hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan

Analysis

max time kernel
1190s
max time network
1687s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-04-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan

Score

10^/10

adware discovery evasion persistence ransomware stealer trojan upx

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebCheck = "Î›%K.ŽDñz\x11\v\x17\u00ade\u009d+’Ô\u009d\u009d1Àrƒ¦£6¦"	cmd.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "&º¯«>h\u00a0\x01yäöÙeÙ\x02Kšójý=)kùÛ\a%\u0081"	cmd.exe

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16\FuncName = "‘\x03Tû\x1aß”‹¯\x0f\x13½ÑÔð™0\x7f\x16¼»]ˆ«Ã\u008fmÝ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\FuncName = "Á\x1b,s\u009d\x11ñdMÒ‰ÏBù¨of®v÷U=\a‚™]Êç"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "F\x18†Gì\rÇ\u008fw>\x13Ú\x15@†Ò¦sÎ†;9¾ìüê\x15\x16"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10\FuncName = "²ƒ(yËfdÌ´ôZµåŠT3ã%†\x0eØù8ûM\x04Rè"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12\FuncName = "\x14·\x02(\|C$mEÄkQC‚\u0081Ç‹æ?;¢&ì:ÀtZ¹"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "\x11ÀÆÿ¥Ï\u0081\x1a"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "\x0e\x18sïR\x17Puú\u0090©«HÅ\u00a0M=¦óÃ<ø—¬ÑÑ½–"	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMd5ThirdPartySha256Allow = 0d0003006f00f10050003d00cc004b009000ec00a200cc00580011007600ca007d00dc002d000000c0007e00df000f0019005a005600380000000000	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}\$Function = "Ù\vâƒ\b._\u008fñÂÉ[]\x11hv\x03‡~¿\vCœ\x14è_Ë—"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "MØÅÎx!ç•ŒP\tƒ ú\u009dçNÆ¤ü7ˆ>‡Ú\x11nô"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "H\x1cÛ/2‹ŒÛ¥k\f\x18;;2\\ ”j³!R\x10¯Ú\\“#"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "‡æ95n-Ù‡6¶Ë9ò¾Œ1¼Ñ…§\n\x16ÐëJéTý"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28\Dll = "\x18§\x18\x1c-6©\x14»®œ4hjðæ\u0090×2lÆz³ú\\\u0081,”"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009\FuncName = "œPY¼ ,_(‡a*ËW2\x0f¯4ÿ´&e<½7ÞÄlã"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackFreeFunction = "þaIùù;\\ìi}tòö\x19¼ºÁ¯›³vì}‡”\b&¦"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "\x04rˆh\x1d,t~7‡\x1fÕeº)—\rb!™R“ÏÞAè58"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "D§Såƒ4/[¶¾åLàäj—a\t¢\x01/2¿\x15²ó\x03¹"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\$DLL = "Z¢}¨9þŒ\r6Ï¸½Ÿ\u008f5á;\|Ãu,ºÔIÌ\x15\x04Ã"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackAllocFunction = "3¬4\u008dŸô12\u00ad\x13›\x10«³«\x1bÄÊñJ«°õÃ\x15\x1dó`"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "¶o¶Ô¶@»~:6\x1a®t'd\x04\x16-²#—\b4“€€0\x1c"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "¨YqpA×‚ïKCÐzF\bšÝhÿÍ)G\x04\x1c\x12áG°ý"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}\Dll = "4†eK “¹Pøû€Ì\|o¨q+]\x01QèiÚ\x03…\x16¤Ú"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2\Dll = "UäX’\x17î\vÀ`cšõWÊ\x01ê:Ikl;<RÛÊ½c;"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "úLšWl/Dý2V§èä\x18rN3C<Šü5Ÿ.GÒ=Â"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Ì\x1a*Œúw\x0fô\x1e\x18×âOEwÀuwºË†˜é\t}bG\u0090"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "z½-ÐîgÃüÐ½s:öX÷*Ç’ã“F\x1ao²Š¾\x1eÐ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\FuncName = "ƒ×´\x12•\x05Ç\x12&gÑ‰\x05M\v§ß3\x1e¿¼PãOÊÝ1%"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}\FuncName = "\|Ãmþ‘â©\x16nò(aþ˜}r.Ä¶\x03Hðy0ù-æå"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "\rŒ2¼z¿…\x1dƒ°ÄKÑ¢ï]fMNvÌö&>žëâ]"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\Dll = "šÑ\x13\x065\x7f%’]\x05\b¢–Q/WG@\x141À1Hž\x0eW¿+"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "ó^ð@˜—~ñL\u00a0\ryºù\x19æ]\x01ÿf,D·\x10x’ß¬"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\FuncName = "Ï^ipVG6ÐTèø2ŒÒaÊ\\KFñb»^¹Æ}#\x1f"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}\FuncName = "~‡¬#ÁÃÐ\x1d/úþ+Q£4½(w«ÒqS@EJ€ž_"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009\Dll = "ï\x06$ë¬K\\–¢œz›ÀÙ2æ„pÊÖX÷\x17\x14)\x1b"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "„å\bx1\\)Iþ<=’ÐÜz Åâ7Ï‰\x1d\"\u008f?+Õ("	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "\u008d\u00a0z¼úé\\&}¸r*ÀÑþ¹÷WþN\x1a-b\x1bÏu½÷"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}\FuncName = "B÷\x13{4üxr\bU—²Ì—©b"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\FuncName = "#ïò\x0eùç¼ø\x16×ÁzùU[¸;U±¤„ø7ºrB¦€"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\FuncName = "7e@…pø\r z\x7f¨¨\x05¸&\x19˜ÒqYá°þ]„ÃP•"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}\$Function = "rõ¬±«&œ\x06°*>\u008d\f\x13%ÉòÏEpdméƒ.‡\\–"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "RâŠ\x0eÕï\x10{\x0fÌŒpÖ\u008f@Í\x01·ÄIuý7B\x1dîk\x12"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "›\aLX9õ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}\FuncName = "‘TSÑ\x11ÁÙ\x14•QS\\\x7fªþ}\x14b\x01e\x01\x1dâ\x05\u008fc0\x02"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007\Dll = "Dñˆ¬{Ò‡)Žiû_§ZâLm\x06ß+â\x17~“\x12)x”"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2\Dll = "\x12”‹îV\x0fÓžÐD³Y.¿¬ªr-æ\x1f!é>õùV¿Ó"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "\x19õûWÕI¬\u008dè\x1d#«[ie'$¯\x1a=¦ü§u`&2="	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "YÁ¥\x16ÐSÿ®\r2A_ž`s€)\x02mä\x03á\n<Žš&\x04"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "Ç\x05A¸\x17†?¤Š×Ãq5ežY\x10f\x06žB¶Íá^ªúv"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "Êê-L: @\n\x1dõ¶Ï˜³\x7fÝ\x1c?\x1a\x16ð>+#4Àu\x01"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "\rÄƒ§o!ð¶DãÅ¸HŸ\x15æ_\u00adSë±Ú6N¬\x10v["	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "-œ¦Uøº\u0090ÐŽbš.\\Ž\bÕp\x12œÿ^ÆüV]\v/U"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\FuncName = "eÎLÝŽ\u008dpTF\x0føwsÑÑr\"në\x01'‹n9\u008f©O8"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\FuncName = "&\x1f_\x12\x02\x033Úà/-®^åÍÛûªÐ²m\u009d–À2=\x7f“"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\Dll = "\fûjÀ\|ÊË¯uÆ1%\x13Üs\x05Xñi÷Ànsà\x13\x02¿ç"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}\Dll = "½d8\x17/Ap U\x13Øw\x17QÉª%\x1e"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "\nJp*¼ãÊ%kr\x13[Ø·°ìç\u009dh6c{¸»Òi\x1b{"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}\FuncName = "OÃ\x11FÒ_\u009dRQ‰¿JçÑ]×Î±š\"¼;ö€Lh‡o"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}\FuncName = "¸w9Û\x16p’*¼êYgríqp9›œj\u008d\u0090™®È¿`¼"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2\FuncName = "\x17Ü\u009déuÑ\x01\u00adÚFòQ[qßñH9ëyo`\x10\x16€[0µ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "$º5î~gÎŒ—\x0e\x0ez\x10ýÿ'Ûô¹¶®\x1büå<„K1"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "a[N®D\x03š\x14j\x17¦6mfÜþHnBS¢l Ýõ`H@"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10\Dll = "&ž5aáßäðDà\x12ï¡Ü‚\u009då‹RÞwök¬'¿!è"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}\Dll = "³‘¡\u0081}Ú¾³ò,í¸¢¸\x1a&ÇË·µ\x1fI¥úN\\ŽÕ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}\Dll = "ïJ¬±´—Q@Gò\bž)fcGò;w[ý\u008f\x18\f'Íý$"	cmd.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Modifies Installed Components in the registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cmd.exeExplorer.EXEExplorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}\Version = "œ¦tÇÔ\x19£\x12\r<ïÜöÝQ\u008f¨²äÿ\u009d¶\u00ad%9=\bä"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}\Version = "b>~\u008fgÉŒÂâò\x14F\u008dÓY»Ž’’MúY\r!\tO±¥"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}\ = "C™\fGE£\x01‚]‚Žü„\x05\x1bY5\u0090:W\x02]\a*”UœÈ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\Version = "õâ©á›ˆ^Ýo!vuq3\x0fŽV«eŒ°Ñí\u00ad€\x02i."	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\ComponentID = "\x04âŸÙçýº‘\bÓþ\x1b:äóKæ“\x15ë0ô¯`AF®Ý"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\StubPath = "\\Õ˜³å\u00a0:^£_\x11vín)´\x18ÆSðcÌ_¾DC6Ö"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\ = "oþ\x0f\u00a0µK²Mb{:àÍez—!êåcàZTFŠ·\\„"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10C4E843-C226-3FDF-9DD6-F4E3275E734D}\Version = "Tz\u00adL„S²Ï£R«\x03Ø.¦¤ðO:\x1aèJ…âa©•Ö"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\ComponentID = ":°&üEqj\x03f#«’\x0f‡\u0081ÑÊÊš’`t_ßw’å:"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}\Version = "d+\u00a0¤›Àvº‰yXîˆý•\x0eñ±P0-o.Å\x1eú¦š"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\StubPath = "P\u0090ÆpÚPqòÿ®úÐ:o)¾Nt&}’¤Ê\x01âZcõ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}\Locale = ".FWÎÉßbÓp¨F\t@\u009d\x12€V×Ä×ª‹W,Oq¹"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Locale = "‰\u0090pÐ†ú¢‰Ÿ¾^\x16uS'\x13Ã\x14W}UJükæ\x1aD\\"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}\Locale = "–AÚ\x13¥¸Ã¹EEQ\x18]\u0081Yè\u00ad°=ÿÞÄW«äÙþå"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "˜\aÖæód\f\x14ê\x19ÍX(\x12ëÕk¶X²\x02”È§Y‹\x1bM"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}\Version = "DÁ\x15ËJ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\Version = "T„\"O\x7f\u0090 cý"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "è\u0081S%Òò…Ì¡Ž¢š†.œØKÒ›\x18-án€+8,,"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79}\ComponentID = "œ€až\x15ÿû\x16Ìc¹=\u0090¿‡vóP:fœomJISš\x1e"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D}\ = "\x06.&'\rßÿ§"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}\ComponentID = "a²TTÎØ1ËÊmÉvCAëÙ\x16IXÝóãä\u00a0wÀ\x01™"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}\ = "u\aƒ\u0081ÅÿM7\|8œ\x1d¸&šÞq.]H\v²\x183÷Tˆí"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "Admin"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ComponentID = "ò{}¸»ø¥GãtüÙ3QÏ¿ëƒ96ÚþíA\"\x11›="	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}\Locale = "á~ñÞ\r7½c>ö\u0090²²Ú\x03]ÇˆOäûdæ\u0090H³¶Q"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}\ComponentID = "¬Sî,s\\\x06áFU9wÐ9\x7f\x12‰1\x11;,Ò\u008d1.Q\nÊ"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "J™žc\\ˆK\x16$Â\x14Ùqëk\x7fSÿ_ü\u00ad\x1a®™‘åjù"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\ = "Òà±6\u0090Ý\x0e\x1dær¸\x11âbÓ:\u009d\x12QKyóÿ5ƒsAx"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "»¹/¼ŒúQßàÊ:á°5IÉm’\u009dø½È\x1c0“z8Ô"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}\Version = "m©hÓÉ\a8\x12\x10fì\x11(P°1w{™±]¨ÚLàà×~"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}\Locale = "Î(\x04÷R@ËÜ«ÏUÚ¹À\x126P@„Ù3æPC×\u009dÂ+"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\Locale = "4GZ6‘Ñ5(ÞˆuŒ›K½ \"©D¨[ê³(÷Ôûˆ"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\StubPath = "ý$gÎã.Î%\a³¤\u00ad\u00818Ëå\v¤á§€…Ñ‰Í¦O©"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}\ = "3n\u008d×¬™a&9€Šq\fnKôqÐð\u00ad{\x1a\trØÊ\u008d%"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\ComponentID = "?\x18q\x06Z‡A\x13\x1fÝ¦’&•Y÷ƒA\v\x05.\x0e÷\fH+èS"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\Locale = "ÎÐ¾ºè(*#\x18ˆc<Ÿ÷q\rŽo2Ìë•oôu,Ò\x0f"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\LocalizedName = "°—)6>×€¾8g7Í\u0081Ç\x010í\x18\x1f?¥8#öÑjkÓ"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EADE66-0000-0000-484E-7E8A45000000}	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\Locale = "ù_å\x18¡´*ü9\x02HµC\x154~Â\bØ/cF€ýZ\x1f¾\x17"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D}\Locale = "\u008dÈrŸíÉLY{u\x1bÿ;+\x0eŒÏ.4Œòzù:V}\x0e`"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "ƒ\b4!Ôc-Á8\x04ˆïa÷}ì±\x1a5¥!G\x15\\†¢…<"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\ComponentID = "ÄufåÇgãîïq\x01\x17G¦Étté-HªèkŠ<\x05aj"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "R\x11/\\åN«j\x1d\x7fÈê{r\x02¢ˆB\v³»\x06R\a$¯&¶"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,10011,16384"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}\ = "ûôâÄeú¯\x1a/;Åºšnx\u008f'K„\u0090œÇ9=Fxxã"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\Version = "Jè7O\x02×µ`‘)D´‘Dó\x10€ÓwÍ²\bK\x1bV\x06cÀ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}\ComponentID = "\"µ-Aê˜\r\a×Æ*ÓýË \x1c\x1e\x1d^©\x13ƒr‡Z¬\bÈ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}\ComponentID = "ûàP•2³W\\W\"\u00a0Fdà\x16G3€%öD¾GÁÔ@‰0"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}\ = "uT‚ïu^m\u00a0à5nÛl\aŽ¬'"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Registers new Print Monitor 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

spoolsv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\IppMon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\OfflinePorts	spoolsv.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation = "3!õÓ´\u009d>\v:Œà¦"	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

VeryFun.exe

pid process

308 VeryFun.exe

pid	process
308	VeryFun.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\VeryFun.exe	upx
behavioral1/memory/308-556-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/4392-559-0x0000000003300000-0x000000000349C000-memory.dmp	upx
behavioral1/memory/4392-563-0x0000000003300000-0x000000000349C000-memory.dmp	upx
behavioral1/memory/4392-565-0x0000000003300000-0x000000000349C000-memory.dmp	upx
behavioral1/memory/4392-564-0x0000000003300000-0x000000000349C000-memory.dmp	upx
behavioral1/memory/396-579-0x0000000002600000-0x00000000026F4000-memory.dmp	upx
behavioral1/memory/396-582-0x0000000002600000-0x00000000026F4000-memory.dmp	upx
behavioral1/memory/396-583-0x0000000002600000-0x00000000026F4000-memory.dmp	upx
behavioral1/memory/1516-588-0x0000000002730000-0x000000000283C000-memory.dmp	upx
behavioral1/memory/1516-591-0x0000000002730000-0x000000000283C000-memory.dmp	upx
behavioral1/memory/1516-592-0x0000000002730000-0x000000000283C000-memory.dmp	upx
behavioral1/memory/308-593-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-605-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/2228-615-0x0000000002B00000-0x0000000002C0C000-memory.dmp	upx
behavioral1/memory/2228-618-0x0000000002B00000-0x0000000002C0C000-memory.dmp	upx
behavioral1/memory/2228-619-0x0000000002B00000-0x0000000002C0C000-memory.dmp	upx
behavioral1/memory/4392-620-0x0000000003300000-0x000000000349C000-memory.dmp	upx
behavioral1/memory/308-626-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/3432-636-0x0000000002620000-0x000000000272C000-memory.dmp	upx
behavioral1/memory/3432-639-0x0000000002620000-0x000000000272C000-memory.dmp	upx
behavioral1/memory/3432-640-0x0000000002620000-0x000000000272C000-memory.dmp	upx
behavioral1/memory/2592-641-0x0000000002D00000-0x0000000002E0C000-memory.dmp	upx
behavioral1/memory/2592-644-0x0000000002D00000-0x0000000002E0C000-memory.dmp	upx
behavioral1/memory/2592-645-0x0000000002D00000-0x0000000002E0C000-memory.dmp	upx
behavioral1/memory/308-646-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-647-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-648-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-649-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-650-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-651-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-661-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-662-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-663-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-664-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-665-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-666-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-669-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-670-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-671-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-672-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-673-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-674-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-684-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-685-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-686-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-687-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-688-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-689-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-690-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-691-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-692-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-693-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-694-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-695-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-696-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-697-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-698-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-699-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-700-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx
behavioral1/memory/308-701-0x0000000000B90000-0x00000000011CD000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

Explorer.EXEExplorer.EXE

description	ioc	process
File opened for modification	C:\Windows\³ªot7BZTg«ØE™ƒtW1Þ¿~na•3@ø\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\³ªot7BZTg«ØE™ƒtW1Þ¿~na•3@ø\desktop.ini	Explorer.EXE

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ = "„©×D=\x05i\x03Y„á©Øjµá{\x12\x17*\\Ü8\x03£²Ý%"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\NoExplorer = "}\x05Wz#ä³²Îö§rã\x04òoúººNË»ôô>ÏÏ£"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

35 raw.githubusercontent.com
36 raw.githubusercontent.com
Maps connected drives based on registry 3 TTPs 1 IoCs
Disk information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cmd.exe

flow	ioc
35	raw.githubusercontent.com
36	raw.githubusercontent.com

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cmd.exe

Modifies WinLogon 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}\ = "œA&]¹\x05¹DCZ_\x13æ\x1f\x1e+\u009dûœ\x12\x06"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}\DllName = "®dC†\x1bLÇô’•[ÃÀ\x0e$;'ðêV¬¨j~ûÔÌ¡"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\DllName = "\t3hK¼Áí…ª+hý~P\u0081ißÎ©\x01b+-w¡Lûu"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}\ = "'\x0exÕ\x05üÎØx¾r¼•9ö+æÄ¡x\x06ÌSžñ\vª²"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\DisplayName = "øXª\r<ôõô´0#+Ùk\r!u¢×\u0081úŽEeP\u009dìæ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}\ = "\fÓ¸gc\x15£?%ç®í}ûàu\bDß"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}\DisplayName = "e]õÏ®íâ\x11]:7Ç\x0f]›ý"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}\DllName = "Ú.3˜9BÇvù¹p!õ\x16\x11&9Ó\x12Šµ(jÁc\a\x0e±"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\GenerateGroupPolicy = "zêþ\u00adM·»Wª»\x15\u00adqï]B€ÙóDä\x1cÄ\x15ÍÎÒ£"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\ProcessGroupPolicyEx = "Í&G-Ô7{³ÍEÓIi\u0081<\u00a01£Xks‚Û\x10k¢\x18¹"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}\DllName = "þ\x13ÏkL©9˜,¬\u00adM¸\x0eÉE˜-WÌ¿û\f\u0090Öß\x14d"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName = "~ªN`¿]\x05Ùr\x1bA¡¢£\v2Öõ\x11L\x16³ßÆü\"o\x12"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\ExtensionEventSource = "Â¡ú\"\u008f`xm!Û™ða\x04\b:I©<æ\x7f\x03`\|qâäC"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}\ = "ñ•÷÷™«~;Y«_Y\x01ìª©-Ñe®_ü•\bÀÃ]Y"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}\DllName = "ÓkzÙAE³ø§y\x05n¥[\x17‡ûÚ\x0e›‘\\\x066Øþ·Á"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}\EventSources = fc00ff00fe00e80054005d00ec00d100a0002d00e3001e004b00f2002120f5006a004300cf0060016800a0006d007f00ac003000fb00cb0000000000	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\ = "_>X(äj¬b>x¿9‘j\x16¥ð^•¯Wª¬&ŠÕÔ#"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}\DllName = "\fßüS\x11.k\u0081\bV\x16Ã++O¼6\x1cf’´›âþÂˆg¢"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}\ProcessGroupPolicy = "¹z\x13œ\u009d·\x1dêçi\x19Ðnq÷4d†ÕD\x06\x16cñ³9$ª"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}\ProcessGroupPolicy = "\x03uˆ=ß“SÇ“á\bö7>hJ\x03Œ²¾8Kï~¬ð›™"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}\DllName = "\b³\x0e>\x1dƒ8F„›/Wìhñ\x0fqS\x12ãGÆö\x03Ä\u008fC\x1e"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}\ = "*üà\u008d\"ñâeOZ\x16\u00adêùºéÿÛ{òÃ\x1b¤ðÆª°ê"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}\DisplayName = "cÒ‚R\u00a0’Hnô\nÙõ,fk…ÖÁC2WÆ‹Œ¶QZO"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}\ = "éºF9\u0081\x06t,ô¹D‹#yõ>îÿ\x1c“É-\x10]H>âU"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\ProcessGroupPolicyEx = "ÎÜ©F6,"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}\ = "h¸ç4›\x04FÎpõ8ôï\u008f\tÂ\x1f\x14+ôY\x01X¡‰yLü"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName = "\n^\x1eIL\u00ad™•Ð\bÆn\a–Möã;\u0090¬,©ªª\u0081¬+\x1d"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}\ProcessGroupPolicyEx = "ÒBˆó\x0fËóF\t\x7f•zSó´\x16•ž®NL\x1a-~”\n\|’"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}\ProcessGroupPolicy = "\x1b´\x1eHÒý\x12§7\v KžÓcÕ\vç,8Ø%Çk"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}\DisplayName = "ÊÃ4èAâÐî\x13\u008fávu¶TƒžRÀDvÁÇVÔ\v\t'"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}\DisplayName = "/\b\x14ex\x12¾ªÈ&þ«1í²XÔÂ9·\x10\bXöFI"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}\ProcessGroupPolicy = "6Å\x04BŽrú˜(—'‡\nßÌìÅÄqæŒ¼I\n“2l/"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\ProcessGroupPolicy = "]è\x1fÒ \x02Ê»\x05\x19\x06ÔCòkŽqçE\u0090[\x06t\x16\x1bÒY>"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}\ = "«Ý‡B^”^Ú]‹<\"ÿÄä6³J—÷O:k22œÝÍ"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}\DllName = " cÜ\x1bW©Ô\x04s\u008db\x14ÙdŸ:Ö+–V\x1eâú¬kg´—"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}\DisplayName = "(²\f0Rœ\x15©sJÓM„\t9‘sŸ]~îÓîÞÓPŸM"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2A8FDC61-2347-4C87-92F6-B05EB91A201A}	cmd.exe

AutoIT Executable 47 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/4392-565-0x0000000003300000-0x000000000349C000-memory.dmp	autoit_exe
behavioral1/memory/4392-564-0x0000000003300000-0x000000000349C000-memory.dmp	autoit_exe
behavioral1/memory/396-583-0x0000000002600000-0x00000000026F4000-memory.dmp	autoit_exe
behavioral1/memory/1516-592-0x0000000002730000-0x000000000283C000-memory.dmp	autoit_exe
behavioral1/memory/308-593-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-605-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/2228-619-0x0000000002B00000-0x0000000002C0C000-memory.dmp	autoit_exe
behavioral1/memory/4392-620-0x0000000003300000-0x000000000349C000-memory.dmp	autoit_exe
behavioral1/memory/308-626-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/3432-640-0x0000000002620000-0x000000000272C000-memory.dmp	autoit_exe
behavioral1/memory/2592-645-0x0000000002D00000-0x0000000002E0C000-memory.dmp	autoit_exe
behavioral1/memory/308-646-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-647-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-648-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-649-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-650-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-651-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-661-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-662-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-663-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-664-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-665-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-666-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-669-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-670-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-671-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-672-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-673-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-674-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-684-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-685-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-686-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-687-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-688-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-689-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-690-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-691-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-692-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-693-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-694-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-695-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-696-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-697-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-698-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-699-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-700-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe
behavioral1/memory/308-701-0x0000000000B90000-0x00000000011CD000-memory.dmp	autoit_exe

Drops file in System32 directory 16 IoCs

Processes:

spoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_bb379132d2c203f7\Amd64\unishare.gpd	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{58D51CF1-F3B9-4D4B-8667-792476090C27}\PrintConfig.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_bb379132d2c203f7\Amd64\PrintConfig.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{58D51CF1-F3B9-4D4B-8667-792476090C27}\MXDWDRV.DLL	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_fd9b9365c7be8df0\I386\unishare-pipelineconfig.xml	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_28deabbd337eb1dc\I386\MXDWDRV.DLL	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_fd9b9365c7be8df0\I386\PrintConfig.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\W32X86\{5084390D-F1D6-457B-BA2C-D4CB129E37DA}\MXDWDRV.DLL	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\W32X86\{5084390D-F1D6-457B-BA2C-D4CB129E37DA}\unishare-pipelineconfig.xml	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\W32X86\{5084390D-F1D6-457B-BA2C-D4CB129E37DA}\PrintConfig.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_bb379132d2c203f7\Amd64\unishare-pipelineconfig.xml	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\W32X86\{5084390D-F1D6-457B-BA2C-D4CB129E37DA}\unishare.gpd	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_fd9b9365c7be8df0\I386\unishare.gpd	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_28deabbd337eb1dc\Amd64\MXDWDRV.DLL	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{58D51CF1-F3B9-4D4B-8667-792476090C27}\unishare-pipelineconfig.xml	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\{58D51CF1-F3B9-4D4B-8667-792476090C27}\unishare.gpd	spoolsv.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

cmd.exeExplorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WallPaper = "ê~lñ\b/\x0eSÀc\u00ad¯p\x1d£Ñ\x16¬_ÀYgezÅ;´Š"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "ê~lñ\b/\x0eSÀc\u00ad¯p\x1d£Ñ\x16¬_ÀYgezÅ;´Š"	Explorer.EXE

Suspicious use of SetThreadContext 7 IoCs

Processes:

VeryFun.exe

description	pid	process	target process
PID 308 set thread context of 4392	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 396	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 1516	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 2228	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 1308	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 3432	308	VeryFun.exe	cmd.exe
PID 308 set thread context of 2592	308	VeryFun.exe	cmd.exe

Drops file in Program Files directory 7 IoCs

Processes:

ie4uinit.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.INI	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	ie4uinit.exe

Drops file in Windows directory 18 IoCs

Processes:

ie4uinit.exechrmstp.exeVeryFun.exeunregmp2.exeExplorer.EXEExplorer.EXEchrmstp.exe

description	ioc	process
File opened for modification	C:\Windows\RGIBDC1.tmp	ie4uinit.exe
File created	C:\Windows\brndlog.txt	ie4uinit.exe
File opened for modification	C:\Windows\B`_[-¡€•ê#'ä,ðæÆhÜ×_ÉèÓ‚,\AppData\Local\Temp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\debug.log	chrmstp.exe
File opened for modification	C:\Windows\System.ini	VeryFun.exe
File opened for modification	C:\Windows\RGIBD9D.tmp	ie4uinit.exe
File opened for modification	C:\Windows\RGIBD9E.tmp	ie4uinit.exe
File opened for modification	C:\Windows\B`_[-¡€•ê#'ä,ðæÆhÜ×_ÉèÓ‚,\AppData\Local\Temp\wmsetup.log	unregmp2.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	Explorer.EXE
File opened for modification	C:\Windows\³ªot7BZTg«ØE™ƒtW1Þ¿~na•3@ø\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\RGIBDB0.tmp	ie4uinit.exe
File opened for modification	C:\Windows\B`_[-¡€•ê#'ä,ðæÆhÜ×_ÉèÓ‚,\AppData\Local\Temp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\debug.log	chrmstp.exe
File opened for modification	C:\Windows\³ªot7BZTg«ØE™ƒtW1Þ¿~na•3@ø\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\B`_[-¡€•ê#'ä,ðæÆhÜ×_ÉèÓ‚,\AppData\Local\Packages\windows_ie_ac_001	ie4uinit.exe
File created	C:\Windows\B`_[-¡€•ê#'ä,ðæÆhÜ×_ÉèÓ‚,\AppData\Local\Temp\TMP4352$.TMP	ie4uinit.exe
File opened for modification	C:\Windows\RGIBD9F.tmp	ie4uinit.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	Explorer.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cmd.exeExplorer.EXEExplorer.EXEspoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	cmd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties	cmd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Explorer.EXE
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	cmd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cmd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 64 IoCs

evasion

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\MouseKeys\Flags = "ÍÂîs…\x06"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WindowArrangementActive = "±Ø^ìÿF”ÍGwïô\u008dë)Ë\a\f:-_<üB‹ˆÁð"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\sCurrency = "Šº-¾r\vŽN*šÏo¸š–$h+ØQÚË2¿\x04'¯°"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SoundSentry\FSTextEffect = "ù\ru\x13À\u00a0•·Óè[\x19ÿÙ\x1fiÐöä˜[\u009dÀæÁ¦¦Í"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\GradientActiveTitle = "ù\x10žÞSLdñŒž@¿Í}Í¬/.¿Ì\vs„\x1c™$\aÝ"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\InactiveBorder = "ágXg³\x13‘’[\x02ƒaæ›—\u008f(¹†ª\vDWÓ0Ê"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\WindowFrame = "@;ÓÑ¡\x13Ñ8¾Kh\x18µ\u009dT‹ªmr\x11Ø{ú«@H?å"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\HilightText = "ÈÇ®J\x17Òú’\"^ÞüU1ue0Ž\x18ÚºLy‘\x16yv«"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WheelScrollLines = "ª1\x15õªäÎ-ü9©ûò§2Õõ‚hmì€Û_ô¢½+"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\iFirstDayOfWeek = "®EVLYêå“\x13S\x18ÕOƒ‚TËÔ\x12Ã—\x13KõfLÝ;"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Keyboard\InitialKeyboardIndicators = "ˆC\ts\u00adö\x03´\reÆvØh€”ÞÑ\x1f¹''\x0fvÑ\vP\x1d"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\DoubleClickWidth = "dwd\x19šyÄÛqõ6çb4¼HmŽ}\x12\a.j„\u00adÔ+\v"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\HighContrast\Previous High Contrast Scheme MUI Value = "i®Á…æ?\u0081·(@—,\bz(g^Ä\x17\x01\x0fcŽ‚²ÎÄº"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\ShowSounds\On = "d…ÉäÆâN®'#'}¾æ•›µ‚F\b„’2Ÿî¥ËC"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\ButtonText = "¤òw´\x17«¤†2mv¹€óe ä(…Âh\x04££ˆPCÛ"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\Keyboard Response	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Colors	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Keyboard\KeyboardDelay = "?\n2ùüÙ¢\x06Ù\\\x10\t¹\b¼äLó¦œ÷Z\x1b+…˜ÃÜ"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WallpaperStyle = "\x14@ŸÆZæ(ög¬Å·†´ƒ…ØT\x02\u00adr\b\r-sŽ\x1cx"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Colors\ButtonText = "N¼n\x1cNo~\fJ\x1fÀÏ\x11G™zO(ÿü”'—Ç=•b\""	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WindowMetrics\SmCaptionHeight = "¨ìÛƒãùùÇ\|Pk\x18\x1e\x16Ê\x17áõ¿AÒ.q–V®C\x03"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Appearance\NewCurrent = "š$\x1bl)55ÏMH#ÈÎ`\"£;~S–\x04p:u%++…"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\MouseHoverWidth = "'¡<¬í\fçóøoÐCg\x16\x02D\x10Ì*k—{ÑYw‰i¿"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\sNativeDigits = "³É,ì\x1b\\!¼•fQ\u008f=\f®¾\"ÀqhÒÿþ\x17Ø”Ñâ"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\iFirstWeekOfYear = "•F©[\"øòb"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\User Profile	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\MouseThreshold2 = "5L\x18•ÎbƒV4—\aS\x19,ê¢`ËÅ½ß\x0ef_ìðÖt"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\MouseKeys\MaximumSpeed = "FÆC`c¾4#ÐiÈdÂ<6–\x10õÓ &tô¬y€˜!"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\InfoText = "æÃ›ªpñ§\x04\x01ˆ‹üj°-y÷³0l¨!ó…OeÉ¹"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Cursors\AppStarting = "‰@ú\u008d\x10º\b›-lìÒ\x02³ ¨ÎŠw”¤k…–s»Zu"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\MenuHilight = "ÄøT¼ŒÅé8÷n´\x12P˜ºlV\x1e+¿˜ÌZb\u008d>Ï\""	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Cursors\SizeAll = "[˜»Ýô_ô><Ï_ÍíðŒ\tž(W‚\x15Z}ÎØ&;:"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Colors\InactiveTitleText = "ü·öŽ\u00ad¨\bßÊÊ˜ƒÆ•\v`\x02¼aåzaÒÂ\x7fÁý\x13"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Colors\Scrollbar = "\x1fÉ@\|3mûe©©\x01Å°\x05¿›È\x0fºÜ\x7f>üÜ\x119\x13Ú"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\sLongDate = "Ì±Ö¬Ÿ\x12F\x15ßÿ\bà_Ù³\r›¢-`\fÞÃ0d¼nN"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SoundSentry	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\StickyKeys\Flags = "«\x178EÆóN\x01ô\x05þºÐÌ;\ròÆ~ä7pœž€ê+\x03"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\GradientInactiveTitle = "^/ÆL\fÝ\x05§¸kªâbSÖg_ŒÊ†\u0081±E\x18¸Þqf"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\DoubleClickHeight = "\u0090VöxÉÂÄÙï÷"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\MouseThreshold1 = "O!\nÔÒH…Óžù\u008f/ÝTÔaà3o±ÉÖÖt™•g\a"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Cursors\No = "V\x01âKÕ¹WJJ\x1aL‚3‘{í»@Áë"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WindowMetrics\CaptionWidth = "\x1c\x05\aÀš#7\x14¯0S\x01š…\x01æ…\x15;5K'¬n\x06BÁf"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\iDigits = "¨y"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\WindowText = "éÂÓûCû5qVÕð0)¼\x7fMây\x12\u0090Ø†'f½&Á\x1e"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\LeftOverlapChars = "º\x11IX\x13¢úÿ3\x01³\f‰+½ÿ>¶\x19Œ\x16Ÿ5g®qô¹"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\sThousand = "\názÏ¿û^`\"³\x11p}Ôèg\u008f”>\x14œ’´èS\x03@6"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\CurrentPowerPolicy = "„Ö\x0ete0DÓ\x7ffp¬0\x0fª˜¤·ßºXRñsMî<Á"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\ShowSounds	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SoundSentry\Flags = "\x18èZ\vëÖ\x10 ØÅsµ7/ï\nÉ!ÔTÀC3tñ9ãc"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\HotTrackingColor = "f\u008dÖpÖ~mhCæ—•+\|°P\u008dJ£ƒîœpÝµá«"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\Background = "\u008d6Úèt\u008fD¨¬ÂùbÂ:mùD\x06\x1e'\að©"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\GrayText = "\b\\ß4U^Q¸\x14c³\rÑF†\x18éR‡ë“\x0eÄo\t_sŸ"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\iNegCurr = "\x19‰.§ÓÂ:=^\x03\fôñ\x17ÚVêŒ©fÔo?4Ý;£•"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\StickyKeys	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\ButtonHilight = "h’\bÃÝ©{œð6¢§3fÞù\x01ä\x16šœÒ:;\x0e‘’û"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\InactiveTitleText = "Êy4€Ç¤\x11$\"@Ê\|â„\x0f\rèÀwÓ\u008dïîæ\x03È\x7f\x12"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors\Scrollbar = "’m˜MÎ²žó_¶éÐt½¶¬%aÝL¨±ˆt\x14×8®"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\CoolSwitchColumns = "\x14UÆ\x05G¹)E…{ÑÞuý\x19Pd?žüêðªƒX'\x18ò"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\HighContrast\High Contrast Scheme = "\x0f§E¨®ULøÐzÚªïÃ\x11Ø\u0090¦ˆë\x1bùÊ×\x14\a\u0090R"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\Keyboard Response\BounceTime = "7–RüÝ…¡ú\u00ad\x7f«ÿph²˜sgýÙ•\|·ðq\x7fÊ‚"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SlateLaunch	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\sShortTime = "H³!0Tó'¾Ø\x12‘®Ëö\u008f¢\a\x01e\\\u009d[®²\x14\f\x10\x7f"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse\ExtendedSounds = "–{ÆÕ\x06Š‡\x06YœÆ”\b ¿i\\37<\x0fÉ÷`:éû\x1e"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WindowMetrics	cmd.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

ie4uinit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmd.exeie4uinit.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "!°–~b\|»¸ªÀÊ\x03*>Å±\x11ÆUu\u009dóX\x12ê\x1c`Á"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "¦°£ÀU\x15NSZå³\x1aÈTD\ve•ÛÁ4kJÓ©þGœ"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\TEXTSIZE\PlugUITextHideIE = "¾hòÝ\x04é¼Þ)5\x02Z\x15Î¹nï\x16O\bÙ\x0f±¾\u008f9F="	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9}\MasterCLSID = "¢Š˜C\x108ãBEû^\x7f¡Gá\bX\x16ïJ‘\x06Î¢\x16Œ\x12È"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{00021a13-0000-0000-c000-000000000046}\Version = "áÅŽ\x11·µ1°Ç\u0081g«V‹¡[G\u00ad1¬ŽCÒ\"a¨´I"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_ERROR_CACHE\RegPath = "©¯©¤\u00adè\|ý?‹îÀ“.½ÃÝv\x1fb¢¸ïð>Fî2"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AutoComplete\Client	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{29CF293A-1E7D-4069-9E11-E39698D0AF95}\Version = "=ê¢ø®—\t¹gg˜æiíÑ\n\x1fSwÞ”Õ¯\n¸8dÌ"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2D90D33C-DE76-42D0-9040-E4466DDC24AC}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{48FFE35F-36D9-44bd-A6CC-1D34414EAC0D}\BlockType = "N(ÚÏ!\x0e\x0fsz,–\x10Ó\|M´˜ÙeE6á{Œ\x01ì¬â"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC}\FWLink = "ôyA?5’pùFò\x12œ\x16ž%\x10óÇ?\x14Ø}ÌrÍ¨«€"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\ALTERNATIVECODEC\PlugUIText = "q¡t--ëzøÅ\u0090Þûnž,YvA‘,ìãºe¬%…ø"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{053017A8-53F7-4EA3-AA38-A4CCAAF1F9E7}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Capabilities\Roaming\WinInet	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}\CompatibilityFlags = "qCŸô\x19¶ÑÁ\x17$Žõ#£´g2º»äÄ_»>€T¾l"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}\Version = "ÿ6Órj\x13ŸŸ‚×µE…oì¦"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "q›q_Ê\f\x10b\x0e"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\RegPath = "¬\x1bØ~!(\x11è\x1bWLé°\x1f\\l)QeìO,2<ò?žÈ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\UTF8URLQUERY_ALWAYS\RegPath = "oàÛæñ\"4K9Hx\u0090\x03¦>Pû\\tn¤¢+u#8[\x18"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\MOVSYSCARET\PlugUIText = "l\"sS*a˜\x17‡±éU‹M²×\x1e×¿·Ÿ\x1eÏÞÌAêó"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{724D43A0-0D85-11D4-9908-00400523E39A}\CompatibilityFlags = "ÖÑa‘åTûw^\x1a\x01røéÚBù2]\u009dÕÇd1¡àb."	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}\CompatibilityFlags = "Õóé\u00a0Nwó°U6\x0eUo®í~‡\x1c\x18’\x01;k»!þžö"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\TEXTSIZE\Type = "z\v\x10Â]™\u008d¥þä\u00ad5Ì¨á~[ÃÞÌ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\Version = "ˆ‚GkÛ`\x03ÇxU\x7f~\|ÄÅhà‡L«²›ý°’ie6"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\CompatibilityFlags = "ºÂžÍF¯Pb3ÜÊf—ç¨I5›TÅ{ý\u008dŸwPXT"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{E3286BF1-E654-42FF-B4A6-5E111731DF6B}\DllName = "ræìq³;âüfÁ‹\v\\ºsúÎ`ZÎ5!\bŠù›\t\b"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutURLs\SecurityRisk = "ë@ÙÆ_ˆ\\–\x0fÛÈ\rf/ÃƒW\u008d×\x1a\x1d`\\Ú`\x15\x0f\x13"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\MOVSYSCARET	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{000D51DD-18E2-4D85-919A-10E3746C3F1C}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}\Version = "\fSÌ\x05Ã&Éa¬ÎK³â…öKÁ'Y\x1fb³Rg0¬Yo"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{877467C0-F9E4-4561-84F0-65AA7539833C}\AppName = "\u00a0¦ÜT,ÑD9%Fýb?³M¡"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\BLOCKMIXEDIMAGES\RegPoliciesPath = "í1)Ø/‚\u008fB×“†¥s\x19sz<ô\x1d¿\x1f^\x0eúËŠ\u009d‡"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\SOUNDS\ValueName = "Üú\x01\x12'8Ø‡\x1d·£g\x13®¬Ie\x1d÷‹ú0”Võh6¾"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CERTREV\HelpID = "ƒr<ÖþRPaµk\x01](3±xÅ¡'\x06«Ð•ÿ±\x05Q2"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{22BF413B-C6D2-4D91-82A9-A0F997BA588C}\FWLink	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{BF09613A-4564-4936-B6BB-B23B1D3D4FD7}\Version = "›[%-‚\x1c\x11S–†ÌN\"•¥xÒ{E‰TÉ?\t/\"’."	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\AppName = "Œ³Ú@\x066\u00adr\u008d„òiËþ– ,\ní\x7f¬sI>]\u00a0B-"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\ACTIVITIES\RegPoliciesPath = "ð\|†h®=¼\x1dÑ²ÒÂµ\x06\x04ßµÌLp£\x13ž¶NG!¥"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\NSCSINGLEEXPAND\HelpID = "Y\x0fW“øÕ§9i:\u00a0¨¤œ˜\x12©zšè:Ù\|y‡j,—"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{E5E2F8B2-79A4-495C-8581-90BA2C845CC2}\Version = "«!ŒëÈú\n´Î‡ÄÌP\u0081’\u009d}ëÂ\x1dük¸nƒfw\x1e"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{95a4104c-1c49-4c2a-9830-1be0f47e926c}\AppPath = "\x1eÑõ†§l‚8XB±ÿ‡:¹cm\u009dä¨+,Ìsá¿d~"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Extensions Off Page = "Ð€IWC0KÞâ4÷[ÛO¥¢¯P\tãÕ\x18B×&L;ô"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\International\Scripts\31	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{179E4A98-A3C4-407D-8C66-E63B67BB6F4A}\DllName = "¼ª^ƒZŠ3\x02Q\x065\x18ÙX\x14¼”¸ÈY)‘¾üF¶Tm"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{D09CFF09-A42A-4EDC-9804-E61224F59CA1}\FWLink = "ïÙ¿\x1cL.\nâ•a\x02\x04\x0féŠÕy\x16Ñt¶ÄãThS\n\a"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\CompatibilityFlags = "·ÃJ*n¬\x12Ñƒ\x1dy#9âó_\x03]À²ZènÐ\x02\x14V~"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{D09CFF09-A42A-4EDC-9804-E61224F59CA1}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PHISHINGFILTER\Text = "bB·_Œ°*£û?Uì·Ï\u009dâ\x13¡ÆH£§IA\x03æ¨\x0f"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\XMLHTTP\Text = "RöÚ¶\x1eˆ\x0fëÕÝY¼6›y¨"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\DNT\Text = "~&¨Í7h\x14[\r\x1f\u0081?5\x1e\x18õ\x12u\x1b…Ò\x1a\u0081ë÷‘ðÔ"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{C94158E1-6151-4442-ABE6-FD53D6534CCB}\FWLink = "ƒ©jÛ¡’q.\x04V,Ü´Æý\x19êVÿã\n\x17;Ãjv²\u0081"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}\MasterCLSID = "Ügçê¬Y7“p÷æEÈ¿\x12˜“EF*\x06\"õ\x03d"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{57F02779-3D88-4958-8AD3-83C12D86ADC7}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{724D43A0-0D85-11D4-9908-00400523E39A}\DllName = "\x05ç\x1d†$éZd\u008f\x01\u009d<‚\x18o\vOsþ9\x05=6¾WË\x05®"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\International\Scripts\29\IEPropFontName	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\UTF8URLQUERY_INTRANET\RegPoliciesPath = "\x7fdÐ\x19Í±¤ôãL×ú\x1d¢Ú7’÷¦\x1fV‰\x17‚Õ<¼…"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\USE_THEMES\RegPath = "$IÜlZiI;ÊL1þ\vq\x0eÛwJá\t\x1emnƒœt\x1d'"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\DNT\PlugUIText = "ób\v¹)<vv\\¶“ñù]aÛ»€å$FÛ…î§\u00adË\x1c"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\SITECERT	cmd.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "”31Š~y\x1eçß5;Õé‹ÈpVˆæ0VQ+¨Ö¸\x01à"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "Hñ~BÛÄ”Ïu>ÔºZ<˜Sì\x1f‡HX™È\|ºDö]"	cmd.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

spoolsv.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587207259168070"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe

Modifies registry class 16 IoCs

Processes:

Explorer.EXEExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000094e2b428dd98da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200033000a004100620020005600610067007200650061007200670020006e00700070007200660066000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff74ae2078e323294282c1e41cb67d5b9c0000000000000000000000006575a3be8f86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000006772bf1b8a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000002f90013bdd98da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200033000a004100620020005600610067007200650061007200670020006e00700070007200660066000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff74ae2078e323294282c1e41cb67d5b9c0000000000000000000000006575a3be8f86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000006772bf1b8a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065551368052"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065551368052"	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exeVeryFun.exe

pid	process
2916	chrome.exe
2916	chrome.exe
2708	chrome.exe
2708	chrome.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe
308	VeryFun.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.exe

pid process

1516 cmd.exe
2228 cmd.exe
1308 cmd.exe
3432 cmd.exe
2592 cmd.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

2916 chrome.exe
2916 chrome.exe
2916 chrome.exe
2916 chrome.exe
2916 chrome.exe
2916 chrome.exe

pid	process
1516	cmd.exe
2228	cmd.exe
1308	cmd.exe
3432	cmd.exe
2592	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.execmd.exe

pid	process
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.execmd.exe

pid	process
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe
396	cmd.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

VeryFun.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

pid process

308 VeryFun.exe
4392 cmd.exe
396 cmd.exe
1516 cmd.exe
2228 cmd.exe
1308 cmd.exe
3432 cmd.exe
2592 cmd.exe

pid	process
308	VeryFun.exe
4392	cmd.exe
396	cmd.exe
1516	cmd.exe
2228	cmd.exe
1308	cmd.exe
3432	cmd.exe
2592	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2916 wrote to memory of 4720	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 4720	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 820	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 2832	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 2832	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe
PID 2916 wrote to memory of 3652	2916	chrome.exe	chrome.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "2å\x1flÖé\x01€×á\x0e\x12CÑ‡Š#-\x14\u00a0e&%À\x1dh\u009d^"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Z\n87<úfï–lp1¥BxP\u0090\x1bÔ«\x1f¨ÁÏ@\x18U\x1c"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\ = "ÍË\u00ad³²²qï¸\u008dÕó±\vÔ8\x1c“\x03\x0f½%\x02¯³é®("	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2040

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Trojan
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff941909758,0x7ff941909768,0x7ff941909778
3⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:2
3⤵
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3824 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4728 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1588 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:1116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1504 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5728 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:1612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5764 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:1868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5576 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3776 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:4652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4520 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:1
3⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:3780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2944 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1452 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708

C:\Users\Admin\Downloads\VeryFun.exe
"C:\Users\Admin\Downloads\VeryFun.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious use of SetWindowsHookEx
PID:4392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies WinLogon for persistence
- Manipulates Digital Signatures
- Modifies Installed Components in the registry
- Checks computer location settings
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1788,i,15966119334963349254,2795884517376594923,131072 /prefetch:8
3⤵
PID:4700

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2bc
1⤵
PID:1472

C:\Windows\Explorer.EXE
"C:\Windows\Explorer.EXE" /LOADSAVEDWINDOWS
1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
PID:2728

C:\Windows\System32\ie4uinit.exe
"C:\Windows\System32\ie4uinit.exe" -UserConfig
2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
PID:1396

C:\Windows\System32\ie4uinit.exe
C:\Windows\System32\ie4uinit.exe -ClearIconCache
3⤵
PID:1304

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
4⤵
PID:68

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
4⤵
PID:356

C:\Windows\System32\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /FirstLogon
2⤵
- Drops file in Windows directory
PID:2332

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
2⤵
- Drops file in Windows directory
PID:2856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff74f8d7688,0x7ff74f8d7698,0x7ff74f8d76a8
3⤵
PID:208

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=2 --install-level=0
3⤵
- Drops file in Windows directory
PID:3212

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff74f8d7688,0x7ff74f8d7698,0x7ff74f8d76a8
4⤵
PID:1612

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1584

C:\Windows\Explorer.EXE
"C:\Windows\Explorer.EXE" /LOADSAVEDWINDOWS
1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\7471075a-5c63-4015-9dd9-06f8c2d871e1.tmp
Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
f012da25e4efa785944d6b15a99b00de

SHA1
7cff26f8dc98a9d646a944989e2ad0752b2647a5

SHA256
45320a715cd1e4a12c9078cdaebf2486ae057c3c5c44e7e8016408720959f799

SHA512
d02bf6fea556948f78f31b2fc50612296072fb2262be5e777af12c59763d5dbf3ba557e362d95f9abf65e86da99b774e8f64d4fc24972e322b6340602501e035

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
2ba3e180120387f4849e8a5acf421ba3

SHA1
48ddbcbaa7107a28b8d1b8899947cf1872161de6

SHA256
3c5625ec2516c323a6f81ab0c48e707ced90774fb0256bb5b909e639914f0618

SHA512
a64bd323f26e496124ef4eab16e2c7428322822398099331b2e0848f8453b93c19caad8bf6371ca8868fa1b5e5641c3fb40ad40298d2eb00a440d2bf7be58b61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\402758e8-1f67-48bc-a689-0290b0748cee.tmp
Filesize
1KB

MD5
f322799722e29d398256357ac0e7e971

SHA1
c4ed88095a283bc353eea2a2ae24bddc0f259db1

SHA256
23545155945d56e58653d30de523693f9657d59408112893659519a83e005d15

SHA512
823956aa2f64164fe2db4cc4ab1d296edebd6347ec28d909522c11937f0820211914adc328a99577363d32b7e55a7614cad3a7ee636c5e3cce1e95172e6e0038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\85246e5b-89cf-402f-a192-1ed5592cb0c9.tmp
Filesize
1KB

MD5
683f4cfe92c22f5dafd161fe5eb7059c

SHA1
3db21c4e5d3d2714e922c38c6fe13b0295793845

SHA256
c6573d9d1ccc72d416b9075fbf8ba578b2c48cf5bdf39799d4f92d6f559428b2

SHA512
0289b1a3308cbcbb02670dca8e6d2165268c0e06fbb484e1a182f31efc14cc0e538cb4b1d4846bc4d0f6de3f149ead377e37625526bc8d5d5265372f7e04f7b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
8c573f558c7f2ae27d708143eafcc491

SHA1
3b4f86525b26aa3868fa8774b537df7011c36800

SHA256
b4c2072ce7cc8379437c81742e31f26725f1f7ab3eca8ceb0ba94e24b7c71a88

SHA512
016ff28c4d45ed45fdc50c48e84782719ff7f6dd80cda5346e71c66d01dc7d998d5f0af0c1d79d30486308083604b29a975c2386be683ab6dc7d28645f15926e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
d4426885b4a5f3283a118ca4b56ce88c

SHA1
bbfe3914e2e55e68f11479f1f2ee8611738da104

SHA256
f541d07df063689aeb84035ef5e9b549441a5649312f46b28768a08e3567dc63

SHA512
53a5d1fbdeecad974e158487689639682d699db6064dd03e3b3b1cfb808ad9a581ff897bf11bb8e5a97b2eb68a9b82b3668194ec8d5b409606d15c30a41ba993

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
c591e7528cef5816a4f55c6378a50edf

SHA1
e351d76329ea29b5a2ae9b29b5d7542603459b7a

SHA256
56d99a26ab78bb777a9770f220eab437001d523b9f9bd320428620cd0a33aeef

SHA512
bca1cb4782401f98027905ba8f2e7dd217ba802b24dfa3ccb468381e0ce147bc441e6725e59dd87ac64f67408ade4de5fe95711173dce3190dae7db14e7cdab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
e613fcb07704c73fc2d487ffe00015a2

SHA1
38c4b00cba439d3576cc7e8f9400f2c7ab696cdd

SHA256
ad04cb2789f8a030619327c77e8ab721e010fe051eca4a7120650b69a6d4a736

SHA512
cfd912e92c75c1ca73df0bf7228e4ea161bfae860daa036a42234eb05fa81b7e8b6458a308e1532144fcb046f8ccd0c2df2f35033053a9d86f705fff1ea16836

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c1daf59ef1a7617d127a95db37cd80ea

SHA1
6f46d89b309902e7f3f4f1132da0645c187a6503

SHA256
e68793e0a9c338db742c1acb848329857d860f9ef9228e0fb09041b5fa593bd5

SHA512
7306fce68dc6ec986005eaf3e248e088a1fc8dcb485468d85271b76877572491fdbe5200e830d6b6a78a5517e6d768d49ba25daf69a607fd458e56f045922ede

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b1efa134492ce359cd0cae76016cfafa

SHA1
72dc2740a5eeb2860ed5379915316be6f00310ab

SHA256
e640067460691c7b96c8d9271dbc24dbb54b2141dcac9740d70f467c2cfe3c30

SHA512
17e710679246d594233f8833ce1f59e7a4f7b32b0c379d45bb3065eb3865cb4d85ad256f2323b80ced39e4da79c71bfa111b154ad615ecfe2b03866569d52bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
70382121603e1a67ca1fbcaa7b6603fe

SHA1
d14c5b938820b2428f9ac822db8201584bd3afea

SHA256
deda000de22673c86e3e26d45d62a5718f336d1b7814c37ef20b13d32d4a4a8a

SHA512
4e1410d46b2a9c86034208003af853821573ec358a5661e3e26d08a539d5048a9e7bfe9827811c8fefe62a58836e832e5e277e7414d88646cb2d81e70b0234c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
fae400a97f1565ccfe3c2b90a7679954

SHA1
f526a9a3a8c2c7cdf1dc1772dea415bc4a6565ee

SHA256
f4b61bd4b35cc8ce89bf60b2f1073e969b48b84490a0e0cc5fb1ac45763e31c9

SHA512
341db9d4ff864cbaf0d1db671b2255185c4f4ee69d0c66159c3a67160f0f92abedd226fc90066dad43fe166877cc7a7ae3e389f4d45e20e26e6043601cdb9025

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
47168dc288100d334e9d24ec21b443ee

SHA1
fd89034a676236f3ef86d95f42f7157919216c1c

SHA256
86e3c3d533e2e34aa925b8ca583730be617b79e5434759a2a0add447a5cdab19

SHA512
3bf8931f9545691eddaaf57fdce047baf09809b7edff735c9bd274f630d1abfe3f1d355831bd31199f2bb0b4cffbbeb3908d69b713ce1b7569a556ece56e4838

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
4ce0029d110bfd4d1def0f01508e45ba

SHA1
c64eb3ea008ec5d5748f2fc69378ea2bf3176e75

SHA256
58c1c0ab350ea78ff3abfb54339046d32a2eb7f79cef5f16fa8cfdaa59ab19cf

SHA512
f15b7417b3317c731c76c1565ae61d897b7faabe6b1ad50d08358cd599fea07c67db2bb82c62f7bd21f17fbb6309ca9a0cc4a40c54bfd53b84423f9b7a23acb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
e229edf2218b612063de9598b1bb1980

SHA1
4315e392cf7836f0a27f53e2a3a15027046db080

SHA256
e1d73047a5122ca0a7949832932195d0d60a388b14f6facbd92501ca0a755571

SHA512
bc289f0f81c0f7cdcd4925275f0fa4b9834be9e1e8b7bd6ffe462706bed2cdc0c13692bbebf6168f82a36c9575da0c1abbd6f1d11ba990515e875c890bc83eb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
feaffaf23df72a2d9b7ef37d64cc4c57

SHA1
d1ea1fc40280caf05483ef60cc2951a1df16f372

SHA256
903e4cf2740a1c66b4ea558286dbf1fd593718725b9702360d1cd46763f9e4d9

SHA512
bdf4a000da1662e0061c26a44e0532a4ce9818d2c5a7e34989a1b843dce97ca407dda672b4a47fd924d39d6f443745078a0f9f062db5c28406a19c839f47bf4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1790f737f309a86ef2e44d6bac5c14f2

SHA1
e004e0dc08374ace420179979551f7e9b3f99fca

SHA256
72ce71c75082a03757cd671b660cfce9a2cff4ffa11d080020e175adfd6b8fdf

SHA512
f6a7eed12afa3da2e29383905be31d1632f0348106505c89e25b23d3f80d6ad08d47fea6cfd9be0e927a94a7cf498ceabed6774eaffc92af971db68b9bc8f1b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9f9aaa6848774cc0193d388f1a9d0764

SHA1
696cebb764b6acb70462fe3d8466af439feb4650

SHA256
f569961759fac1d092131e1fd558733191cf3d69971ae5ad82cc6af0cbec0de8

SHA512
2a2eb086b8949794c32582f59f6a826f6a8551dad60cefb0396849afabe603aec856b03dc7e2c182fbb269cf2300cc9715452c147a673b0f84f79469c82995c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
9981835c8ed0ebd8ffafb83e6703f25a

SHA1
dddae951b2e293388032fbbec4394c9ee034dc2a

SHA256
84fd7e38f1eab0054d9921e98719da4ca43e6b714c57530b0a8abac10df4f85f

SHA512
1ccb6395e92a52b774417ee357917de6c7496c1ee016c0552cf1dc62ef5c83c0f7e23558fce2397bde7533b50231cac7acfb00af2a56fc358eba87aec678beaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
105KB

MD5
ae2e860a9951e1690a194af9ec8243f0

SHA1
0c1d0c4281671196e6e65afcccf6639184f8beb4

SHA256
517456fc61f5a0502a523bae00fab37ef7a85b993a806ed0ba5c512305e0cd47

SHA512
2845b1dad11d8f8b569e54ec44e61f92e26d3d828e9dff42674ad2a81c9d909932fd16167bcd28003a88338ce6651ae585acf556388c8ab6faa1bdcda89a0017

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
114KB

MD5
5a185737e5169b98c61a3fe23a0f8781

SHA1
b050caceed1b51715b558037475d91c01b1af2f0

SHA256
5b606ac175cf8d17b32e847b470023b7e61ef7e50c5ab5c84b5c4f6fd26e7630

SHA512
4d2fbe49db24ef410d6418fbd95494eb80b567ddb79b2a72a6c1977b1e7af24744fd36a852f2059524faf9c8ac16f12f9ff3ef6edbdcfa08bef0fabe841f050f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
107KB

MD5
d8cd3618b043a51d279e848cb3a2e684

SHA1
aa7aa21c0cf5bb4d51186d7d0b6da2a158e59382

SHA256
b1c6dedce50bf88a11be7d2b257bd9f77afca5e95a5db15b74b1d371d8296f2b

SHA512
678c297f4a80d09bb25964dd3e84adabacf91a8773ce4898a0685759762edc2fd6c1c921ecb6a640badc62ea51a93e5e43f9075ed3c65de131ab21df5c55b999

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582342.TMP
Filesize
98KB

MD5
31c73be158838d4cf149617ef8f5f13c

SHA1
4e03e89cd3aad60d34f67bc421042e5ffb28b4aa

SHA256
47d9c7bfc375fae693cd3ee12a514b22d37159ac9cf01adec61d5942e4267274

SHA512
bdb6355bd0980f9810e9e2647f3f1382d1368797813f5ded7263411f54147a145eb5e742126a33188f1f79ba3afdc9b034417def2dd3352c4f1513290634b896

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ebb5d242-38f5-4878-9a0c-56769e57336b.tmp
Filesize
136KB

MD5
b596810745e349a3208b158cdf6ac5fb

SHA1
ed62e9475c59748a10f4f16f8ca0bb161438de67

SHA256
9baa993f77ab98c7086d65d3e951576063c9c1ff0045046f9f7034beffff355d

SHA512
aa221f54c3271045e2f989e315b2ef9f342bb69f35be009628c45d74e3c06bd27bd0a03906036b01ab94906f21bc6d2f6dce665873a0254ba5d024dab77cf18a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\VeryFun.exe
Filesize
3.0MB

MD5
ef7b3c31bc127e64627edd8b89b2ae54

SHA1
310d606ec2f130013cc9d2f38a9cc13a2a34794a

SHA256
8b04fda4bee1806587657da6c6147d3e949aa7d11be1eefb8cd6ef0dba76d387

SHA512
a11eadf40024faeb2cc111b8feee1b855701b3b3f3c828d2da0ae93880897c70c15a0ee3aeb91874e5829b1100e0abafec020e0bf1e82f2b8235e9cc3d289be5

Download Submit
C:\Windows\RGIBD9D.tmp
Filesize
24KB

MD5
dd4f5026aa316d4aec4a9d789e63e67b

SHA1
fe41b70acbcba7aa0b8a606fe82bcfde9a7bf153

SHA256
8d7e6cee70d6035c066b93143461d5f636e144373f5c46bc10a8935d306e0737

SHA512
3f18e86d8d5119df6df0d914ebf43c1a6dadb3fdeff8002940a02d0a3d763e779068a682ee6bafe650b6c371d4be2e51e01759ec5b950eef99db5499e3a6c568

Download Submit
C:\Windows\RGIBDC1.tmp
Filesize
3KB

MD5
a828b8c496779bdb61fce06ba0d57c39

SHA1
2c0c1f9bc98e29bf7df8117be2acaf9fd6640eda

SHA256
c952f470a428d5d61ed52fb05c0143258687081e1ad13cfe6ff58037b375364d

SHA512
effc846e66548bd914ad530e9074afbd104fea885237e9b0f0f566bd535996041ec49fb97f4c326d12d9c896390b0e76c019b3ace5ffeb29d71d1b48e83cbaea

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat
Filesize
40B

MD5
b9a83fa3b5da8f332d5124d46cd8dc51

SHA1
ba591e42a682668729ba65d12ce5d6fe4600a19a

SHA256
e5a5728c138e29a910eeaddea58aba0b8d3a5bdb325226c9c07089a27268c831

SHA512
03f91d457fa5df6f68fb45315eeba66828870e8a51b62b80b87cc6d5aae0cdbb1a8d8c910c92c2e05a1d17dbc650beb4b4a9b96d095e9e0182fae2307bb90d98

Download Submit
C:\Windows\debug.log
Filesize
1KB

MD5
09d31ddcdc89d569d9626e3af6481ee7

SHA1
d93934fea120410fb8f4016e6e7faf7e46d7c222

SHA256
73d8f21b69a86be23dfb1bba467fef718cb2c86be6a819bc2ed222d010038a72

SHA512
02fa8bed8bd3b56f7968fd9579e738039d9673af4cea233ce890e7a72724b4190dc5dfb30f4e3f99341ef340406a6afa3655b65e25ad59f15edceb2c0095debe

Download Submit
\??\pipe\crashpad_2916_JEBXDDHHIKDNGYRB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/308-673-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-691-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-556-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-558-0x0000000000AC0000-0x0000000000ACB000-memory.dmp

Filesize
44KB

Download
memory/308-557-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/308-701-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-700-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-593-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-699-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-605-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-698-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-697-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-696-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-695-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-694-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-626-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-693-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-692-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-690-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-689-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-688-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-687-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-646-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-647-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-648-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-649-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-650-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-651-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-686-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-661-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-662-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-663-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-664-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-665-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-666-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-669-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-670-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-671-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-672-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-685-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-674-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/308-684-0x0000000000B90000-0x00000000011CD000-memory.dmp

Filesize
6.2MB

Download
memory/396-582-0x0000000002600000-0x00000000026F4000-memory.dmp

Filesize
976KB

Download
memory/396-579-0x0000000002600000-0x00000000026F4000-memory.dmp

Filesize
976KB

Download
memory/396-583-0x0000000002600000-0x00000000026F4000-memory.dmp

Filesize
976KB

Download
memory/1516-588-0x0000000002730000-0x000000000283C000-memory.dmp

Filesize
1.0MB

Download
memory/1516-591-0x0000000002730000-0x000000000283C000-memory.dmp

Filesize
1.0MB

Download
memory/1516-592-0x0000000002730000-0x000000000283C000-memory.dmp

Filesize
1.0MB

Download
memory/2228-619-0x0000000002B00000-0x0000000002C0C000-memory.dmp

Filesize
1.0MB

Download
memory/2228-615-0x0000000002B00000-0x0000000002C0C000-memory.dmp

Filesize
1.0MB

Download
memory/2228-618-0x0000000002B00000-0x0000000002C0C000-memory.dmp

Filesize
1.0MB

Download
memory/2592-641-0x0000000002D00000-0x0000000002E0C000-memory.dmp

Filesize
1.0MB

Download
memory/2592-644-0x0000000002D00000-0x0000000002E0C000-memory.dmp

Filesize
1.0MB

Download
memory/2592-645-0x0000000002D00000-0x0000000002E0C000-memory.dmp

Filesize
1.0MB

Download
memory/3432-640-0x0000000002620000-0x000000000272C000-memory.dmp

Filesize
1.0MB

Download
memory/3432-639-0x0000000002620000-0x000000000272C000-memory.dmp

Filesize
1.0MB

Download
memory/3432-636-0x0000000002620000-0x000000000272C000-memory.dmp

Filesize
1.0MB

Download
memory/4392-620-0x0000000003300000-0x000000000349C000-memory.dmp

Filesize
1.6MB

Download
memory/4392-565-0x0000000003300000-0x000000000349C000-memory.dmp

Filesize
1.6MB

Download
memory/4392-569-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4392-563-0x0000000003300000-0x000000000349C000-memory.dmp

Filesize
1.6MB

Download
memory/4392-559-0x0000000003300000-0x000000000349C000-memory.dmp

Filesize
1.6MB

Download
memory/4392-564-0x0000000003300000-0x000000000349C000-memory.dmp

Filesize
1.6MB

Download
memory/4392-566-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4392-568-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download