aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55589f0ba31caeb1506b805768840749.exe
Size

1.5MB
MD5

55589f0ba31caeb1506b805768840749
SHA1

be7a0fa20dec57b9b94efb533e23a513547e3981
SHA256

aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112
SHA512

a6484eeb0eeadd1e16f1ddd33e130f7a8194da2a68236d6178f5bb404fdc45b2e2fc6c615e045d10c013d9d9a745beebc1cfe70d78b3c9724d397849cbe47078
SSDEEP

49152:68Gl0svU8HLuBX2sdu7c/WJdHhZZ39MT4Xq:68Y0svHLuBX2SuY/WJ5t3924Xq

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2420	dnt-firstlook-sntb.exe
2092	dnt-firstlook-sntb.exe
2808	ispassistant-bho-setup.exe

Loads dropped DLL 64 IoCs

pid	Process
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\StartNowToolbarHelper = "\"C:\\Program Files (x86)\\StartNow Toolbar\\ToolbarHelper.exe\""	dnt-firstlook-sntb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper"	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ToolbarUpdaterService.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\constants.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\netutils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome.manifest	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\uninstall.exe	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome.manifest	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\events.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\netutils.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.xul	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\ispassistant.dll	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\events.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\constants.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.xul	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\utils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\utils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\install.rdf	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\install.rdf	ispassistant-bho-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000146b5-14.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-14.dat	nsis_installer_2
behavioral1/files/0x00070000000146b5-17.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-17.dat	nsis_installer_2
behavioral1/files/0x00070000000146b5-18.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-18.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeL = "1592678736"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeH = "31081734"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\AutoSearch = "0"	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0B778685-E426-F581-3E23-25863083650B}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={Language}&form=IE8SSC&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}"	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\DisplayName = "Bing"	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{5911488E-9D1E-40ec-8CBB-06B231CC153F} = "StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EE47E41-B0F9-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411191536"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\URL = "http://www.bing.com/search?q={searchTerms}&pc=Z153&form=ZGAIDF&install_date=20240112&iesrc={referrer:source}"	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\saveFFToolbarDisabledState = "1"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorHomepageChanges = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0B778685-E426-F581-3E23-25863083650B}"	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F5B8301-B0F9-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607cb2760645da01	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.msn.com/?pc=Z153&install_date=20240112"	dnt-firstlook-sntb.exe

Modifies data under HKEY_USERS 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecisionReason = "1"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecision = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorHomepageChanges = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorSearchChanges = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecision = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecisionTime = 406c85600645da01	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeH = "31081734"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecisionTime = 406c85600645da01	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\3e-b2-fc-d7-e5-21	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadNetworkName = "Network 3"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeL = "1620598736"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecisionReason = "1"	ToolbarUpdaterService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}\ = "Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ = "IBandObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CurVer = "Toolbar.BandObject.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\ = "IspAssistant Add-on"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1\ = "BandObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1B1E911-0191-409E-81D2-C0BAECE1A380}\prod = "IspAssistant"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\Programmable\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ = "IToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1B1E911-0191-409E-81D2-C0BAECE1A380}	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\VersionIndependentProgID = "Toolbar.BandObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\ = "ToolbarHelperObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\ = "ToolbarHelperObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Toolbar.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Toolbar.DLL\AppID = "{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\ = "BandObject Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CLSID = "{5911488E-9D1E-40ec-8CBB-06B231CC153F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ = "StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CurVer = "Toolbar.ToolbarHelperObject.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\ = "Toolbar 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ = "IToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\InProcServer32\ThreadingModel = "Apartment"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32\ = "C:\\Program Files (x86)\\StartNow Toolbar\\Toolbar32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\VersionIndependentProgID = "Toolbar.ToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ProgID = "Toolbar.BandObject.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\InProcServer32	ispassistant-bho-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1116	iexplore.exe
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1116	iexplore.exe
1116	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2516	iexplore.exe
2516	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe
"C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
  "dnt-firstlook-sntb.exe" /CHANNEL=US728 /OFFERED /TOOLBAR /DEFAULTSTART /DEFAULTSEARCH
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
  "dnt-firstlook-sntb.exe" /RETURNSTATUS /CHANNEL=US728 /TOOLBAR /DEFAULTSEARCH /DEFAULTSTART
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2092
- - C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
    "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --install
    3⤵
    - Modifies Internet Explorer settings
    PID:3020
- - C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
    "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --start
    3⤵
    - Modifies Internet Explorer settings
    PID:1100
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /i /s "C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll"
    3⤵
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:2412
- C:\Users\Admin\AppData\Local\Temp\ispassistant-bho-setup.exe
  "ispassistant-bho-setup.exe" -d 5
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://pornclips69.com/?tmp=adultvideo
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2236

C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:1324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f1932d748ed17e783816432c8c2dc1

SHA1
e4cc0130e5853d5604958a83b4f0012671e9c83c

SHA256
316ac39600e610197c8ab386ba4f74a0647318eeca087455464a13a78f423cea

SHA512
4b4c79df4b3caf117211b5d5803d4099bb6fc679d5bcf446d05d932d7e29f15634d5e0e45f9fc7e52e78b204b2cb1d95aa9ad60e43c64095fb8f85b2e35e6cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d70aa8078128ab6082c05d15ce9adf

SHA1
374a37fd743ffd1d44ea35d97ae3d5bc1fff2919

SHA256
2bead42f7d0a0d15dc3a157e112027c17b126cf22744a3e1e1de738c675aaf6a

SHA512
087751f379c2969c8da3241842d29de058e85e5f326ccf887a1f49b7131a5066c1404f4c2b5cd6a40f7d59ea69eca0396b0f58077b87e94930e7a55c3bd35c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ececb0a4e90f795f4f7c881a1bab3a8

SHA1
011dfa1daa3c1d9ebd731eb4de26e4d0600ea885

SHA256
2cb2baed0a6e4754616ec9d3d8505bbd412bf3b5e2ef495d76d6151543e6018f

SHA512
38fb1e0b8da064393de370f7d198cc9bb987ee9d146ce32be44f931f9d4f31f4278ac71c43b42c7eb17f6407dd0240b341d81fd87b735ffe58cee08861d460ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4a39c042517d0358ee8e1c832dc5b8a

SHA1
12556a5fcd1e9100a12b656045836b9c8b7acd7b

SHA256
44db5c2d55b13510c7db0eb6f9cb3c09a90ea15e43d767b557b9a3e33c56ffcb

SHA512
912ff8f9052142a6f6f2190ec577430105d11e186c130de15c54fd6aa0d23c19dcc160ba64bb4f7690e93837d167ac8826b2fb8541fc3192b5c77d1a287c4a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e70eee4b9aea2ad8ac47e360fbc524f

SHA1
df78d7f22ab7e87384421ed03dc004c5089db528

SHA256
4b8155d78caa19a76be03108841c1963dcbbb473b251ab4d8649bfc3d8ba4545

SHA512
1b89731f895c4579332c05f26252363c8462228e3f957adc5125494d28914f27c17e8c767f1da5aa3ed1a9670faa07dcfbbee1dd703ba81edfeb6771fd09cba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85076886e13e3a048c7279f403ebbf7d

SHA1
810e5286a8cc5126afd820a08427f9c623bf456e

SHA256
f9427d4a81ce47d4e7809d1333fa6fd877a9c1d6f3643f35436c69bca621c2fc

SHA512
98bf1093f32a89d5df7d3d38bb81cdbab49956455acbb7e2a0df8c65ca5f149b5ad466e6c4307901105df41f9f8653f665a425e05ff8b1793fb8adb9152b6282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044a2574af31debc2bfbaa50d0a5f663

SHA1
59b77b4ab55d0a8d2628975bf46ade6f8a5135f7

SHA256
08ee36597d1269c44bd4c3e88df33b9f334154a6fc9a73205335db01f0d39b11

SHA512
bc04f4fc39b703b2bc059322cc88c39dbcde495b2a68ddeb54f7b6bef01d091379255eae20793dc625744bab06758b386e768fee13349fa7521b654931592c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d32ef2321689ae7ae04f6fd35e0408

SHA1
86e13435f7f730c6a8cc799959024d6b4e43aab6

SHA256
6c42bf096cd95255cdafed26996ea9873c7b04ce7c645dbfcfb07eae2d2aa9aa

SHA512
cdb13fcb2b39a3fff8e90ef6913ba686fd16fe6eaa317ba4f695888adaf65cf431e1601804704f5aa4ee016050febdc951642bd2593f8e6cb76a670cb1b4753b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c12d22667e45cb528126be1cb9d49790

SHA1
ff783ca25fb5cdc25446ca240393767a13566237

SHA256
9585ce49379a46f6775c9b0fdafad771958fd68d5ce002561045736cf0d62cb7

SHA512
0c516e7083ecde67b904b030de35156c444c96868fe8580fcf3045aa03c442c545e22e37b9bfacd680ce4a816bfff8c097a6b97171e427c59e3102ad6cd6d909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4411f32683356e20d8bccbb17ebcb9

SHA1
800242ebd5bdba380617efc5250de87cd2117ac8

SHA256
a4bb0201a3cefb14c7997bec5a01f0bff742d5674c1785a4e9b2f9ae090f6a06

SHA512
087aad0a0d839c630ac05d42be6a72a0c45507f5aec6a926622b0df1760102f18f334a6faa3a4766da67c5ab891f7e6d5af399534cf14303802acf0be7785683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20143e3ea29f12a1af818f88c89db4ad

SHA1
23cb45cd288557a6da37991cf53c0fea412e8916

SHA256
a3752ee76a47cb41d5ea1e931d1490db62099b30dee84c49174f25de68a674d2

SHA512
5ee1ef149c73807a07c6785fcd94db2e3c1a7e900f11d65322dfdc2d011efa0290826c1de9a8eff41cd62785f1fc690d9dd7542ec2afed62038e1f53c6826f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90fd3d250e2535524754e15bfdd3c2a

SHA1
9fed416860158a3429ef2f2ffcc8800a2a4fa2bc

SHA256
2c56596fe5c4addc8c1cae486558353841ef1eda0fa2718412e6ddf8b51c7f74

SHA512
9941e0c14bc377b4d058d72324ad181057d6d461511976222cb8f0b03af8c392e5e0e9944d8a31a5f57798997af1f44e10c602a3b6ac5462520c14e01dd5f5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19f3cc60224dbc9cfda0b7d0e16a023

SHA1
1c161526a5cbc2738fca3803334f4e6770979a2c

SHA256
302922f5fc3bb2c89ac4738a27ebed6f554db2d51ac916730602bd836208bf6e

SHA512
883aaef6de9eb09e46488e3575e0d04c3f0a52fd8be76cde625fc884629dc13d5b2d8d621cc6895ed5e3b46364ed51a1addf87dd9dcd9146935878411f67b083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872b08cbf85d2cdca35d008495dd5457

SHA1
1d16d37fe1fee2534d1dc35fc1486022e503cb5e

SHA256
b9a6d39083d8e417d8f461a495e021527afabbd3394be8c30fdf6c3d84a7756d

SHA512
b5ced8f9b816b75bc0df48bf705f3e0ad90227ece49a786552d245c123d3bd94331351073a4b428eed8e1533c2427f0e54d0b200ed34f098279c7db68c98f3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55031be718d448c002d21c3bb1bf6d9f

SHA1
29d2350a3fb47108e4fa886d81821a1efc18096d

SHA256
66050e6c3591d31168e36705768d91d4d2a3b313a681d0a258ee6027e2b18e10

SHA512
09e6861e832959dde4865268be823cc2a93164bfd85eafdee49e929d7ac723aa9a41f6bdee8ac4bec53079cdc2aad79db08f66d49deaee50164c0ae1f2ed7866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8b8e3f836d790b99233154bfa966e4e

SHA1
bc14e7fe24eedecc91dc340e3cf605b8ea3374eb

SHA256
9b9a116052261eb7ab68250112aa6314d8c916ae4b1640fc721fad8b64043605

SHA512
0c2018c21261c329784c65a315bb6164440d1dd2062be238535073e82539e9c883b05445453d05af9177e8f228af8ee6715f2246121b6ab2971e9f94fdf415d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5884f57ddc97194d31e14eea5de5b7dd

SHA1
5749d21b513666115580283c655cbbe64971792e

SHA256
7f4c99a7a5b89db798b9709526869076b64f6ebdbaa6e5b004d4cc238094d6b2

SHA512
e196c460edb424db6c3fd5289c7adfb3fbfcfb52018999f93d475daa48a86ada4e8b0aa5c35e41885cac5c5692dd9c7f1e17886cec0bdda0b180d52c71f40163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9493352108a0ee9c700c66881c116b76

SHA1
2899d8474704f9a8dff2af433eba5c0c96dc2b2a

SHA256
0f91480eacfc452840c51e1ffd5544daee94c8420ff2d3934cf1426d6aca53e9

SHA512
0f13edec147d2a355354b02d78cb52af8fccd23fd0fa8f8bd0cf50f164750a90a5e9a63e054ceaa6149329925fcaebb0b7c09f3ceeabc2d6cc032c791f7de62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0B778685-E426-F581-3E23-25863083650B}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC361.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC548.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe

Filesize
648KB

MD5
94a889d20f7ebbea5f229631affea5c6

SHA1
9d3cb49b3f5663ead0c0fe08f947b99ebd33f066

SHA256
77b5b9b9633f05a149307e3b1c7b7ad8528c5f62f23c590930d0ff0c88fdcf98

SHA512
0ee318286136de386ee25e46054122ceb36c80d1f1523e0bbaf195928a7fa44f96f3cbcb97ac91f6a80e5b293ffbcc5055bc003911032022da5dbb683ce31be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe

Filesize
401KB

MD5
cc71dc5630af1ce24c4405ba7b54d83e

SHA1
4a6f112289b7398661a9c3d85102319fc360ca8e

SHA256
73123c627867614e3bf1806b288c35a0ddefdcd28558c3b62493d3589b35a90e

SHA512
89952e1a1014934a8a8a33c281b8ddcdfeca3775f0fd58f47e7990c29982c04e00478584271e634344162b8a6ff84a950da1ab82c8d364f76260c7d0165a68b1

Download Submit
\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe

Filesize
712KB

MD5
4251d8d58a61737cabc32bee6ad94845

SHA1
a7dd476767117ddb8bf04588976735ce9b3757e2

SHA256
f168a3d9048460ade8e9a99570e04b7298b51d733cfdaa815c7114897ef43edf

SHA512
506aa2ae112bcfed60b3b0b8936d53f6b4ef0954030e65003706ddfa95db28080cdea92fd4f617caae31a47e2ebe6c22e023041d2d7d939956e44e9f6d259238

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\GetVersion.dll

Filesize
6KB

MD5
5264f7d6d89d1dc04955cfb391798446

SHA1
211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc

SHA256
7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4

SHA512
80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\Math.dll

Filesize
66KB

MD5
b140459077c7c39be4bef249c2f84535

SHA1
c56498241c2ddafb01961596da16d08d1b11cd35

SHA256
0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

SHA512
fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\inetc.dll

Filesize
20KB

MD5
2f94245152dbd233e248909f9c01c578

SHA1
ab4e5879c001b36a2f9ff214946599fd015edda9

SHA256
4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9

SHA512
f92830de27d6663be5e0df9e32cd88732bc7ee93b14c1ded65258c325d22436400801aff1124f40400c6c3b3c16e71deb08436714716f3888d13a8a6b6a32231

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\linker.dll

Filesize
6KB

MD5
8450b29ee8d592c208ba1aaf6ee50267

SHA1
75096da057bc85cef63bb0eec168652ea75cf618

SHA256
53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612

SHA512
d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\nsProcess.dll

Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\nshist.dll

Filesize
39KB

MD5
d3686f7113ae84568624746249cbec6e

SHA1
a5849fd8e5722f91e58eec28244e9d54387f5912

SHA256
0d8fc9dc3894ccab669eee7e07c7d53a85ee191069c5e02140a23bc19461ec39

SHA512
18dec8ef52c343587e7790bbb4a0eca9a02efd37ca347e2ed72d03c2021486b240c8d451c2d04e1b564c80eee437b4730d53c7702524159291255a15e6de1b6d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3C95.tmp\timepro.dll

Filesize
20KB

MD5
009dbbdd1ef470dd752c2b73835da3e7

SHA1
f97da6556b24302df8201a092eaa32a80d49064b

SHA256
c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c

SHA512
dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3AE0.tmp\System.dll

Filesize
10KB

MD5
fe24766ba314f620d57d0cf7339103c0

SHA1
8641545f03f03ff07485d6ec4d7b41cbb898c269

SHA256
802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

SHA512
60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

Download Submit
memory/2092-315-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2092-320-0x0000000074BA0000-0x0000000074BB0000-memory.dmp

Filesize
64KB

Download
memory/2092-323-0x0000000074A90000-0x0000000074A98000-memory.dmp

Filesize
32KB

Download
memory/2420-186-0x0000000001E10000-0x0000000001E19000-memory.dmp

Filesize
36KB

Download
memory/2420-48-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/2420-37-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/2808-420-0x0000000001CF0000-0x0000000001CF2000-memory.dmp

Filesize
8KB

Download
memory/2808-419-0x0000000074400000-0x0000000074510000-memory.dmp

Filesize
1.1MB

Download