hxxp://0 | Triage

Analysis

max time kernel
2280s
max time network
2297s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://0

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c105edd1fdd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000f50d7810a660d08bc02d91f0762f39967a9eabe27c13d06212afcc5a6b55eea9000000000e80000000020000200000006cd61775248fb2740a9e3c40916d5fc80449dec599d6c20550afe9f5c456e4bd2000000086d63a6a4805112196f7a39261c9f2f2fe2a0d59a5103eb49e10954638d9ca1e400000001c7f99fb12e24080a2b1573603131b580003b099e4b52a67eaf4d88afaefcf786b8937de77b4dc2df66d04da40f036963b6a2b3a254c15cd5cdadc23c79ff5ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	POWERPNT.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage\docs.oracle.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "142"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000c36816e038e7d3116ea33a42d9404ed39c2929d5a9f2c23cdc8b1269ba739933000000000e80000000020000200000002b1d696d35d779442c03fec9e81485043df40c105d311c3333034c1bc15845d090000000ffe85d470b27c8d1374f69478ea39c909182d6da0052e87f97b9b43531a7105728a2df9eb8d66475b1353cfdd229fb010facb0cd0514205fe71d25d4914b57e599edce72dfeb060c932211583c89c0867e73a9e620b492c245307c03293e10a86b3278d51c632ebcf9614881ce5cd18f9f86e1f9224659106f2f020721e781de9f2db655d1bdfe4b9bbc26d72d3a2f594000000005746c630a5722fd19bcb4dc3f772eab4114f94b8e4ff37686b1b5ebf4b880692c32b80c4517efa1b841f744297f225a523754cc2685ea8ab653f565192e8dd6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage\oracle.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage\oracle.com\Total = "142"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DOMStorage\docs.oracle.com\ = "142"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	POWERPNT.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	POWERPNT.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	POWERPNT.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	POWERPNT.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2476	POWERPNT.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1352	msinfo32.exe
2476	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	firefox.exe
Token: SeDebugPrivilege	624	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1544	iexplore.exe
624	firefox.exe
624	firefox.exe
624	firefox.exe
624	firefox.exe
2108	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
624	firefox.exe
624	firefox.exe
624	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2188	mspaint.exe
692	mspaint.exe
692	mspaint.exe
2188	mspaint.exe
692	mspaint.exe
692	mspaint.exe
2188	mspaint.exe
2188	mspaint.exe
2108	iexplore.exe
2108	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2736	1544	iexplore.exe	29
PID 1544 wrote to memory of 2736	1544	iexplore.exe	29
PID 1544 wrote to memory of 2736	1544	iexplore.exe	29
PID 1544 wrote to memory of 2736	1544	iexplore.exe	29
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 844 wrote to memory of 624	844	firefox.exe	38
PID 624 wrote to memory of 2084	624	firefox.exe	39
PID 624 wrote to memory of 2084	624	firefox.exe	39
PID 624 wrote to memory of 2084	624	firefox.exe	39
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 1900	624	firefox.exe	40
PID 624 wrote to memory of 2280	624	firefox.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://0
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1964

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.0.1606945872\291815738" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c697a85-e157-4819-9e69-a318955f68dd} 624 "\\.\pipe\gecko-crash-server-pipe.624" 1292 118d7e58 gpu
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.1.73090280\256058487" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21019 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ee9fd2e-acd1-4743-8cdc-00c168533c33} 624 "\\.\pipe\gecko-crash-server-pipe.624" 1496 d71c58 socket
    3⤵
    - Checks processor information in registry
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.2.1758073529\517864068" -childID 1 -isForBrowser -prefsHandle 1944 -prefMapHandle 1940 -prefsLen 21057 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {197de387-ed7b-46c5-991b-f5faa8dda8e3} 624 "\\.\pipe\gecko-crash-server-pipe.624" 1892 19c78958 tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.3.1899290177\212589896" -childID 2 -isForBrowser -prefsHandle 1792 -prefMapHandle 2072 -prefsLen 26417 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f54808e9-49a4-43d5-9ec8-83d67eaa8280} 624 "\\.\pipe\gecko-crash-server-pipe.624" 1808 d71058 tab
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.4.1755353019\439239497" -childID 3 -isForBrowser -prefsHandle 2568 -prefMapHandle 2564 -prefsLen 26417 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {954e32b2-d87b-41ad-b40c-b85ec7c11810} 624 "\\.\pipe\gecko-crash-server-pipe.624" 2580 167d4258 tab
    3⤵
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.5.1862549563\558927465" -childID 4 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06ffe7cc-8f56-4761-9695-b8b239cea8da} 624 "\\.\pipe\gecko-crash-server-pipe.624" 3568 19d5a258 tab
    3⤵
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.6.117631044\1958484576" -childID 5 -isForBrowser -prefsHandle 3584 -prefMapHandle 2408 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd79c685-cc3c-420f-838f-c73d3e4ae1a7} 624 "\\.\pipe\gecko-crash-server-pipe.624" 3680 1e16e458 tab
    3⤵
    PID:572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="624.7.1506944992\1948706904" -childID 6 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd82bb69-e469-41b9-95a7-ff89a6588fbb} 624 "\\.\pipe\gecko-crash-server-pipe.624" 4012 e8e6958 tab
    3⤵
    PID:2668

C:\Program Files\Windows Sidebar\sidebar.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgets
1⤵
PID:2384

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1352

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2612

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AddCompare.emf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AddCompare.emf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://docs.oracle.com/javase/7/docs
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:1724
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:2032

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2476
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6766397a5de55e4fbd99ccf9cece8abf

SHA1
4f46dd92d0b26c152fd467a5f327a570289e98e2

SHA256
e6e5563adcd41d59b89188182ee6ea0f95421b17b6ee2d7841e296dd4bb24822

SHA512
2ba54aea7e16b80251cc070b1b1680e02a6ce655e58eb90b4da07cb78c40a86705236df7e57737080133abeb7bb97e6b82e7fbf8b071c8dfc1fd986f5711d1bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706d21a15e39a78c5c97ab601e3b0edd

SHA1
c36b02b63770ce9abd8066e3b8a6d2f2b588b6de

SHA256
23e8187077bcef59681f54693a8a67922e983a5428e540e12838a7a5dc019420

SHA512
1e9fc3a1b9fc88a1539f2e1f7dced618a8b7f08641df7fe2c3a0a7232b1f78352d35344826323f8c011708573d0a3cbdce5ec4194af30264d8a969cadfe07491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
643e17f2f0cbcd0d32fea8de770a5271

SHA1
c7a0a3de0a7f55dcfc70b2443a85b4ee56cdc759

SHA256
dfcd082f44f99bd2b87104eb93f9a84fd19d2861f18e7afbb8998e078c596c5c

SHA512
34cf4b58345bea80462eab23bbaf698b2762bfc7b8644e7a3a4c1c612109132aa13cf5f0d31c55f5004184b297f3ecaab96795c0351eb07bf5a36ae995541370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fa2c4751513822f2120d0bbf76d2506

SHA1
8c3ee9ef4c4534c45a5e475b80b4e9912344275a

SHA256
ea536c3efa6c4651ba53fa03f96f886b3f5adc21e0ddddb0c0945bec925a83b6

SHA512
d91e8a6d5d46cac2d98b0f1348ebd831cbcbb47300b6eb878b9db8a0eb26f4648d489330da5fac7e21bee6e31a0ddc66dec41078d61aebef9f446ab3888116a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb705e465955eeda17011e5c74309254

SHA1
b10a94d3832aae6778b2b62b3c4743575bdb9f64

SHA256
4308f891cbedd79f7def6e6de860ddd81efdeef62c60cc2840b0d7201d767db6

SHA512
7d4211abdc823a0c3ad889cf05c33f4abf393cba34796d17f7322a4ae1d38977a46b9d6d04ce81e02e462069d0a44710b91f6ef78b7d42a0fbf2f664910eb8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0e6e53c28f4929e387d5189c49c3ef7

SHA1
a83bafefdc4e91539589d91dfe74929dacb1736c

SHA256
00aac930299988468617a0dd6e0cb02e3c72766e65bd3398ea0fe92ead710b07

SHA512
0a7e720236e18c48b45f0ca7e6c5e813184389ed02a105ed901672bfbac89ce4adec8607df5df6183dad41fcfc748ba5cf825dc8cca94519f3bed6b367546030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bae330def48c45d6ef0326f5d7d8c5d

SHA1
834259d5a4fe11061f3b3a5b4511f57cede0c942

SHA256
b143d5264b51ca998eaa4ad0765fe2001d14e82766f6283f83182cf5df447747

SHA512
7b1f679044d2238557fb5266807d8f31bdb0037281f74606aa0e76862f04575cb217e4a7b678a0334a2151b2dd9a56b875425f3c0e4ada18b914f72ec46e6862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc4bbebbfa7976468a820177b9a6c059

SHA1
ce2f036e396368a37d3d67cf867431daf498c0c9

SHA256
ac74d943c5295c141b6fd09ad64ee3df7b2495beb9035d552d3ac683fab045a9

SHA512
81581e7c031bfb860dc51133b0da38294cfa7c74aae53ba2471f137deda33993acba3cb008b00e9a1a10a836a1062068d1a52ca5531549b66079e733192295a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e6d2e398c1fc79c0ef91a0bbe73c2de

SHA1
673cbf77c0fb2645932bf1c6f51dc36262275020

SHA256
f1a5d98fa91c9ef535f463b399e6dff8160fe8cd4aaaaedef1ba34e8ac73faa7

SHA512
b36479947c33750f19eedc54b17aa2d128e08b4e5ab64045f56dcc4911fa1b6353508186c963599b1336aee261c12000e89aca0ad345e5200a82d4bdf0ab8ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93021b1749361b569d778ef50233f078

SHA1
0b044add1598f9403ccf0b7f8c8e6778c5c0b7b3

SHA256
f467206061066fa1da3b779b35f414f746380ba54932ce3f6ce450dc3c7afc38

SHA512
b6e584bfe6b120d70610ce2312e17956748135cec875af59f535afaf94428c206e12c31676309fcf6ba223c2f8b647fb0319c62dacc26e6188aae08bb25e50f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
638ac596231a14d4ad8d925013fb2945

SHA1
0077911dae8c4d9c97f1fa92053b1db58c304621

SHA256
464b896cf60f88592fe484313219e207994954e28b95911d737fd0f0f6af5313

SHA512
2ada912eef5dc9e13910730fa631f4b565dade10d947242746dc3731351da07b972109e31a4f1d657117db90cd3e78ac7ad051102f4ddb52b16d7b033f729d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63291946156fa7c51f584b3efb07dc9e

SHA1
434f757c95374271d8b553f04aad90568084ff04

SHA256
772c632c201973ed8ae3be66378fa23cfbae4d778b8aa2b90af1306be2eab43e

SHA512
cf64a48b1adc59dde5cbe9322a9e878f39e94f8b09bd97b2a424d96b47319d204b094f64fd94c94954b72c79e44c57d02056f41dc35cad7bd1fd635b250b4876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc65c7c28f33ed2392ac01f9861ea46

SHA1
bacccc21301e4e930226e59427251a15a0eb3a89

SHA256
e67e825c2e4af5d709827058424510301f2fb4946e2cc4edb7245427679149d2

SHA512
bc14c8e9b28d0dc6508a5526d9bb01d17ced5823e1708b1497459b8291d7d06b5c88d6975c465ffd4f91ab7c10e58bcbdc9d937ad26a9b41b7e63128571795ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38262f1c84147247aeb43bed25a9c214

SHA1
4be47ce7bd498c771ecbc3e9a65ab330c1178b4a

SHA256
e0ba9d4324eba9151267de8582d38babd09be23f76e7525d7b881af0ac9dcb99

SHA512
7a5758d388478ef2e9cd1717174f0ab2fb0d567dab61d6021f07d347cc345179f4aca1852b494ea129b00a5af0da828c5a2cfc0f781a42830f12b0807e1116a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116414df444a38971ad750f00656130e

SHA1
bac5df4a9ac805e9771801c739baa69994fb3983

SHA256
ef3c0187639db1b1bb74d496210860932708cc68d7cfe82a4d3006043663a335

SHA512
a7637d745c65b2a50ba39ad4ca42006eda219c52437d8e53263fbbb589e3f64701f8e8c36740ffada951244198f4ddaf8e5c4579888eec772307931e03c5f137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
719ada9d9c1b543e90c899c1297e5126

SHA1
cfb7ddc64fe6cd6fe5685f7cf2451245c02a825f

SHA256
968719325d7c995345e2198449b6f5e5124b20da8a56096c517b8dc1c908366b

SHA512
dd15dc30b26f62dc194e9d65cbf4610ecdc813ee8c3b9e820c0c907240b1efa54392d362adb6ebc59ddc2db5d925cb95ae0854c75b16f42b6913cfbcc3bdff91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd4a57b3c1a1f9380748ddbddd304d9

SHA1
fdf0b7321bd8f0fd6ac822a671b70f7ed51eda66

SHA256
370ce818e8a2e2e1b07b3be6b4ddf7c36327edea6efb9bb6cd67edce330ca435

SHA512
65aac3f81c6b5217b2a97ea37d0b37a346ccbb485a28d693187667aa055e477f842baa1841e63ccdbfb87c4011213163e2ebada57356cae7565e9c0ba2086fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ab47ce25f4f9fd06d4f5fdc3c753bf5

SHA1
326da53b830351a9c55bec21e187123bd57adb67

SHA256
e5e20e8ed7990201a3193bf7c548d22fc388724f59d528cc67ba30fb2d0539f7

SHA512
1377fd6a5d3df416a45bcf88f634b792ce8ced67aedd3ae3a9cc24e006a875fb0e39c9dc08b7914447f1d755356c43412a4cd1ee99ea8e2b5615f14477548fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc61e67ada3f2d80b22d6b8be5c7a0b5

SHA1
116e40b56e1c120ea587e9e83a14737b2e3f1b81

SHA256
bd7040328267e773df1cc405237ce07f7320e7feb3f268c65cc8dce5f707fbf7

SHA512
20c36ae3c5202c50e61bd38dd1423beac14e4fe77f0a513ca094d16ded946bdbb49559936290293db3c5d8f06d7a59ecbcfe63d52bacdc51c698f4a67bc3a665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
721f22ff846e5d781bd9b2c83cb75f98

SHA1
7a368f69f2c86e22f81539102b1b8befb2bad405

SHA256
072bdfd7ce92a2a623895cf3b551489076bd7daea9e17535b2fc80b0c4163e64

SHA512
fb9b855f5d80bccca7fd2d8f912b6765deaf2bc1bf9b55d305182ceb314c99b3ec36aa77ffe35f3f82551810d61512c0f218237c19af5954db44f84d8992fa7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{0DC64960-4859-11EE-AC2A-62B3D3F2749B}.dat

Filesize
5KB

MD5
59791b848875fe70deddb98aa4b35459

SHA1
a0c9a383ba2d4f32e1633e09a6af39d15fafec4e

SHA256
9987a524f9cf006c02c484c4134dbccbc2e175b0023b187d094cf4412307d161

SHA512
ea0269e3733b8e0822dcfb391a7c250167969c6ed85a5f92664624fa8471d5216df9ead4d146421647d43ab5c6247b7fc018246061aade3aaa72131aa6173ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{4ACF9A54-69C4-11EE-855F-5AE3C8A3AD14}.dat

Filesize
4KB

MD5
34cd8d26bd8ae0a1d894da8f3c649ef3

SHA1
a20f50cdfee2d4a9d1dd412622fb48c224c3f010

SHA256
250303fa6dce6bfad43b25ef84f912624e74da8a7fd375ce9f619589bac6be0b

SHA512
624835e3a7d65706de8807ce72e6f32ed409737f72c7438906e62d7af0fdf249fad9d41812e3bcb096e0269ac7467e2f271928fa5686b7c7075fc642bed2a8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\zo0jyaj\imagestore.dat

Filesize
5KB

MD5
1d08e41ea737162b2cc2805ce168eab8

SHA1
e1458dc03312eef3f4dfa281537d874e2a71bd92

SHA256
26d98783de7f04a78cd267f56d2a1943dcea13a6329c411fa1966e34b5b2e9bb

SHA512
647dda0fa92eb3832e4bc5200efd27d5069ce0658416e3017ee700124ba03f6ffe15675fecb5856600d45954b86a1e6472265d5737bb90ab4dde08fcd44d8c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HCMMLZVL\favicon[1].ico

Filesize
9KB

MD5
c9856f0a4dd7ad0c215a68052a04d9e8

SHA1
f26103fb231ee3d431c6ea2caee670cd89d5a3d3

SHA256
0e3cfacf6a7a4caeed25bb1c51f48df499f53eabcf68ca00d631db7f2614fe2b

SHA512
0082cda89c1f384d12b8a8e1e138a53ef4d945a067031157deafc8f46075ddb2829714a0c95e09b1bb811a9c5cd22e6f12b4b3975a79a68a9ba1e3cb0989cd1c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gt29yduk.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
15e3e8801e41ccdc17972eb2945f099f

SHA1
73feb0f7b91bd95f6a5513f6cde0d1849028b83a

SHA256
bcc1b79fc73d01eedf5de8c6340bfb876728784b1e6f05539568698b7c42c979

SHA512
b5751381ede6a75b10154b8aed6949b842027fb84da0c417a53f20a65a7525e99b10dc0b7918bbf138290a5edfce944a85af688d6ec230793ccb5a1c5864a16a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBFA9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFAB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp06623.WMC\allservices.xml

Filesize
546B

MD5
df03e65b8e082f24dab09c57bc9c6241

SHA1
6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf

SHA256
155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba

SHA512
ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp07980.WMC\serviceinfo.xml

Filesize
523B

MD5
d58da90d6dc51f97cb84dfbffe2b2300

SHA1
5f86b06b992a3146cb698a99932ead57a5ec4666

SHA256
93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad

SHA512
7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF9F7CFECAB81D0E55.TMP

Filesize
20KB

MD5
03e95f3c8a5e473f622a3711cb220d6f

SHA1
f93fb31f5aa6b8cbe16bed38f2ff439584b56670

SHA256
f5a1fc0b0c8d1e1adb10a99ec57128177131857eabe3bffbaf37499dcffc7d09

SHA512
8f2f0f39cece80e5e83233995d03893a7a9c3b475f2113a8f84097c747b2eee0f97499bb94e2314f046317160160fe361473e20a36e470fcfd751a20c8ee76fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gt29yduk.default-release\prefs-1.js

Filesize
6KB

MD5
7708ca296f6f98a3102904e9d18fad97

SHA1
8255462d221768c32129ae9d35d2ff4d04b21da3

SHA256
51f924b97bced25c111c6e8fae72a28366465043ae8327113c6158c0e1a13323

SHA512
39b72c544af03fb46a8a1bbfc18bce061d0c89f1d3903cb7f0731a488daa58691b26dcaa4bda3c07dc62d4741477e2ce83d301f1f5bbab179826d638a134f7e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gt29yduk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
e736a98ab0595865046e2d6f59f158cc

SHA1
d222454771d06c1a8035fed17299044511444cbc

SHA256
a2e162b35a07977bb3cf8db8effa3e8db51cad17e89d101fe63ff4893fb01ce3

SHA512
95bbaa27a3aa96beb4bff41b252afc081f3fc2b89e5a7650ebf62d3b7955743df39a96a4a5c642bded8e9d79d7c09b1769df5424db09bb8428fcf7d3d9e7986c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gt29yduk.default-release\sessionstore.jsonlz4

Filesize
841B

MD5
60d88b02ab44442513c170e074c4ff60

SHA1
c7e1c2e6b76a3f9a1b8b8ed80f1bfc3f0d9c80c2

SHA256
f25285e31d641589982599384b30dfd6a2d0142d7719ea6898c9a4b902065e46

SHA512
cf06fd199ca06441f4662d4bb39db7cc48b8cfd8a45c2ba8212ad1cba45c6d801fab4072d93f8741f95f84468d8d3ff037c893479668b2541af2aca2cd429092

Download Submit
memory/692-124-0x000007FEF4FB0000-0x000007FEF4FFC000-memory.dmp

Filesize
304KB

Download
memory/692-125-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/692-127-0x000007FEF4FB0000-0x000007FEF4FFC000-memory.dmp

Filesize
304KB

Download
memory/2188-128-0x000007FEF4FB0000-0x000007FEF4FFC000-memory.dmp

Filesize
304KB

Download
memory/2188-123-0x000007FEF4FB0000-0x000007FEF4FFC000-memory.dmp

Filesize
304KB

Download
memory/2188-126-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2476-1145-0x000000002D221000-0x000000002D222000-memory.dmp

Filesize
4KB

Download
memory/2476-1147-0x0000000070FBD000-0x0000000070FC8000-memory.dmp

Filesize
44KB

Download
memory/2476-1149-0x0000000070FBD000-0x0000000070FC8000-memory.dmp

Filesize
44KB

Download
memory/2476-1146-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2476-1163-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2476-1164-0x0000000070FBD000-0x0000000070FC8000-memory.dmp

Filesize
44KB

Download