36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Resubmissions

18-07-2024 14:09

240718-rgaytssakp 8

18-07-2024 13:33

240718-qtg28szhqj 10

Analysis

max time kernel
1557s
max time network
1345s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.ps1
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

8^/10

execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Windows directory 1 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe explorer.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2736 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1684 taskkill.exe
1732 taskkill.exe

description	ioc	process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	explorer.exe

pid	process
1684	taskkill.exe
1732	taskkill.exe

Modifies Control Panel 19 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\SizeWE = "%SystemRoot%\\cursors\\size3_rm.cur"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\UserPreferencesMask = 9e3e078012000000	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\No = "%SystemRoot%\\cursors\\no_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\SizeAll = "%SystemRoot%\\cursors\\move_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\UpArrow = "%SystemRoot%\\cursors\\up_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\AppStarting = "%SystemRoot%\\cursors\\wait_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\IBeam = "%SystemRoot%\\cursors\\beam_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\NWPen = "%SystemRoot%\\cursors\\pen_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\SizeNS = "%SystemRoot%\\cursors\\size4_rm.cur"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\ = "Windows Black (large)"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Help = "%SystemRoot%\\cursors\\help_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Wait = "%SystemRoot%\\cursors\\busy_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Crosshair = "%SystemRoot%\\cursors\\cross_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\SizeNWSE = "%SystemRoot%\\cursors\\size2_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\SizeNESW = "%SystemRoot%\\cursors\\size1_rm.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Hand	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Scheme Source = "2"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Cursors\Arrow = "%SystemRoot%\\cursors\\arrow_rm.cur"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeexplorer.exeIEXPLORE.EXEhelppane.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1F32FC1-4511-11EF-838F-D692ACB8436A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	helppane.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies registry class 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 09000000040000000800000007000000060000000500000001000000020000000000000003000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\NodeSlot = "17"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\{BDBE736F-34F5-4829-ABE8-B550E65146C4}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 06000000050000000400000001000000020000000000000003000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\7\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "646"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\{BDBE736F-34F5-4829-ABE8-B550E65146C4}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\{BDBE736F-34F5-4829-ABE8-B550E65146C4}\LogicalViewMode = "5"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000090000000400000008000000070000000600000005000000010000000200000003000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\7	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 04000000090000000800000007000000060000000500000001000000020000000000000003000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\16	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 080000000700000006000000050000000400000001000000020000000000000003000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "829"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9\NodeSlot = "18"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\TV_TopViewVersion = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\{BDBE736F-34F5-4829-ABE8-B550E65146C4}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9 = 81281f003128d5dfa32323280400000000001f2800003153505305d5cdd59c2e1b10939708002b2cf9ae5727000012000000004100750074006f004c006900730074000000420000001e000000700072006f00700034003200390034003900360037003200390035000000000010270000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000ca00c800310000000000f2588a731300532d312d352d7e310000b00008000400efbef2585d73f2588a732a0000002495010000000600000000000000000088000000000053002d0031002d0035002d00320031002d0033003400330034003200390034003300380030002d0032003500350034003700320031003300340031002d0031003900310039003500310038003600310032002d003100300030003000000040007300680065006c006c00330032002e0064006c006c002c002d003800390036003400000018000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001d00530065006100720063006800200052006500730075006c0074007300200069006e002000520065006300790063006c0065002000420069006e00000000000000000000000000000000000000000000000000f9fbfe07000002000000ffffffff000000000000000000000000000000000d000000020000000600000000000000804ab40200000000008df9fbfe07000002000800ffffffff000000000000000000000000000000000f00000001000000ffffffffcccccccc50618a0500000000d085f9fbfe07000002000000ffffffff000000000000000000000000000000001000000002000000070000005700690010628a0500000000008df9fbfe07000002006100ffffffff000000000000000000000000000000001200000001000000ffffffff3a003d00d0628a0500000000008df9fbfe07000002004100ffffffff000000000000000000000000000000001300000001000000ffffffff30003000804ab40200000000d085f9fbfe07000002005500ffffffff0000000000000000000000000000000014000000010000000900000072006f00a045b40200000000d085f9fbfe07000002004100ffffffff000000000000000000000000000000001500000002000000ffffffff41006400c052fe0300000000008df9fbfe07000002007400ffffffff000000000000000000000000000000001700000008000000ffffffff5000720010628a0500000000d085f9fbfe070000020073001200000000000000000000000000000000000000ffffffff000000000b00000073005c00d0628a0500000000d085f9fbfe07000002006c001300000000000000000000000000000000000000ffffffff000000000c0000004600690010628a0500000000d085f9fbfe07000002004300ffffffff00000000000000000000000000000000ffffffff000000001000000028007800d0628a0500000000d085f9fbfe07000002006e00ffffffff00000000000000000000000000000000ffffffff000000001100000067007200c052fe0300000000d085f9fbfe07000002003a00ffffffff000000000000000000000000000000001f000000080000000f0000006f006d0090958b0500000000d085f9fbfe07000002000000ffffffff000000000000000000000000000000002700000001000000ffffffff590050008066b60200000000d085f9fbfe07000002006500ffffffff00000000000000000000000000000000ffffffff00000000ffffffff740065006069760500000000008df9fbfe07000002007800ffffffff000000000000000000000000000000002800000003000000ffffffff43004b001064760500000000008df9fbfe07000002005200ffffffff000000000000000000000000000000002b00000003000000ffffffff5c0055005068760500000000008df9fbfe07000002006e00ffffffff000000000000000000000000000000002e00000003000000ffffffff5c0055004067760500000000008df9fbfe07000002006e00ffffffff000000000000000000000000000000003100000003000000ffffffff4f00470070e5750500000000008df9fbfe07000002005c00ffffffff00000000000000000000000000000000ffffffff00000000ffffffff5f004f0030e7750500000000008df9fbfe07000002004f00ffffffff00000000000000000000000000000000ffffffff00000000ffffffff4e00540010e8750500000000008df9fbfe07000002005700ffffffff00000000000000000000000000000000ffffffff00000000ffffffff43003a00f0e8750500000000008df9fbfe07000002004300ffffffff00000000000000000000000000000000ffffffff00000000ffffffff330032006069760500000000d085f9fbfe07000002005700ffffffff00000000000000000000000000000000340000000300000017000000570069001064760500000000d085f9fbfe07000002007200ffffffff00000000000000000000000000000000370000000300000018000000450058005068760500000000d085f9fbfe07000002005800ffffffff000000000000000000000000000000003a00000003000000190000003b002e004067760500000000d085f9fbfe07000002004a00ffffffff000000000000000000000000000000003d000000030000001a0000004300000070e5750500000000d085f9fbfe07000002005f00ffffffff00000000000000000000000000000000ffffffff000000001b0000003600340030e7750500000000d085f9fbfe07000002005200ffffffff00000000000000000000000000000000ffffffff000000001c0000003400200010e8750500000000d085f9fbfe07000002004d00ffffffff00000000000000000000000000000000ffffffff000000001d0000004d006100f0e8750500000000d085f9fbfe07000002007400ffffffff00000000000000000000000000000000ffffffff000000001e0000003600340030dc8b0500000000d085f9fbfe07000002005300ffffffff000000000000000000000000000000004000000002000000ffffffff39002d0010978b0500000000008df9fbfe07000002002d00ffffffff000000000000000000000000000000004200000001000000ffffffff36003500d0978b0500000000008df9fbfe07000002004400ffffffff000000000000000000000000000000004300000004000000ffffffff45003500509c8b0500000000008df9fbfe07000002007200ffffffff000000000000000000000000000000004700000003000000ffffffff67007200109d8b0500000000008df9fbfe07000002002800ffffffff000000000000000000000000000000004a00000001000000ffffffff32003d00d09d8b0500000000008df9fbfe07000002006d00ffffffff000000000000000000000000000000004b00000004000000ffffffff2400470050a28b0500000000008df9fbfe07000002005000ffffffff000000000000000000000000000000004f00000003000000ffffffff7900730010a38b0500000000008df9fbfe07000002006400ffffffff000000000000000000000000000000005200000001000000ffffffff2e003000d0a38b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000005300000004000000ffffffff5000750050a88b0500000000008df9fbfe07000002004900ffffffff000000000000000000000000000000005700000003000000ffffffff7900730010a98b0500000000008df9fbfe07000002004300ffffffff000000000000000000000000000000005a00000001000000ffffffff57006900d0a98b0500000000008df9fbfe07000002005000ffffffff000000000000000000000000000000005b00000004000000ffffffff4100700050ae8b0500000000008df9fbfe07000002006100ffffffff000000000000000000000000000000005f00000003000000ffffffff6500720010978b0500000000d085f9fbfe070000020070004200000000000000000000000000000000000000ffffffff000000002800000000005500d0978b0500000000d085f9fbfe07000002003d00430000000000000000000000000000000000000062000000000000002900000045003d00509c8b0500000000d085f9fbfe07000002005200470000000000000000000000000000000000000065000000000000002a0000005c004100109d8b0500000000d085f9fbfe070000020069004a00000000000000000000000000000000000000ffffffff000000002b00000064006f00d09d8b0500000000d085f9fbfe070000020067004b0000000000000000000000000000000000000067000000000000002c0000005f00740050a28b0500000000d085f9fbfe070000020067004f000000000000000000000000000000000000006a000000000000002d0000006500730010a38b0500000000d085f9fbfe07000002006c005200000000000000000000000000000000000000ffffffff000000002e0000006c006500d0a38b0500000000d085f9fbfe0700000200000053000000000000000000000000000000000000006c000000000000002f0000000000000050a88b0500000000d085f9fbfe0700000200780557000000000000000000000000000000000000006f00000000000000300000000000000010a98b0500000000d085f9fbfe070000020000005a00000000000000000000000000000000000000ffffffff000000003100000000000000d0a98b0500000000d085f9fbfe070000020000005b00000000000000000000000000000000000000710000000000000032000000fe07000050ae8b0500000000d085f9fbfe070000020077055f0000000000000000000000000000000000000074000000000000003300000000000000d0ee920500000000d085f9fbfe07000002000000ffffffff000000000000000000000000000000007600000014000000ffffffff080000003050b40200000000d085f9fbfe0700000200ffffffffffff000000000000000000000000000000008a00000001000000ffffffff0000000010978b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff000000003400000000000000d0978b0500000000d085f9fbfe0700000200ffffffffffff000000000000000000000000000000008b0000000300000035000000e401000090988b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000008e00000001000000ffffffff5011000050998b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000008f00000001000000ffffffff00000000109a8b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000009000000003000000ffffffff00000000509c8b0500000000d085f9fbfe07000002000000ffffffff000000000000000000000000000000009300000002000000360000000300140090bd690500000000008df9fbfe07000002002000ffffffff00000000000000000000000000000000ffffffff00000000ffffffff000000000044b40200000000008df9fbfe070000b10600b76acd06001085b907000000002052f20300000000ffffffff00000000ffffffffffffffff109d8b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff000000003700000003000000d09d8b0500000000d085f9fbfe07000002000000ffffffff0000000000000000000000000000000095000000030000003800000000000000909e8b0500000000008df9fbfe0700000200a800ffffffff000000000000000000000000000000009800000001000000ffffffff00000000509f8b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000009900000001000000ffffffff5200008010a08b0500000000008df9fbfe0700000200ffffffffffff000000000000000000000000000000009a00000003000000ffffffff0000000050a28b0500000000d085f9fbfe070000020000f3ffffffff000000000000000000000000000000009d00000002000000390000000b383b2780be690500000000008df9fbfe0700000200ffffffffffff00000000000000000000000000000000ffffffff00000000ffffffff645757577046b40200000000008df9fbfe07000002005757ffffffff00000000000000000000000000000000ffffffff00000000ffffffff4e61766910a38b0500000000d085f9fbfe07000002004c57ffffffff00000000000000000000000000000000ffffffff000000003a00000054617267d0a38b0500000000d085f9fbfe0700000200ffffffffffff000000000000000000000000000000009f000000030000003b0000000000000090a48b0500000000008df9fbfe07000002000000ffffffff00000000000000000000000000000000a200000001000000ffffffff6c57575750a58b0500000000008df9fbfe07000002000000ffffffff00000000000000000000000000000000a300000001000000ffffffff7070446910a68b0500000000008df9fbfe07000002007265ffffffff00000000000000000000000000000000a400000003000000ffffffffffffffff50a88b0500000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000a7000000020000003c000000050064b5a0bc690500000000008df9fbfe07000002000700ffffffff00000000000000000000000000000000ffffffff00000000ffffffff706c5757c04db40200000000008df9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000ffffffff6874575710a98b0500000000d085f9fbfe07000002006f6effffffff00000000000000000000000000000000ffffffff000000003d000000ffffffffd0a98b0500000000d085f9fbfe07000002000419ffffffff00000000000000000000000000000000a9000000030000003e0000004265666f90aa8b0500000000008df9fbfe07000002000000ffffffff00000000000000000000000000000000ac00000001000000ffffffff436f6d7050ab8b0500000000008df9fbfe07000002006174ffffffff00000000000000000000000000000000ad00000001000000ffffffffffffffff10ac8b0500000000008df9fbfe07000002005757ffffffff00000000000000000000000000000000ae00000003000000ffffffff50726f6750ae8b0500000000d085f9fbfe0700000200d8a8ffffffff00000000000000000000000000000000b1000000020000003f000000616e6453f0c6690500000000008df9fbfe0700000200ffffffffffff00000000000000000000000000000000ffffffff00000000ffffffff80000000604fb40200000000008df9fbfe07000002006769ffffffff00000000000000000000000000000000ffffffff00000000ffffffffffffffff90988b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000440000004672616d50998b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff000000004500000080000000109a8b0500000000d085f9fbfe07000002006e64ffffffff00000000000000000000000000000000b3000000020000004600000057696e6490bd690500000000d085f9fbfe0700000200c4f7ffffffff00000000000000000000000000000000ffffffff0000000048000000746976610044b40200000000d085f9fbfe07000002006f70ffffffff00000000000000000000000000000000ffffffff000000004900000000010000909e8b0500000000d085f9fbfe07000002007465ffffffff00000000000000000000000000000000ffffffff000000004c00000055504441509f8b0500000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000ffffffff000000004d0000001030d6a910a08b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000b5000000020000004e0000000e0031a280be690500000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000ffffffff0000000050000000ffffffff7046b40200000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000ffffffff0000000051000000726f706590a48b0500000000d085f9fbfe07000002007456ffffffff00000000000000000000000000000000ffffffff000000005400000048574e4450a58b0500000000d085f9fbfe07000002005757ffffffff00000000000000000000000000000000ffffffff00000000550000005061746810a68b0500000000d085f9fbfe07000002006557ffffffff00000000000000000000000000000000b700000002000000560000000a0053a1a0bc690500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff000000005800000080010000c04db40200000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000590000007062467590aa8b0500000000d085f9fbfe0700000200d87cffffffff00000000000000000000000000000000ffffffff000000005c0000003257575750ab8b0500000000d085f9fbfe07000002004944ffffffff00000000000000000000000000000000ffffffff000000005d000000f005000010ac8b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000b9000000020000005e0000000f301e67f0c6690500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff0000000060000000a4070000604fb40200000000d085f9fbfe07000002005757ffffffff00000000000000000000000000000000ffffffff000000006100000057575757406b020400000000d085f9fbfe07000002004944ffffffff00000000000000000000000000000000bb00000003000000ffffffff5f535045b063b20700000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000be00000003000000ffffffff4d444944b062b20700000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000c100000003000000ffffffff5f504153b061b20700000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000c400000003000000ffffffff4f4c4543b06bb20700000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000c700000003000000ffffffff4f4c4543b06cb20700000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ca00000003000000ffffffff80020000b06db20700000000d085f9fbfe07000002004f4fffffffff00000000000000000000000000000000cd00000003000000ffffffff52414e47b06eb20700000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000d000000003000000ffffffff4f4c4543b06fb20700000000d085f9fbfe0700000200ffffffffffff00000000000000000000000000000000d300000003000000ffffffff4f4c4543b076b20700000000d085f9fbfe07000002005757ffffffff00000000000000000000000000000000d600000003000000ffffffff4d415857b077b20700000000d085f9fbfe07000002004944ffffffff00000000000000000000000000000000d900000003000000ffffffff4d444944b078b20700000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000dc00000003000000ffffffffffffffffb079b20700000000d085f9fbfe0700000200574effffffff00000000000000000000000000000000df00000003000000ffffffff5f53544fb07ab20700000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000e200000003000000ffffffff80020000b069b20700000000d085f9fbfe0700000200494effffffff00000000000000000000000000000000e500000003000000ffffffff80020000b06ab20700000000d085f9fbfe07000002007505ffffffff00000000000000000000000000000000e800000003000000ffffffff50455155b064b20700000000d085f9fbfe07000002000270ffffffff00000000000000000000000000000000eb00000003000000ffffffff980b0000b074b20700000000d085f9fbfe07000002004f41ffffffff00000000000000000000000000000000ee00000003000000ffffffff59424147b067b20700000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000f100000003000000ffffffff4d444944406f020400000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000f400000003000000ffffffffffffffff50968b0500000000d085f9fbfe0700000200494effffffff00000000000000000000000000000000ffffffff00000000ffffffff4553455490988b0500000000d085f9fbfe070000020045438e00000000000000000000000000000000000000ffffffff00000000620000004d44494450998b0500000000d085f9fbfe0700000200f0d38f00000000000000000000000000000000000000ffffffff0000000063000000ffffffff109a8b0500000000d085f9fbfe07000002004f579000000000000000000000000000000000000000f700000000000000640000004154455090988b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff000000008b0000004f4c454350998b0500000000d085f9fbfe07000002005757ffffffff00000000000000000000000000000000ffffffff000000008c000000504c4154109a8b0500000000d085f9fbfe07000002004543ffffffff00000000000000000000000000000000f9000000020000008d0000001a30fb30d09a8b0500000000008df9fbfe07000002004e42ffffffff00000000000000000000000000000000fb00000001000000ffffffff45414354909b8b0500000000008df9fbfe07000002000000ffffffff00000000000000000000000000000000fc00000001000000ffffffff8002000090bd690500000000d085f9fbfe07000002004f43ffffffff00000000000000000000000000000000ffffffff00000000650000004f4c45430044b40200000000d085f9fbfe07000002004e4dffffffff00000000000000000000000000000000ffffffff0000000066000000454c454e909e8b0500000000d085f9fbfe070000020045439800000000000000000000000000000000000000ffffffff00000000670000001f30f79a509f8b0500000000d085f9fbfe07000002004b469900000000000000000000000000000000000000ffffffff00000000680000005f4f505410a08b0500000000d085f9fbfe070000020000009a00000000000000000000000000000000000000fd000000000000006900000045575757909e8b0500000000d085f9fbfe07000002004944ffffffff00000000000000000000000000000000ffffffff00000000950000004f4c4543509f8b0500000000d085f9fbfe07000002004c53ffffffff00000000000000000000000000000000ffffffff00000000960000005241564510a08b0500000000d085f9fbfe07000002005957ffffffff00000000000000000000000000000000ff000000020000009700000080020000d0a08b0500000000008df9fbfe07000002004f50ffffffff000000000000000000000000000000000101000001000000ffffffff5256008090a18b0500000000008df9fbfe07000002000000ffffffff000000000000000000000000000000000201000001000000ffffffff5448575780be690500000000d085f9fbfe07000002004944ffffffff00000000000000000000000000000000ffffffff000000006a000000800200007046b40200000000d085f9fbfe07000002005345ffffffff00000000000000000000000000000000ffffffff000000006b0000004d44494490a48b0500000000d085f9fbfe07000002000000a200000000000000000000000000000000000000ffffffff000000006c0000008002000050a58b0500000000d085f9fbfe07000002005044a300000000000000000000000000000000000000ffffffff000000006d0000005f454e4110a68b0500000000d085f9fbfe07000002000000a40000000000000000000000000000000000000003010000000000006e0000008002000090a48b0500000000d085f9fbfe07000002004554ffffffff00000000000000000000000000000000ffffffff000000009f0000005f484f5350a58b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000a00000008002000010a68b0500000000d085f9fbfe07000002004352ffffffff000000000000000000000000000000000501000002000000a10000005f4f4e42d0a68b0500000000008df9fbfe0700000200ffffffffffff000000000000000000000000000000000701000001000000ffffffff5355505090a78b0500000000008df9fbfe0700000200e8a3ffffffff000000000000000000000000000000000801000001000000ffffffff4d44465fa0bc690500000000d085f9fbfe07000002009a81ffffffff00000000000000000000000000000000ffffffff000000006f0000004d44465fc04db40200000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000700000000002000090aa8b0500000000d085f9fbfe07000002007357ac00000000000000000000000000000000000000ffffffff00000000710000000500b36e50ab8b0500000000d085f9fbfe07000002003c97ad00000000000000000000000000000000000000ffffffff00000000720000004d44455810ac8b0500000000d085f9fbfe07000002000000ae000000000000000000000000000000000000000901000000000000730000008003000090aa8b0500000000d085f9fbfe07000002004f50ffffffff00000000000000000000000000000000ffffffff00000000a90000004d44455850ab8b0500000000d085f9fbfe07000002000000ffffffff00000000000000000000000000000000ffffffff00000000aa0000007865636f10ac8b0500000000d085f9fbfe07000002006149ffffffff000000000000000000000000000000000b01000002000000ab0000000e000430d0ac8b0500000000008df9fbfe0700000200ffffffffffff000000000000000000000000000000000d01000001000000ffffffff53686f7790ad8b0500000000008df9fbfe07000002007a65ffffffff000000000000000000000000000000000e01000001000000fffffffffc020000f0c6690500000000d085f9fbfe07000002004e49ffffffff00000000000000000000000000000000ffffffff00000000740000004f414449604fb40200000000d085f9fbfe07000002004144ffffffff00000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000040000000c0f7f53b1fd9da017300000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001f000000530065006100720063006800200052006500730075006c0074007300200069006e002000520065006300790063006c0065002000420069006e0030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe000000200000000000000000000000000000000000000000000000000100000057280000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\7 = ba00310000000000f25890731200532d413038377e310000a20008000400efbef2589073f25890732a0000000244020000000200000000000000000000000000000053002d0031002d0035002d00320031002d0033003400330034003200390034003300380030002d0032003500350034003700320031003300340031002d0031003900310039003500310038003600310032002d00310030003000300020002d00200043006f007000790020002800320037002900000018000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 040000000800000007000000060000000500000001000000020000000000000003000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetaskmgr.exe

pid	process
2736	powershell.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

helppane.exeexplorer.exetaskmgr.exe

pid process

3056 helppane.exe
2564 explorer.exe
2156 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

powershell.exehelppane.exetaskkill.exeexplorer.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeTakeOwnershipPrivilege	3056	helppane.exe
Token: SeTakeOwnershipPrivilege	3056	helppane.exe
Token: SeTakeOwnershipPrivilege	3056	helppane.exe
Token: SeTakeOwnershipPrivilege	3056	helppane.exe
Token: SeDebugPrivilege	1732	taskkill.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeDebugPrivilege	2156	taskmgr.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe
Token: SeShutdownPrivilege	2564	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

helppane.exeiexplore.exeexplorer.exetaskmgr.exe

pid	process
3056	helppane.exe
2724	iexplore.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2564	explorer.exe
2564	explorer.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2156	taskmgr.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2156	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exe

pid	process
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

helppane.exeiexplore.exeIEXPLORE.EXEexplorer.exe

pid	process
3056	helppane.exe
3056	helppane.exe
2724	iexplore.exe
2724	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

helppane.execontrol.exeiexplore.execmd.exeexplorer.exe

description	pid	process	target process
PID 3056 wrote to memory of 1944	3056	helppane.exe	control.exe
PID 3056 wrote to memory of 1944	3056	helppane.exe	control.exe
PID 3056 wrote to memory of 1944	3056	helppane.exe	control.exe
PID 1944 wrote to memory of 1356	1944	control.exe	rundll32.exe
PID 1944 wrote to memory of 1356	1944	control.exe	rundll32.exe
PID 1944 wrote to memory of 1356	1944	control.exe	rundll32.exe
PID 2724 wrote to memory of 2740	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2740	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2740	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2740	2724	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1732	1192	cmd.exe	taskkill.exe
PID 1192 wrote to memory of 1732	1192	cmd.exe	taskkill.exe
PID 1192 wrote to memory of 1732	1192	cmd.exe	taskkill.exe
PID 1192 wrote to memory of 2564	1192	cmd.exe	explorer.exe
PID 1192 wrote to memory of 2564	1192	cmd.exe	explorer.exe
PID 1192 wrote to memory of 2564	1192	cmd.exe	explorer.exe
PID 2564 wrote to memory of 1812	2564	explorer.exe	NOTEPAD.EXE
PID 2564 wrote to memory of 1812	2564	explorer.exe	NOTEPAD.EXE
PID 2564 wrote to memory of 1812	2564	explorer.exe	NOTEPAD.EXE
PID 1192 wrote to memory of 2292	1192	cmd.exe	explorer.exe
PID 1192 wrote to memory of 2292	1192	cmd.exe	explorer.exe
PID 1192 wrote to memory of 2292	1192	cmd.exe	explorer.exe
PID 1192 wrote to memory of 2616	1192	cmd.exe	NOTEPAD.EXE
PID 1192 wrote to memory of 2616	1192	cmd.exe	NOTEPAD.EXE
PID 1192 wrote to memory of 2616	1192	cmd.exe	NOTEPAD.EXE
PID 1192 wrote to memory of 2156	1192	cmd.exe	taskmgr.exe
PID 1192 wrote to memory of 2156	1192	cmd.exe	taskmgr.exe
PID 1192 wrote to memory of 2156	1192	cmd.exe	taskmgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1688

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:956

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3036

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:2288

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1084

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:624

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:2804

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2816

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1
1⤵
- Modifies Control Panel
PID:2920

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.FolderOptions
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" shell32.dll,Options_RunDLL 0
3⤵
PID:1356

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1468

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://c;/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im explorer.exe & start explorer.exe
1⤵
- Kills process with taskkill
PID:1684

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\system32\taskkill.exe
taskkill /f /im explorer.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\explorer.exe
explorer.exe
2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini
3⤵
PID:1812

C:\Windows\explorer.exe
explorer
2⤵
PID:2292

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini
2⤵
PID:2616

C:\Windows\system32\taskmgr.exe
taskmgr
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2156

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\$IOTA03D
Filesize
544B

MD5
b431ecdc11a656be17f1a88a8ac5e5c8

SHA1
4df02f49eec33ff9e7e309ccd8e77168419603cb

SHA256
b6778433d817cfc2763b77344c6d3fafb0f12f14af59cdf1f8347e7c37b3f7f5

SHA512
874d4d3d8b09719ad9c63998bf270b7e0b28c47849b42628211029bcb6030fe96b90a02653a1011b9520731ee6f18a29f5c556ed234232123c005fa2d659bc2a

Download Submit
C:\Users\Admin\Desktop\DenyStop.TS
Filesize
714KB

MD5
cf211faf66605437f2f0ddfe0ae9937c

SHA1
143ee4223ffc5b88df1bbcaae1749de217e8c977

SHA256
9e8e6b89a89177f8639163a73e0a07b8050058db2fe68ef9e03cc90ff046438d

SHA512
655039b039547ccd9de779da14c0c4c1c8445fbea2f6025c8e40a0d63ed730e1fa92d610c36477550d4ea8dc474d8a6cedc7098f9e27ebd8539b5049dedf0f0a

Download Submit
C:\Users\Admin\Desktop\EnableConvertTo.m3u
Filesize
539KB

MD5
0fe241eb7b3db95d206e8a781ebd3bca

SHA1
c20550342bffef45c9746aa485a9bfbb12e44f25

SHA256
16142674a985712eeeb5900855090e2969f2f6d5939a28feac6ccc603d4a145f

SHA512
0f9b063991793d65e5e0d98c7ae7d948b15ef6925860fe776dbd9d7aa88481a8c1f04a7aa99fadd88efa51ed3b967ca8ea847cc599e81425923a281eaa698a6b

Download Submit
C:\Users\Admin\Desktop\FormatTrace.ttf
Filesize
609KB

MD5
1ac982b3989aca9fc2b00c2417f6dd49

SHA1
23ad5a8f0c117e277d138312e702116f0d8e8235

SHA256
c9933ec6199b6833f0153f271b46e20c5dc75106625cab82ca38111ab5c52346

SHA512
41d062111174ad82020dd7b59e5150537b1ccebefe5cf3f2129c4cdcd616cf16347f0262ef6d0b1f837ebfb028034122d330e3a04a133b00dca44a01f1412743

Download Submit
C:\Users\Admin\Desktop\GetMove.bmp
Filesize
922KB

MD5
1bc473a1d2095fe158cc3c7754c695f8

SHA1
b49ae4db6a9e835b34c4bdbdaaf555c4793c3c2a

SHA256
c7d1be14c2e7fd446133051ac1f55d314698cccbdcf8021618de3f4a88ae7223

SHA512
a232daf5c4a6cb11b7627af08a7de6d24c0fba67e1400d73f07129ac4a8e10443cb970eb1a497c75b945a013ac042741e5fe1b6ded0937302d3db00c4a0f6851

Download Submit
C:\Users\Admin\Desktop\GetSet.easmx
Filesize
748KB

MD5
37f4bdef1b4237a99b6e452663c351b2

SHA1
e6b99a9d192d534c8be1f6f086ea4c7ef4c19245

SHA256
ad7e6e2a53c92b7be8008c745d5f26a8189590a234d6da6e64cad1c7067e8528

SHA512
4406e00f417d8517a5d4357232c97bb564e8da9300915350905b604ce2c40e54ecb7e0c6da903d19743942cd0ebfe6d3cb53b6d6cf1d7e868af42ecd786672bf

Download Submit
C:\Users\Admin\Desktop\ImportCompare.xls
Filesize
853KB

MD5
0641a247347bacb596686fbd1aa1f840

SHA1
faf9d99cf7738ec3729009491fcad8478e6c818d

SHA256
e37086657ea5b885ef2e9eba1d9fdae7de7831217ccebe354d5f8b4fb18c041e

SHA512
dc86228b1b2d619946c57f6a8c560faa8e465371dbc70ccf1546efd80cf2a903248519195c7f45184a7eefd7904f72b5305d76e805472e768fc4037a1383f4d6

Download Submit
C:\Users\Admin\Desktop\InstallHide.htm
Filesize
818KB

MD5
8f1048b77e5e400fe208efcb9db4bbef

SHA1
a37cdd78c44f0372b20dd080c0f3baa9b78ee38c

SHA256
cbad9ff3207f16b2e75595357c49e02e7e92e0bcc3cc94aa935ba0a659c85ff8

SHA512
56ff2531a21df5c15790c299d43fff59ac684dbf70189fd85a75346f7d4f50215d8f58038b11e915b7347033d0d59c1afe2491d683b63a31e68c867f8f3684c6

Download Submit
C:\Users\Admin\Desktop\InstallUndo.wmx
Filesize
470KB

MD5
08b57afab3869daa9e02e491c07a1986

SHA1
c884632a4a8ce1590f060293e6c402c64f1ce48b

SHA256
f9c37d4af130acbdbd98975682dd9abbea07fcc07d2812756a6e3e14d9368e1a

SHA512
7192f0c2e5338cc168a0e241fabb10756ecda8474c4d9431d87974a6351b97b134a36c6937ff024ad8e8f3abea46928439b5ad344c485a7d1c8ebea599cf242c

Download Submit
C:\Users\Admin\Desktop\InvokeClear.temp
Filesize
505KB

MD5
d7bae9814e3b5b12210d389d49126d70

SHA1
7ab7048d454c1f4a181332a0570d0da4be1d2676

SHA256
4d1500649c01f3b917c38a7441fec6b433afdd54defa94870578c1808c498859

SHA512
6dccff0f9d87697f8002fa0f78c465559b231aa49731e0ced42fb4990caf8a50ffbec623e3557a8034a20392bfe9755eb8df334d941e60777e421f8394db7cd4

Download Submit
C:\Users\Admin\Desktop\MountInitialize.contact
Filesize
1.4MB

MD5
6e8b832fad3ef15d76cab1ba7d549b9e

SHA1
2ed5cc8f69b9cd15ad53fd0194b7357af4f6d498

SHA256
322dba7dd1c8f44cc5b271fd0b17410f6d876be45cf344562ee7c830da8d338f

SHA512
8e0226f460940115f9a28ee3e27d66386f859e37da62e770941570ff6750bc739bdce98f77d0a058de4d37f634dee3f628df6e3d73bae419dbfcee0eac9de1d4

Download Submit
C:\Users\Admin\Desktop\ProtectSuspend.mhtml
Filesize
574KB

MD5
806af1d8bc4d22f73749df276dae13d9

SHA1
4c11b773a7a9204f279716db068d37d61e205f59

SHA256
26d86a951381a7db430a241bf432295bb2a8ecda2efdf5e2e4d2d372f415afe8

SHA512
f1ccfc6e837fe26337cb2d369bc48a9bc7412abfd4beaa0eb25614f38e4b9ac9f4f5ec86e06e53e59507c7325526ca4e089e127d3c1e03dc53a42b68631209b7

Download Submit
C:\Users\Admin\Desktop\Recycle Bin - Shortcut.lnk
Filesize
359B

MD5
e91e2e19d333d2869ecd4e84dadce0b1

SHA1
4cc8f4571869f83e2c0ebfac3dd17f0c51654bd6

SHA256
1bae20e282456a5df55249f23d3c89430ed079c5e0f25d16976128f303db9e61

SHA512
b540108474cd92140d824e7aedc50b24fc30bcd9d5a87ac9c5f6af11b1079d518006c1942a156da093f3e27481cb5182d60118c4e984f099a38cff68fbb59867

Download Submit
C:\Users\Admin\Desktop\RegisterRestart.vbs
Filesize
783KB

MD5
482d465181c1b1245cc29a9cfccb4493

SHA1
7edd35dde62c49261a8891c3b114272a82e5e422

SHA256
0ae5e835e2037edeb46ea85feb11f7bfe2e6c88f82c8ef5268057c0512e89ab3

SHA512
5a95bf84cd50c899d7893e0494b22365c19ad55d6206b706d3c478473210982aefd6b3f216b3533b8b0c146da75e8277de688ea468da8b3930daf392a0b2499f

Download Submit
C:\Users\Admin\Desktop\RestartSync.vdw
Filesize
365KB

MD5
59a864f52272f213e4b41bdd550b18dd

SHA1
1287b4819f693ce0988d9349810fb06a5fe048b1

SHA256
dbd0d261c3a28b3735c17fea4ba064bd6cdbc4ac47c3bbb5af6f8d1dc514ede8

SHA512
48b0b6e6ba1bd5d221d3e445debc38b994caf5f16f0ba2e707a7027c77944e421032f59c058acbb21773ad63acf0e566c5245942b38860ee9e7fd19af2999bdf

Download Submit
C:\Users\Admin\Desktop\S-1-5-21-3434294380-2554721341-1919518612-1000 - Copy (10)
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Desktop\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop (2).ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\Desktop\SendBackup.xlsx
Filesize
12KB

MD5
db183532e6189ea42ad0caa368fc40bf

SHA1
11cc091ea900d95b2835a6de85483cf0f75cf11a

SHA256
986c30619350112526fb7320ad671eb6ae9e874de38d98fd29f6a196bbd1fce0

SHA512
89f96fbd80bedbd87db2bdc11232aafe06463dc6da2026802b6d1af502e3ce94d0ddde45645f729d63e84c9e96fb46ecc5f301f9a62e619a12706ee10173285c

Download Submit
C:\Users\Admin\Desktop\SetPush.vssx
Filesize
644KB

MD5
6458386b0152a6f67ffb72599d67a7f9

SHA1
ab269e8055dbb17900d2d8e8b7590f1bc955a17b

SHA256
969edb8892d5d521540aa24fd86933eb5c1b6ee7b3f509cb859f8df3c45c9d7d

SHA512
0733540b990bcfb11b2cb82eb94f8b3fb94df466096d04fb8e0e0842fab0f1bb55461a9a9e451d9118bf3b8721b0448158b9eb08925e940e3f4c45b34f231415

Download Submit
C:\Users\Admin\Desktop\SplitDeny.wma
Filesize
957KB

MD5
5dec1a393b472d6aeb04093fbc4da14a

SHA1
43ebdd76b57d4f49f89ad14964db8d9e663d2e2c

SHA256
0daffbd8f41bbf87a70c77ebaede58ad58858f8f6b09f22c41efa7a9676d3638

SHA512
a4d082473dff5fcb5e4225bff9c49aae3f8d815299be8aa7b3539f8ce1775a74393d34c64b6d5062d460270561c4678b2417e8fe659332ce72ffc1d28e4016f1

Download Submit
C:\Users\Admin\Desktop\StepStart.docx
Filesize
20KB

MD5
2c28de05de5bc9a71b3579e01caf3aee

SHA1
b327dc2e5f145e4878b70f483e372c3aba02f29b

SHA256
9160e95e93f297454562b0015c1bd08800a28e8c087a12e14354eda4c6408b24

SHA512
a4fd2735e32252e7ff4395e459ffec7cf2d3cf5b3f11d031b9704065301528e8ab5d9e4e21b31640f5f0d338f234c5b8a61cb97f88360bc945e8378529fe49b3

Download Submit
C:\Users\Admin\Desktop\SyncLimit.ppsx
Filesize
992KB

MD5
562a51ee5fed0e7a10d50e660846501b

SHA1
e3079622ff662a61ca103ae51b8db94cca52050e

SHA256
4c4594f077f839e9c5602cbe46d5cfc0bf39ce37bbab7c28bbbf781d73eeee13

SHA512
6f8a5bd5e4e6f96b98b8fff9704f4822dde9d0b536818c7e910758d80a9938f32336ed9e2b760e58e0745e14d31e894c04d1c74008268736c794800036d0b14b

Download Submit
C:\Users\Admin\Desktop\UnblockRename.vsd
Filesize
400KB

MD5
0f0859042bdb5f4dcf2bbf14d0bac0ea

SHA1
9e74d13101bb631c902b567a0d2af2021fc3f5bf

SHA256
4aa743766d839484ee2e03b1cc36ab4686c2603165f59dfb66924c1618052cf1

SHA512
ada5e3c13715b2a51f13ea822ac865d22b5e67c9598ab9f6d9a01229ab0277cd88ee03cf262739940bc0271876832cfcbe7242b741ae4bf1b53b79f456a56014

Download Submit
C:\Users\Admin\Desktop\UndoOut.tif
Filesize
1.0MB

MD5
55686e0ad339eda5a1cdf82f67a6a62c

SHA1
6a7690505350a1814e0304ebd8e60b153fc41ff2

SHA256
a8e0de179fd9da96fbc5801db38d03c6966eb923447b3c14fbec49f9dc975c95

SHA512
5560f1981eaac23ec4c003c242de3e5c4ea47e397e507b4af2b4162091d63b91387a6f3cd69f949f84872291c68396c571ee84cf97be236fff9549da1a6ede23

Download Submit
C:\Users\Admin\Desktop\UndoRemove.docx
Filesize
14KB

MD5
0993a1f2a6c10191622f70c1b6298eb8

SHA1
9d2fb7e618969107a129cccf1e16ec80e282fb0e

SHA256
67270d2cad4eb833ec95570f24f59241b4a27f484be45f9734a355ef646805ba

SHA512
31c58c30a60443bfa3654660c20f776973b594fa437e78656f849826309f96383e7c6a51b2b410e24dfbd3d07a4c08fab47f5921cc212d279e07a0bf5fbe7247

Download Submit
C:\Users\Admin\Desktop\UnpublishReceive.sys
Filesize
435KB

MD5
3ec4e4b09400e2fdc0f987f838368514

SHA1
61895d65e33cc3530193dc0a257c922e5fb68eef

SHA256
0a60022ecdfc12aafd77b13b809748e96582fd78c4c76c6057246decdb64caa0

SHA512
3ba3be6c12487f349da61e1ec3cd9f8950910c435b8772a9f1c8cf4440c7203eb2a7f30ddc2ce58d3152e85af63dc858b7369cad0f3cf24161c81248af32b214

Download Submit
C:\Users\Admin\Desktop\UnpublishUninstall.ps1
Filesize
679KB

MD5
6a9486bfede57a64b1a002d4faf31ea0

SHA1
7d111c305e46f236492637b4140b89b8b500f81f

SHA256
83b278ff7bfdf8ae42cdcfef067db792047c3daa126b1f1b51b6729c6660cb35

SHA512
1bf5705b7e7a62b637c90c61a318815b28ca3db85df9e72eb35d5d214723f5b794e109fa09a54e2398bc653277066eb1689805e3848fd2d5034202154dd84672

Download Submit
C:\Users\Admin\Desktop\WriteHide.xps
Filesize
888KB

MD5
5c5eb0d02c315b943f45b43daa42a891

SHA1
cafc9a7d4268ce35e6d228b767474064e5b2d5b2

SHA256
2914d6180d707159a0f0f0d1fd8eb76c15e346680584e9e438f9b5dff0c8e2ff

SHA512
3b471ac043cb1abfadb943a370192ed728f1f31bb688b4466506e3152b9998a9918a839b288f81d68ea15d8a3fdf7b6ded36c153048118872188776fee8952e7

Download Submit
C:\Users\Admin\Desktop\desktop.ini
Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Users\Public\Desktop\Adobe Reader 9.lnk
Filesize
1KB

MD5
f7833a6b4d0d3c6252c5bae72ce4ffbe

SHA1
3eb6826cc838d14053c9136e3cd5d2c82c8582b9

SHA256
2c5f9ff9573aa5522f947629e208b0501a3a526fde950a5a715914b1a68c4d2a

SHA512
bbb7fe2d40bdaf68d0dbd7178949eda11569843c435449d6ed2180d37607f2d97fd3e547aabde8fdc2186ae906d747de56bc29d24f076d346ea772e716bf8081

Download Submit
C:\Users\Public\Desktop\Firefox.lnk
Filesize
931B

MD5
c7a442b0cc33249f397470b1846890a5

SHA1
fe68d996c69127b3a8c521fbba06b740ea707db8

SHA256
e4662963a01dc464d7157011460a227fd4136a8c5593762584657aee3d4134a3

SHA512
b549f82a1142a78e6666cbc55aaccccedfa8b99fdd510e249708b330539fe75ab7f7f010a748478e2a234a4d1ef2316e5706bfd7c3e05f42a6838aad6936f916

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
b1fb1da90e3920c93556f2f85dfca9b7

SHA1
3008eae1f155928ef7477c44154624c314a15e97

SHA256
7cbaa0e3aba25ff5230928503699abaac70268810d6b8f7259242604a143315b

SHA512
3235df04640552d64e74fd43030e03e88fba7a7145935503c9a30cffda5ee02207303fad5dbbb2060f5371acbccb9b0fdc5e96972c25cb63d249cfdd1a11deca

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk
Filesize
878B

MD5
51389fc9204a2c44a09cc6573a58d44e

SHA1
38b86b7e193aa034d11d5fd657230b6e51a05101

SHA256
49a096a737f387c490c495b0e26eb0e32777e26073256e21cc50854e78cea6ed

SHA512
0697313dc31a053a0ddc7c90b5e9ef45652bda929770406d7ade3187ecafeef33e906d3a9f2468b8e9ad722692f7bfef087851c5970068df7eeebe3a75fa00e4

Download Submit
C:\Users\Public\Desktop\desktop.ini
Filesize
174B

MD5
dc723b859dec1526568ad581aec334d5

SHA1
74e7432df4a66f246b5214d60b190b67e2f6ce52

SHA256
7148fbbf1aac8b5a54d248df19b60c00d3c0dcb2fd5bb2a1efd4e0f0eac6dd0f

SHA512
9bb97339f18dc8744bfb7cb8fd9392c580765e707ddc228ef5045150375510b43f1f4c310274e20fc1c0c51f50f40d4430f40561d5cff46ff42214e465490074

Download Submit
memory/2156-174-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2156-166-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2156-175-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2156-167-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2564-113-0x0000000004100000-0x0000000004110000-memory.dmp

Filesize
64KB

Download
memory/2736-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-5-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2736-12-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

Filesize
4KB

Download
memory/2736-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads