hxxps://cdn[.]discordapp[.]com/attachments/1216886003416043670/1232473708787011605/lmg_MlaKaifa2333_4k[.]zip?ex=66299616&is=66284496&hm=44c6f341634904e6a58b537f456b31c6d84ca5b66f6004148b5ed79f9480b40a&

Resubmissions

24/04/2024, 00:46

240424-a4w15sdb7x8

24/04/2024, 00:35

24/04/2024, 00:19

24/04/2024, 00:07

23/04/2024, 23:48

23/04/2024, 23:40

23/04/2024, 23:34

23/04/2024, 23:30

Analysis

max time kernel
839s
max time network
808s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24/04/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1216886003416043670/1232473708787011605/lmg_MlaKaifa2333_4k.zip?ex=66299616&is=66284496&hm=44c6f341634904e6a58b537f456b31c6d84ca5b66f6004148b5ed79f9480b40a&
Sample240424-amc7psda75

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CAB02684.TMP	makecab.exe
File created	C:\Windows\System32\CAB00240.TMP	makecab.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Types\Remove.exe	Types.Setup.exe
File created	C:\Program Files\Types\Types.exe	Types.Setup.exe
File created	C:\Program Files\Types\Tasks.xml	Types.Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133583915769952086"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	iexpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Type\ = "Edit file type"	Types.Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76402ED7-C2D7-4FD7-A4A5-BD52204550B8}\ = "Types"	Types.Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76402ED7-C2D7-4FD7-A4A5-BD52204550B8}\Shell	Types.Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76402ED7-C2D7-4FD7-A4A5-BD52204550B8}\DefaultIcon\ = "C:\\Program Files\\Types\\Types.exe"	Types.Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	iexpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 560031000000000084580568100057696e646f777300400009000400efbe724a0b5d845805682e0000006b05000000000100000000000000000000000000000043c4b700570069006e0064006f0077007300000016000000	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	iexpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	iexpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	iexpress.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76402ED7-C2D7-4FD7-A4A5-BD52204550B8}	Types.Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76402ED7-C2D7-4FD7-A4A5-BD52204550B8}\System.Software.TasksFileUrl = "C:\\Program Files\\Types\\Tasks.xml"	Types.Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 0000000001000000ffffffff	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	iexpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "4"	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	iexpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexpress.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	iexpress.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	iexpress.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2408	iexpress.exe
2408	iexpress.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
3812	OpenWith.exe
4620	iexpress.exe
4620	iexpress.exe
4620	iexpress.exe
3580	iexpress.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2920	3052	chrome.exe	72
PID 3052 wrote to memory of 2920	3052	chrome.exe	72
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4320	3052	chrome.exe	74
PID 3052 wrote to memory of 4164	3052	chrome.exe	75
PID 3052 wrote to memory of 4164	3052	chrome.exe	75
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76
PID 3052 wrote to memory of 4784	3052	chrome.exe	76

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1216886003416043670/1232473708787011605/lmg_MlaKaifa2333_4k.zip?ex=66299616&is=66284496&hm=44c6f341634904e6a58b537f456b31c6d84ca5b66f6004148b5ed79f9480b40a&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffcd579758,0x7fffcd579768,0x7fffcd579778
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=164 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3376 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5000 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5060 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3016 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3060 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2804 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5644 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5780 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4316 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5844 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3792 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2940 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5816 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2928 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5952 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5692 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=2912 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5516 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2936 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3044 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1832,i,3339463636132163290,1524032337960286927,131072 /prefetch:8
  2⤵
  PID:3040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2304

C:\Windows\System32\iexpress.exe
"C:\Windows\System32\iexpress.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408
- C:\Windows\System32\makecab.exe
  C:\Windows\System32\makecab.exe /f "C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.DDF"
  2⤵
  - Drops file in System32 directory
  PID:2684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3812

C:\Users\Admin\Downloads\Types.Setup\Types.Setup.exe
"C:\Users\Admin\Downloads\Types.Setup\Types.Setup.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:4776

C:\Users\Admin\Downloads\Types.Setup\Types.Setup.exe
"C:\Users\Admin\Downloads\Types.Setup\Types.Setup.exe"
1⤵
PID:2136

C:\Windows\System32\iexpress.exe
"C:\Windows\System32\iexpress.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4620
- C:\Windows\System32\makecab.exe
  C:\Windows\System32\makecab.exe /f "C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.DDF"
  2⤵
  - Drops file in System32 directory
  PID:240

C:\Windows\System32\iexpress.exe
"C:\Windows\System32\iexpress.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47658d6c-3378-4048-b5a8-7338d6519c5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47658d6c-3378-4048-b5a8-7338d6519c5b.tmp
Size 6KB
SHA256 6f3ba3567842569f381a31825cf089edf9bb484881578955e943420b150530cf
MD5 2c8790bfa8b2982e133dc11e1d125d1b
SHA1 015018604bf807a57ed1799cd1a4e16d2622ba03
SHA512 4c70a65bcdbfa509fd290adcaee838e89c291bffaa43b91a37083aec6dcb1fd173334b85ef76eac1cefb8a4e04508fa805600fe9b87bf9beaecd787babbbc41a
SSDEEP 96:eBDGZc2kJzCDKIpqCE8iZt+y7Di+6MsmdexkA1uMOmdUjVhYtjEsXt0/cg2Vup:G2c2kJmDu86+yy+FukAqotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 58KB
SHA256 520408fec7c6d419184ec68ad3d3f35f452d83bd75546aa5d171ffc7fe72cb2b
MD5 9b603992d96c764cbd57766940845236
SHA1 4f081f843a1ae0bbd5df265e00826af6c580cfe7
SHA512 abd88ee09909c116db1f424f2d1cbc0795dbc855fef81f0587d9a4e1a8d90de693fa72841259cf4a80e0e41d9f3e1f4bf3a78c4801264e3e9c7d9635bb79ccf5
SSDEEP 1536:lHojGmiNGVBTFNyMmynvXGm9rl4hq/vq/Eao:GqzYXTbyMzeCah6SRo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 40KB
SHA256 675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9
MD5 5ce7bdeeea547dc5e395554f1de0b179
SHA1 3dba53fa4da7c828a468d17abc09b265b664078a
SHA512 0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e
SSDEEP 768:zznaC0S3xL3wn+dljVGT3tOkaSOzWS64CLUulVINZQ9vQMAdS:PnajS3x3wn+XjVGoknOiS6PzlVIEROS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 56bfbc7f6c75a930621bcaa10459241679857c2b66c1c6aaa64b7e36658af4b5
MD5 c5d5d1f514214d5a3b8ec0e54d9859a3
SHA1 b90874d359b6185102014659d26758131a6a69c2
SHA512 531616e7418d911fd3858ed706bf6f76d56e4fa07e250100f6a8283b86bd5ff0024df9ad41c829f70f18fa3fb9e0227d8afc72fc1e1fe802f84d0af769af8621
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 a05c3c75e9c062a87181aedbf560bba2ee53c227b8a445bbff1518e202b230e4
MD5 a418e3915f7ea016d16a5d1898caaa99
SHA1 f6bf967ba1e8d3992ed9768d3a362052e7c2a38d
SHA512 768c0cc5f8f91975e888695c68427d210a2aeb958c5a0d450333058e5170497c25f36a1a72e196784c6ac84ca2b85f10db7ff80fd8cb7cebdc0403bbcd6936a1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 13b0182bce9b579cb2e7be61cbcc52705418d4165333c3136fd1ac98b176ae99
MD5 1bc0abb4333ecda41f898d5a9849a57a
SHA1 e39bed2ce596c7b2347714677a0b3b55d943d20e
SHA512 424a871766e9343e5365134c8448aaadac16e03a35c04ce9157aa25e679ae37b5774f8a6bab291d367eb5b6f35f5bad98e66848065f49f47b0cd378030b1c7f8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1f1020c57a7e8c085befaecc30da2362852ef199dfcfbc3e4903cbe001dc0b3a
MD5 5f4d21332006ccefc3057f6232a17834
SHA1 47771faa8bf25168811c8f19f02150d5be080d23
SHA512 6d040c610688ae4fbaa34727e129bd2ba9d88b9b48f117487ef7a90c39a549790c766c69a0ebf747221f4604db5cacbcc5c2bbfab016e228ef8ddc3d723b60d9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 abc55931525a906e2c814e78aede386e128a7fe114591c610217864e60925a59
MD5 348e911fff747e7f5171687765637304
SHA1 c651e89548d218d0f05ea81c2cac49050734b58c
SHA512 63fb7e5e3bc755f6edf8675f714e75724f02b54dfd1539a2ac89d001795a5d7afbceccb53fe275c983daf56170a6f02f9e9874a2e2e934d30c5781d2af6cfad6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76e4962a1e4566c464c8569982fc859bf3aa7ecf1bd75379f57a9bd172b8b26a
MD5 bc4c47c6d4715dd316b58ea8673243de
SHA1 8c4a7add87aa308db7ca950b39620a6e614af1ee
SHA512 ebfcea5e1afe7b2b8a7756828d92effadca287ae652f7ac38d65da70fa40dbf577f97ab58f09980ee7305dfd4e3628ceecae653d9a297d4892c1528562923397
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9e6e7af03b7a60af67ee2927b3d59ea97ef8a795ebb4a0e153fd9876e4c1d9a2
MD5 9ed1434035eb0729001ca52c09be6e5b
SHA1 418caa6e0da6f0fed6cbe25d8a5457bdae42125d
SHA512 9e8408ccf11b05c0376a43e5a44c768ec11158affe6e497ead7e388359e178d7905e569551083039e8a5169e48ebcf7572c5150121f87f33b83e8e6d13bfba04
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 94567439f93812337dfe60190209b3e7d62b11f0520b8759abfde47760aa1e3f
MD5 6dc34cf7d2d7377d3862a77ee64a057b
SHA1 a32f1b3dc5f69b82b6fb1609e09b7a81dc356357
SHA512 24a39a64b9593258ae5626c1df7df3c922a52792ab393b2a5b3d79e1c7a825a4b508085d33d6637e4ad2f08091a543034bff4cdb34c4806862baa5728265f43c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 726a7afd35a80ab7286507d600e56889eff2b686bd14ffd14030bcc3cdb62e50
MD5 0a5ed8b62bc8310577bf37b99bb13deb
SHA1 bbf2b2e67c06174b9ca54ece19796b17ab3c3366
SHA512 b546c37840a7d5729ed4bee82d1db2684d1e247bb32a0e50f9e52e152167275f7e6ff08ab9406a43917b0e956f75c656f4e3b0bbca14e497ff0417e8a29a0c78
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 08d7bbe73621aae09f09b9c0a5902ebe51d89caafcff23646ed89ee1cf4fdf7b
MD5 e4ea08c113af09666b74d1603bd0da3a
SHA1 00571cb6bd40b2c930bb1c958032695c873558a4
SHA512 6cbb119ac66ccdf8a7b7fd406abadc542c59f8785b7b942f9e1e31c9b8fd2421784a04ef488d95023ebab5c2a74d1088fd0cbf955c9060575d29161f83650a30
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 0766492f696d562ae1fbeb07878d7e45b03407e3668c22915c75bd01c490b017
MD5 1d46fa97dde055f842414f9fba9564fb
SHA1 0f8b570f887eb1ecbd7f6cb5e469fa8dc2057e18
SHA512 68e8bf31489e6793b7043e835443b807e517448a4e8bcab2b9f50087ae8cc7fe76be52bbc3395119ec161b06e8706db02eb4c623e35a6513ec1ee36d40b2df2f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 bbc2b55d2b209c8ae87c9ea1761ad07cc808c6a16885a652727fa0530c85b46b
MD5 ff1486440a738f9d102a12a0e61e0c77
SHA1 0c1ee0e7f83f0f0a9932bd6babb6d8c13727dd77
SHA512 d1c16eff3aa2ffe68a99ec2a303e05719286e2cd2826cdbaeba3f2a03f9f263eaf924a6cfdd92e10125c41c6c20e073c41d797212a408ce043cd17139a98b569
SSDEEP 96:7D6CDKIpqCE8iZRy7Di+6MsmdeYROmdUjVhYtjEsXt0/cg2Vup:73Du8syy+F0otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 11f7be808f0f471a60e358eef19e5b1f216c3bd1cae22169f7ea71f97751528b
MD5 1b57eb8d56d2c43da75c2f22c95365cf
SHA1 fb2c512b0aadb5f026d2c5f1519867642c83e69a
SHA512 f83b619b54405dc124311172a1bf2a47837511a4e4e088df64565a09f091bea847bb7c425837586cbf80b69f8619f7d4396be1cd8bf3e97392bc3ec1302f0ae8
SSDEEP 96:7D6CDKIpqCE8iZRy7Di+6MsmdeYLOmdUjVhYtjEsXt0/cg2Vup:73Du8syy+FmotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 c69f4109b50bbf7701731944db83e44f190fb49fe36f195bc23b59937418faab
MD5 ef11c301bbc792aa032ed897ed9a1064
SHA1 1bd9d3a81c1e37939fa66fff075eb3b6b7c816e4
SHA512 e67c6dc1bb5b27674348e0914735d09aeaea3daa0c7cd6f7fcb6af1f028859a01b17f40077b4d2455fee3ae28cf0889dfce5d7720209c81974610f01a55f13e0
SSDEEP 192:n2c2kJmDu86+yy+FIZkctkA2otjEsXtScPS:n2cmXyxgpJtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 9da5d0d214e56f363369e417799162e83706facdfddc637fc36863738a0a2a1b
MD5 c6fef7db3520da3f5ae85d664e0626a1
SHA1 b44a8ad71924d7cc2c5df1f6aafb65dfcd0875d3
SHA512 bcb993111cae46d4aca7ff018114e77f52c2a2dc2164a948604735548a8bb52c758bd7e1647f3f40532c66a741d7ca6b7d8a1bddc5a898f92bff95cdc5afe45f
SSDEEP 192:p92c2kJmDr86+yy+FxOZkctkA2otjEsXtScPS:p92cmgyxopJtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 614df5c922c65721ff5cb87482b90dfe19a41e056690972affb2f6fd0c849c8a
MD5 a08edeb3fdc65dd1e10db260f9c6e3e9
SHA1 62c2d13f88654fc047578cd7d03a6d360cd427d8
SHA512 cbdefb1112634b3e69a03da0afe8853b9b2d1ea588b9b0332bfd1a95c4d8e9937af546d5e6064ca78035a11d8dcde803b69ad998606db7594b71901a01402719
SSDEEP 96:nDGZc2kJzCDKIpqCE8iZt+y7Di+6MIRgmdexkA1uMOmdUjVhYtjEsXt0/cg2Vup:n2c2kJmDu86+yy+FIMkAqotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 4389f4fd4f149313e13cf3b4609277c7d3770472305c0c076c52be0afff6958b
MD5 82ef69c7318469e3e7701776bb644632
SHA1 ad7e6b7d80400c2f65dbae2d1d91bd993b316051
SHA512 9f4ea809ebfff0054fcf34e4378c2f91a16e790a34b99e2b41947e0e4c9d6eb4fceb403f9060aec18bebef7961a3d37b14df18b1c7a60d4ba52ee83523f49625
SSDEEP 192:p92c2kJ7Dr86+yy+FxOZkctkApknOotjEsXtScPS:p92c7gyxopihtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 d64417c281fd73acafa1b8d0e1da1c735efea0388195cf7468349ecd81a7dd45
MD5 04126f1ffdc751d86767c4d5b5411466
SHA1 cb4b6fe5a39a705fd78a3e1dc62440e32911d003
SHA512 04a0b9e16313ebc3706654aed8397cf169082a93d0ff2a52fa3c5f6a13a3c5073da34db6122f561f3742529a07e833ef854325e2dd80866b9836203aae1e5d0e
SSDEEP 96:7D6CDKIpqCE8iZRy7Di+6MsmdeYLIOmdUjVhYtjEsXt0/cg2Vup:73Du8syy+F13otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 608d7ad43d26d89d0a49c5f2f0960c35aab7e54067e053043750941512cb3319
MD5 e8bf0161d6d32098c651e60a5fa762fa
SHA1 2a83173d8591e3d994346a0714ee51b2ad08df84
SHA512 6fce2d62cafddb155eee3f78f27c36dc633cf33aa292d143598446dabe7af91a7a1612a953deaa69be721f6e09c06524f040225b7c3d4c7cb939bcd31c979c0a
SSDEEP 3072:Ae33uAy3vehSmpLKe2iO0i8IfZAanIC7RA0T9Q6L3tQ:Ae33uWhSmpGeLOpH576KQ6L9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 830ed3ed9661d109587efe5b4c3ec15d60b9d5625b7bb1f62152aff5abe06d0c
MD5 0df86d41fc0adbda778f5c5297e89c80
SHA1 bd1fe7d45b7002bf7912aaba49949c512ecba7b4
SHA512 6093d93114067e0b1c767d88128da3f8005b01105f4ec8712c48ec698f3e1328f2b00a5e223a2cefa7e8536b66fc6ee8affc01dd05dc0caf362dfe701635508c
SSDEEP 3072:9e33uAy3vehSmpLKe2iO0i8IfZAanIC7RA0T9Q6L3tQ:9e33uWhSmpGeLOpH576KQ6L9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 f4d81fe9b8ac4e459b1bcafdf14eb406bc8f524dd8c72c43cf3877ff04a12570
MD5 61c2e8233052ca9687250828bdc5fb66
SHA1 65a4c6669e3fe5557882e5a2035e9ec0dbfdbdda
SHA512 440ba944704562cbbddd191c90c0c708dac01a55e95f92b0d16c61a3da5388de745a58df3ae28fca7a7356ea2c09421c7a56aedac7f206ee1ffcb9180b6306ff
SSDEEP 3072:Te33uAy3vehSmpLKe2iO0i8IfZAanIC7RA0T9Q6L3tQ:Te33uWhSmpGeLOpH576KQ6L9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 3b638693a4ce8a798eb27c4d5224b157ca243300e42ed6f933dd45c6635c19bf
MD5 e0206e0966f8d6266fbfae4378b8eb16
SHA1 805e740650a5525419fcf0860830c2d16a4af543
SHA512 abd748a592a0177af4ffdabe2a5ae7f401d3054a708800299fcf57486a2c66b7d71ad6dad76f4bed5d762daedb7a875ff925f64b41c9344f7c05c5438d985359
SSDEEP 3072:Ze33uAy3vehSmpLKe2iO0i8IfZAanIC7RA0T9Q6L3tQ:Ze33uWhSmpGeLOpH576KQ6L9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 111KB
SHA256 174cb5a5bc2203af35a1ec7f99ebf4e13ecbde66b0601c341c9ef25add84296d
MD5 6590ca2d081c4a274918d58fb87282f9
SHA1 ac880fc7cca7899ab75d379b957c26410ec89173
SHA512 b0ec8395d52a60c3e816079f55585550f62ebfc4b514f442eefb1ffa331ab2c0a869379b479e418db929f06283b76e75f519291a741b1e2b6af55f049b238d82
SSDEEP 384:aNFcl+YRMnKPGNnTBUbYFLPzGZx/uvNVSp9DXYaKe6b+PLgj+rX7L/ZwXBORm003:aA+YRwVpAMHPjicMGFKs3zrUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5c49c2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5c49c2.TMP
Size 109KB
SHA256 aa28db557bb8163008956c17b27a727863734ac9ee0a02464fc347b7d3513fc2
MD5 542bd347f6180dfc4c6cb60d554c57a4
SHA1 37574cd476cfba0e46cddb59ab863321fe2d80e7
SHA512 e110603679cb2b9e75c98bf1391b332e93269e5c6f2c67913eab66e7602c9d2eb243492b5c9616ced60eb5bb2e3d4d1e5eb8de89f35d1b9fcff0ad8e3995f416
SSDEEP 384:jNFcl+YRMnKPlTBUbYFLPzGZx/uvNVSp9DXYaKeC+PLgj+rX7L/ZwXBORm00O2p5:jA+YRfVpA+HpjicMGFKs3zrUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Types.Setup.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Types.Setup.exe.log
Size 400B
SHA256 f0dfa12153a02532e0cd5059de1e8031489035844b7662c6fc97d46a2015ea8b
MD5 dd0281dbcf6d1eab4ec6c149cf4b26b3
SHA1 da467d761068ec4911390637ea1d66986a3dbd38
SHA512 d41097efca7aa0fdaee57d36343fa49345d9d069eed4b86d82136fb4058a951c7cf41717d7738f009e7caece69a4a1d0722e0d0ddcfe468b3cbd6d7b40e70a19
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 11KB
SHA256 ba27cd9e734698af45e4a223f2cfacfe45057ca936d4988b2f3056ca1b69e10d
MD5 dd48f93a511b14a336567159568c675a
SHA1 63106fc200d211b516999bf6cfb7a0eddb2fb558
SHA512 16560c0e7113fe82fe833420f45d4d86187fb06d9bcb12ad6d0fbcf190838dcc233fbd20c684565c5404d8572d5d681a57461d53344f1f19927e1704971cdc3e
SSDEEP 96:DPSFLOF1Qm3RNPSFPKLrPSFR0i/Fm7iH3RNPSF2RyY3EvFeE3/PSF4zMPSFg0F0:DuLh6uPSulkGTu2RHWuTue
MD5 SHA1 SHA512 SSDEEP

Submit Download

Types.Setup.zip.crdownload

Path C:\Users\Admin\Downloads\Types.Setup.zip.crdownload
Size 66KB
SHA256 af9e4e4ebcfc45d62e4aec9cf861b849a2c3da57ad7a1c540ff784020a950c74
MD5 f527977f117bc4dfcaefa2371e6889fa
SHA1 0be694b5d62b0f98bd008ff660244790a0603f00
SHA512 68262f7b7c5357fdb76518d3bfded81f1574228e9e85b3417899cc9af17e14efbd029be3303f1fdcb973eca0742c0884f85e834778f010b2477ed2ad0b8ab868
SSDEEP 1536:UHuC154JDb/ynZK0w4XJxU5PqucSu1Nx7:UR15s4HDtau177
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gyat.SED

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\Gyat.SED
Size 946B
SHA256 72838bb6fde1b560eee5b98910ecc98cbdb18c201405d3f15ab77a4a14901186
MD5 a86b4578e6655351ae9303177350df39
SHA1 c91d0b8b7490474f7525dcc1d67cd9a40e31608e
SHA512 2542ec13028eaea5e768b8078e4b4de30b306aa3dd38ec2ca24542e8e7605f1cb37beeb5d89fd52dbbe7cbd853dd162ac49c36a2a1d9727bce69e7b59b9aed72
MD5 SHA1 SHA512

Submit Download

Gyat.SED

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\Gyat.SED
Size 131B
SHA256 d354e39fe0c9fa8d9ec3e0b74be827d86c67e2232bd0f0497abf01c56e16b034
MD5 ceb4caae7b47002892fcbc1a7707a573
SHA1 972f38a032098698e4562b446fbb5445a932126b
SHA512 15722b17213339380dc34f4fa68b794bf5fc2da8b19eee71c20e1d2e6a7f893318fed29a528e42d897bb13a1d64be85522860130942b591d31de1f72fdcbdb87
MD5 SHA1 SHA512

Submit Download

Gyat.SED

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\Gyat.SED
Size 915B
SHA256 be845c3f77e201b4876efff7742ae8cefa9f654d74c7844601f823bf99770eb7
MD5 d35439bcb601c44af40a0e928d80e26a
SHA1 37c88421d6b4c5197c1d50e995b8cdedb3fc6f3b
SHA512 6a8548081d9fe1f97e22992e7ce33cbf2c52d7ad1d2ea7731c981e4538cc1836acce5e8460367ca48f954415e7e69052bcb7eb6c64fee042714dec769667b081
MD5 SHA1 SHA512

Submit Download

Gyat.exe

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\Gyat.exe
Size 141KB
SHA256 ab519b1c2711219a9f262b23bf72343eec3c0df4c7ddd135d30d05e700ec302e
MD5 e78764b49f5806ce029cd547004493c9
SHA1 8c1f3f989913bebf827a707c04754047507a8cf3
SHA512 71040e5f0d2d409efaba70a7daaebe7a4675cb19009436a826a679671cc0d7c960498364ec7a29fb163ce8dada65218b75bebb973e6c8b194734e01970fd3a6b
SSDEEP 3072:EydsuK56kNe1bcWp1icKAArDZz4N9GhbkUNEk95t:4Cdp0yN90vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX2D3B.tmp

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\RCX2D3B.tmp
Size 261KB
SHA256 04f73116aea83143c570269264fdec13b8bf5bc5a30813f7acfe4192ace16298
MD5 515ddebc6cd9e27d355cb9a8e470371e
SHA1 7282a61433268994774f00d05d1f8d1ef20e729d
SHA512 1e0f39009f01a810123466569e50d25e3a0d3ff5f3de946a3246f559676129b6b3d3d1d59dd3a738ce0ccfbfdc1e693ff2cd6be7ba95110a94203879faf337e9
SSDEEP 3072:qydsuK56kNe1RL5GWp1icKAArDZz4N9GhbkrNEk5N7AX8VBt3wRW8ffMyWcLBq5p:eep0yN90QEVdWOBquw
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCXE2A4.tmp

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\RCXE2A4.tmp
Size 261KB
SHA256 853430b800a06f97ea3a14227511884d1cbca2a6fb6152631647ec6d75fcb2b5
MD5 289e1174033156f11fc90b60603a66c2
SHA1 372f5951216bccb864c45cea3367090e324e46c0
SHA512 031e74e2632fc83e66f351712275e1e7b559726561063306aeed47bc011bd55bb7ccfb48d69d63c9e9cf87a72e3b07a0a5855d73accfa13ae176d536bd615f3f
SSDEEP 3072:PydsuK56kNe1Fb5GWp1icKAArDZz4N9GhbkrNEk5N7AX8VBt3wRW8VfMyWcLBq5i:Jip0yN90QEvdWOBqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

~Gyat.CAB

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.CAB
Size 47KB
SHA256 49bf481fd6834d1115a4212219c2e9f02a5fb5e134a73497a28a7451370d4937
MD5 61fb83d8bb984c57884d561c9fe857a7
SHA1 1c5f83198663f53e3309e461de52282c149f4120
SHA512 caf6599740ba2227ef45aae31f10a0be054eaa305d1b3bd390e78d2f74ef482eb0a63bb4f5e8581300eb302f141a038e22bd2f14dd3b3f606a1ae8bb13618027
SSDEEP 768:AzIG9vFnnuuNfVS3GQuWcLBCzVilMgePZ5PR7thRGYz1YCmJoON0OO72YLlNnWx4:AG8fMyWcLB/beDPVrRGi1YdSVtcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

~Gyat.CAB

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.CAB
Size 47KB
SHA256 48c732203c10f28d3e4fcc1a562d59261710e3fad757ceef71f7ec1d1bc4830b
MD5 fd6a73671795e3d4d1647a29b9e08913
SHA1 af18bb9b62960bb4b5f1330b6aeb625f8e177038
SHA512 d471fa6add418be2ecf0220fbabd23deeb90b15d1ac660c515fb57b44ed5c5a86fac2b24a547411219063861bb64190fe510406ce53f70b35c8c8ce733f086ca
SSDEEP 768:KzIG9vFnnuuNfVS3GQuWcLBCzVilMgePZ5PR7thRGYz1YCmJoON0OO72YLlNnWx4:KG8fMyWcLB/beDPVrRGi1YdSVtcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

~Gyat.DDF

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.DDF
Size 851B
SHA256 be2f405151927298af7b28bf991d4d5df017f799e41f72bd3e0825b925767b55
MD5 a83b485cc7af5b3f0bfecaafc7cd1aa8
SHA1 32ea9c7ea2c02959e34b844dc593a2344001f1fa
SHA512 916f5b4bd255f0c3eb677643c58dc7070a6fbe91a866ce05ad18c7da463a4b3ad8d215557d1d4997507a2644b7c1c80140d53c4d45eaa11c0ab99590e5956f83
MD5 SHA1 SHA512

Submit Download

~Gyat.DDF

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.DDF
Size 847B
SHA256 2cb38ad56f9656072da889b9900a9c3577df7fa5aa731d430ecaa42bc6478f5d
MD5 e0604237572ba50ac0d4aa783ff71577
SHA1 6193513911033b6038b32b42f73b9cb5bd48e878
SHA512 1962dfa5e2667d85425b146f0da269cca0cce604306d4991ddf24f7ad4ca5f1ecb06f36e2f05c7eb0dc19586c9a03ff70e6ba9c30d21bcfaa71ead1965a92ce0
MD5 SHA1 SHA512

Submit Download

~Gyat.RPT

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.RPT
Size 283B
SHA256 ca4bde15913fca0a310f31d3d4a6c7ccaf6f9cc30eec67a795226f6bcd58cfc6
MD5 3941ad9b968d47a5224a07467d540459
SHA1 9338d3db57aabfd478225f695b3e497ef4852c71
SHA512 c423dcd5ad8bb89a45bb9d71c7200e66e9b3c12348bb4b796a7b86a40d4093803cd4106a4e40dd9739e07397b853599fffd7caa50e76a494a0f0a16e0279e638
MD5 SHA1 SHA512

Submit Download

~Gyat.RPT

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat.RPT
Size 283B
SHA256 5c8e64e08e266bd11a836f999ebfac7acd98c87094809d2c82beec0609584ca4
MD5 395d6c131bfd27240c29870e62dfa982
SHA1 ffddf8effef814a6ba207b989741ae8b30deba88
SHA512 2dd10fb57fb74186344dff5942ecc8c00339578a57259f025f4459c8378f93cccafcc1b2de1779a5cfbc6af979457006b81e1f4ad15996dd8742cd6db752d9d6
MD5 SHA1 SHA512

Submit Download

~Gyat_LAYOUT.INF

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat_LAYOUT.INF
Size 1000B
SHA256 92b56ebf709f698e9661e1007d718ff92175dd4072a11c163de107ded2d6e84a
MD5 42ad74b78b59e6ab1c3ad99986509bb1
SHA1 283cdb9db5728c277032b0bbe86ee2ee9bd7142f
SHA512 6495f46dd591b618eac2c25b242dbb046c38e2b16ffb10608d3870412f56b6a1bac0b53794570e3433447e320bab69115e7bec73c026042c89812f6281b29abc
MD5 SHA1 SHA512

Submit Download

~Gyat_LAYOUT.INF

Path C:\Users\Admin\Downloads\lmg_MlaKaifa2333_4k\~Gyat_LAYOUT.INF
Size 996B
SHA256 82497e45a721bfbd3400088c525506aae3fb7b2049a3500d4f9731540c2caedd
MD5 a772b8a2060fe041a2e5937f1e634790
SHA1 9cf4753b57e9791dd7271bcbcf62c96bffc82225
SHA512 953ce8c244e93a63bc4598919e3ed51875d3847eed855224cc52e5cc4c41e7a6f1feb4bef9880e8206c000aa2dbf035c8ca57175c34a3210d33c38d8f0bc23aa
MD5 SHA1 SHA512

Submit Download

memory/2136-468-0x00000000025B0000-0x00000000025C0000-memory.dmp

Download

memory/2136-469-0x00007FFFB9AC0000-0x00007FFFBA460000-memory.dmp

Download

memory/2136-467-0x00007FFFB9AC0000-0x00007FFFBA460000-memory.dmp

Download

memory/2136-466-0x00000000025B0000-0x00000000025C0000-memory.dmp

Download

memory/2136-465-0x00007FFFB9AC0000-0x00007FFFBA460000-memory.dmp

Download

memory/4776-454-0x00007FFFB9F70000-0x00007FFFBA910000-memory.dmp

Download

memory/4776-449-0x0000000000910000-0x0000000000920000-memory.dmp

Download

memory/4776-448-0x000000001BF40000-0x000000001BF48000-memory.dmp

Download

memory/4776-447-0x000000001B3D0000-0x000000001B46C000-memory.dmp

Download

memory/4776-446-0x00007FFFB9F70000-0x00007FFFBA910000-memory.dmp

Download

memory/4776-444-0x000000001B950000-0x000000001BE1E000-memory.dmp

Download

memory/4776-445-0x0000000000910000-0x0000000000920000-memory.dmp

Download

memory/4776-443-0x00007FFFB9F70000-0x00007FFFBA910000-memory.dmp

Download