapping.dmp

Download
memory/1896-64-0x0000000000000000-mapping.dmp

Download
memory/1932-111-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/1932-97-0x0000000000000000-mapping.dmp

Download
memory/1932-102-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/1932-100-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download