ardamax | e4d95be483d87f25db57da7bf5f280583803140f7419ba6692564e685926d1d3

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
Size

756KB
MD5

d1b6223c9444283f76758dee7bcd907d
SHA1

73648b62774211b9c8b0cf66f3919a01df4b5dea
SHA256

e4d95be483d87f25db57da7bf5f280583803140f7419ba6692564e685926d1d3
SHA512

e20e24d272b3bd68a39f8a790fa1f38e417814d651fb35efeeec2c330acaa8877cd94b75b850b6bdc8c1dcda2fe52b8473fb8c16a741685cdeefde31845fdc5a
SSDEEP

12288:WGe6ASVjW+ewWqhIJ0JiUBxq4h6gX4+J68w+j/xucLX9R9otMtrhg3Indzc6Mq:86ASVC+oMIJaDBlh6gIfaDxumtXeeFd7

Score

10^/10

ardamax adware discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b9a-58.dat	family_ardamax

Loads dropped DLL 21 IoCs

pid	Process
2296	regsvr32.exe
2296	regsvr32.exe
2296	regsvr32.exe
2296	regsvr32.exe
2296	regsvr32.exe
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\ = "XBTP03704"	regsvr32.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_additem.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\msvcrt.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\fdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\basis.xml	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\tracertsettings.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\tracert.exe	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\regdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\fdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_list.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_imageviewer.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\MMIP.bmp	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\icons.bmp	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\regdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\descdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\autofill.cfg	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_list.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\msvcrt.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\msvcp60.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\spyrem.exe	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\snipetoolfull.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\basis.xml	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_menulist.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\descdb.bin	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\tracertsettings.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\tracert.exe	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_menulist.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_imageviewer.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\version.txt	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\autofill.cfg	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\autofill_plugin.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\autofill_plugin.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\icons.bmp	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\spyrem.exe	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\version.txt	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\custombuttons_additem.html	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Snipeomatic Toolbar\snipetoolfull.crc	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\msvcp60.dll	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\MMIP.bmp	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Snipeomatic Toolbar\snipetoolfull.crc	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804d44c18948db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148169"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086445aa8a430244a91c2b800ab210a51000000000200000000001066000000010000200000006f9a6ea8b3ab6402a6c27e2b4bcc4a126b1777c9539cda19daece4e4e69e72ae000000000e800000000200002000000002c0631c87a5d2e7aa171f58c4c8123d1c9bd1cbaa28af4071d83d584c828160200000006fd4749c23d26163532fe80dbede76728cf9b9e73ee07acfa9597eace85f903440000000d1ddbd4ccb0d1935ec2ca4434bedafe307d05a12d5ef17e30f8b7b1bba93d7c3e8258aa1ce16619ae455eb94a3b1776fd4caab168629b01cc0d3ec86fc2c8809	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001002d00000001000000010700005e0100000600000001030000e803000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021ec28e8a9eab3448021ee89101c6acd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DOMStorage\support.microsoft.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001001600000001000000010700005e0100000600000001030000e803000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021ec28e8a9eab3448021ee89101c6acd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086445aa8a430244a91c2b800ab210a51000000000200000000001066000000010000200000001da70eae3289b4500693ac18111b337486eef40a8956bec279ca9bbacd62eb0e000000000e80000000020000200000001fa719a9d39fe7d83aa8892cde206177319c374ecd9ee97bd00913400b90e5582000000076d1f76d736c14ad01afe860015458996f641053f89bffe84d730f1d167a7e09400000009b61b5ad4675285b46b626b251b190d174f55ae3205a4f93bfd84bcca3e179b9143ace47d1ddac8ef04aa373f1d9b924babed17967f4130f0b5ca58afafdf51e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3506833808"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148169"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440328412"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3508708413"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148169"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "22"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e0100000600000009030000e803000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021ec28e8a9eab3448021ee89101c6acd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = dc4fbf7bd218db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3506833808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{E828EC21-EAA9-44B3-8021-EE89101C6ACD} = 21ec28e8a9eab3448021ee89101c6acd7b32363532453934312d383635452d343838642d423731382d4538324530324433364543427d00	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\support.microsoft.com\ = "124"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704\CurVer\ = "XBTB03704.XBTB03704.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\InprocServer32\ = "C:\\Program Files (x86)\\Snipeomatic Toolbar\\snipetoolfull.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\VersionIndependentProgID\ = "ToolBand.XBTP03704"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\0\win32\ = "C:\\Program Files (x86)\\Snipeomatic Toolbar\\snipetoolfull.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar\ = "IE Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704\ = "Snipeomatic Toolbar"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar.1\ = "IE Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\ProgID\ = "ToolBand.XBTP03704.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar\CurVer\ = "XBTB03704.IEToolbar.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\ = "IE Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704\CurVer\ = "ToolBand.XBTP03704.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704\CLSID\ = "{E828EC21-EAA9-44B3-8021-EE89101C6ACD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\ = "Softomate 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\ProgID\ = "XBTB03704.XBTB03704.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Snipeomatic Toolbar\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704.1\CLSID\ = "{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704\CLSID\ = "{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\InprocServer32\ = "C:\\PROGRA~2\\SNIPEO~1\\SNIPET~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar\CLSID\ = "{E828EC21-EAA9-44B3-8021-EE89101C6ACD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\ = "XBTP03704 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\InprocServer32\ = "C:\\PROGRA~2\\SNIPEO~1\\SNIPET~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\ProgID\ = "XBTB03704.IEToolbar.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\VersionIndependentProgID\ = "XBTB03704.IEToolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704.1\ = "Snipeomatic Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D6C60F6-F97C-4d48-B442-ED2441AA2A66}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4336E20-4428-47CD-A2EA-39CE7804549E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.XBTB03704.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704\ = "XBTP03704 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\ = "Snipeomatic Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XBTB03704.IEToolbar.1\CLSID\ = "{E828EC21-EAA9-44B3-8021-EE89101C6ACD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E828EC21-EAA9-44B3-8021-EE89101C6ACD}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToolBand.XBTP03704.1	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4912	msedge.exe
4912	msedge.exe
3784	identity_helper.exe
3784	identity_helper.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2284	iexplore.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2296	4924	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2296	4924	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2296	4924	d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe	83
PID 2296 wrote to memory of 2284	2296	regsvr32.exe	84
PID 2296 wrote to memory of 2284	2296	regsvr32.exe	84
PID 2284 wrote to memory of 3872	2284	iexplore.exe	85
PID 2284 wrote to memory of 3872	2284	iexplore.exe	85
PID 2284 wrote to memory of 3872	2284	iexplore.exe	85
PID 3872 wrote to memory of 4052	3872	IEXPLORE.EXE	88
PID 3872 wrote to memory of 4052	3872	IEXPLORE.EXE	88
PID 4052 wrote to memory of 4632	4052	ie_to_edge_stub.exe	89
PID 4052 wrote to memory of 4632	4052	ie_to_edge_stub.exe	89
PID 4632 wrote to memory of 3344	4632	msedge.exe	90
PID 4632 wrote to memory of 3344	4632	msedge.exe	90
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3960	4632	msedge.exe	91
PID 4632 wrote to memory of 3044	4632	msedge.exe	92
PID 4632 wrote to memory of 3044	4632	msedge.exe	92
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93
PID 4632 wrote to memory of 1564	4632	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1b6223c9444283f76758dee7bcd907d_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32 /s "C:\Program Files (x86)\Snipeomatic Toolbar\snipetoolfull.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.snipeomatic.com/installed.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17410 /prefetch:2
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50214
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50214
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe117646f8,0x7ffe11764708,0x7ffe11764718
        7⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        7⤵
        
        PID:3960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
        7⤵
        
        PID:1564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
        7⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
        7⤵
        
        PID:3176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
        7⤵
        
        PID:2496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        7⤵
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
        7⤵
        
        PID:5076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
        7⤵
        
        PID:3124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
        7⤵
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
        7⤵
        
        PID:760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
        7⤵
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
        7⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,13584693139018071988,8460978170924849867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5300 /prefetch:2
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=1 --customer-type=1 -- "https://www.godaddy.com/forsale/chance2save.net?utm_source=TDFS_BINNS2&utm_medium=parkedpages&utm_campaign=x_corp_tdfs-binns2_base&traffic_type=TDFS_BINNS2&traffic_id=binns2&"
        5⤵
        
        PID:4324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=1 --customer-type=1 --single-argument https://www.godaddy.com/forsale/chance2save.net?utm_source=TDFS_BINNS2&utm_medium=parkedpages&utm_campaign=x_corp_tdfs-binns2_base&traffic_type=TDFS_BINNS2&traffic_id=binns2&
        6⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe117646f8,0x7ffe11764708,0x7ffe11764718
        7⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9340670856219834946,5529726073077957772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        7⤵
        
        PID:384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9340670856219834946,5529726073077957772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\SNIPEO~1\MMIP.bmp

Filesize
3KB

MD5
730d8fa88d8b06ff5a4e5b56489a306c

SHA1
5eb8ead4fa3b0d1ac70753c9b52e791a2990bdeb

SHA256
b7e0f69cefd9e6f5a49040bd8ed2552c73497bc828fc50d902384bfb115f6358

SHA512
54c07612b865492fb367888b42ce452d81ba270685ef7ed794966032ff1e75c5c17086c6b447cd2cd9e884246cb02a44cd259894ef81a725136c463dab0280a4

Download Submit
C:\PROGRA~2\SNIPEO~1\autofill.cfg

Filesize
17KB

MD5
130f14037780bc1853005b0753936395

SHA1
7e65e748252114402ea9ecd97247abe131de115d

SHA256
f2824521c88e4b1c08e3144cc192621476c339ced1ab8a321e42d5c795f2729a

SHA512
1617debf836d7fb01fb2f6853a4a763d967b6a30e918271a22afe1b5ac8247dce441ed1a7cc5c94ce81f3e779efb49ea36d8b4467d7e8c9f7d02cd4e09c60cc9

Download Submit
C:\PROGRA~2\SNIPEO~1\custombuttons_additem.html

Filesize
5KB

MD5
3753249e9cf870545aff904c351c62ad

SHA1
e08a78cb7903664c0776a1d5a07455485b2697f7

SHA256
78e02ba3d6d60f44ebd5d9fb6b8c26df8326b87c4cfe76c3334bf50511c397b3

SHA512
0c3a866f141c764dabed73c222416d919419ded396cb99b1bdaab77ec166fe09f8142dbb59727793109ab2ea1f752562752763390911e8677c81cd58492a4d2a

Download Submit
C:\PROGRA~2\SNIPEO~1\custombuttons_imageviewer.html

Filesize
1KB

MD5
4ce770a6e20bdd5b57fc406edb5e5c9d

SHA1
7a97843c871549281295c2f11a1888fd3628b515

SHA256
3a4bcea74e23b899ab3b7a99b2d046b2ad36959314e0c8d3d44e811340b2ec65

SHA512
b745a2a836b7cb16e7a4c8144030485f7a48da574c0fb0f004e9643cfdb6fcd1a8ff11e54d3fee70caca7c87495752f458873f9e52fda08f6470a95ab6ccc94d

Download Submit
C:\PROGRA~2\SNIPEO~1\custombuttons_list.html

Filesize
14KB

MD5
f31221ea317f96dccd0f80a714558a51

SHA1
b709a1ea654033b26681e00ba9d3380b5fc1c1f5

SHA256
0728809962454119fd73117905c66b3652b2fbe780b01721abb2ce57eb767342

SHA512
825116590d183b4cb1bb3bab8ee45e59c84d4d4b2bcf64d2cb33c1589e3d2b1175e14c84c22a99aac2a8b2f4d805290d2d4d8216339084b5c2f4b32235428b83

Download Submit
C:\PROGRA~2\SNIPEO~1\custombuttons_menulist.html

Filesize
17KB

MD5
d096c647f6a3d1f38af0cca88ea8f8ac

SHA1
eb1cfc986d02ea61148204c4e3e3e4d8528485e7

SHA256
9c0c46dcdd6a76c0c362f36734c6ae046a498f14dff3ae62064249ee5fd1029a

SHA512
46b9852889fa1a887f5b0c340ed66cf9f154252f8248076a67d34631ce67755171c0cdd42383166e929ac1a9e28a05a85398636afcd491b24e505449323fd1ed

Download Submit
C:\PROGRA~2\SNIPEO~1\descdb.bin

Filesize
115KB

MD5
7bb096d53d9ca88388254afae9068995

SHA1
f877bbc27707547db79bc2a1fb05489104b05168

SHA256
c171108e3d59968b9de54565a732c5a87e90f83e079156b3c92386c192768e17

SHA512
901a05a0ba94ade6d9b90836bebd01c4af131457630cfd059ce6a1eba40c7b654c7b9f83079df6d08160e21e8a1842571bef6d077328fae097ac88cd9a6c5b97

Download Submit
C:\PROGRA~2\SNIPEO~1\fdb.bin

Filesize
496KB

MD5
20a6062a938e56319ecc28fcbf71c191

SHA1
da5096492160899b52a5a3414ec0829a38764600

SHA256
8718d1d8154d0e4fcd0e2c84d02f580af677b96dac589426b0ed7e327f550a58

SHA512
14bcec751dae012d35f25aae59dcec9dbaf0b8674035328cfa3a586228e40ffb6d2bbd3d4b068cae587f47f4f233ccea452ca016ecc4fc92b48a7a1a0baf3da4

Download Submit
C:\PROGRA~2\SNIPEO~1\icons.bmp

Filesize
13KB

MD5
fde327cb58ee99a1672ca9752e7de95b

SHA1
5acdaf53d05595fd9508dc4406d3cc9ee484ef08

SHA256
feb4b3f4d9fdb93e893caee2603280bc7db1fa1dbcd7fe11d9b54e265e27061f

SHA512
4c0ea3450543fdf72de468566355c9c8053c6a4a03662b9362cae7d060d9f62d1ab51250ebb2fd95d1bfcadd8a66223c6715872f3de70ed3ed63e643ca073740

Download Submit
C:\PROGRA~2\SNIPEO~1\regdb.bin

Filesize
717KB

MD5
a9ea14a1fd7dbd79e7fc81c73b97a1b8

SHA1
46351d7552860351cd5cfb66a5056de3eb616157

SHA256
9c2ab69190aeb45e65faf317cbb752beb43895a29eac69dba12b7d6fa035a582

SHA512
1d0a15b2d128679c8275dea4a371e7b669a80d4d3e2d8a4c2f52d9987a2c589a7179f2885dc330cb58962bdbebb454513fab532405234a418b65b46e01dc4949

Download Submit
C:\PROGRA~2\SNIPEO~1\snipetoolfull.crc

Filesize
351B

MD5
11a71d1605719e4d22536924af2739c3

SHA1
03cef4b3b57a07fe1bbcede567cb1ae1274c6b2a

SHA256
faf8da0be449f2f77179acb5d7c5947f933e23e03398ed8b74e8f242ef1fdef8

SHA512
f7bf080ccd48138424f653a301aebdc678b36bfbc4f249b6dda8a1bc6adf4495fc589bedaf1bdac04fc40ab4e908e088b61523bebaa67850097d58f6e531fba4

Download Submit
C:\PROGRA~2\SNIPEO~1\spyrem.exe

Filesize
280KB

MD5
d464b9ca5f771d88c6b2a2b7ba359aac

SHA1
c401a9e54bac45cd87aa70c83abd0e193fc47d0e

SHA256
d7fdb53aec3090b81881ee63c47c3f766a25245afd892026b96dc82eea5d21e3

SHA512
9de2566e953eca760d86978feda5e51a9a1ca0f75b0347b8483ffe3bd80e96ba2ba52570476df0550b23851991360b631b6f3cdc8c4ab8ee1ca565ae4afc4a54

Download Submit
C:\PROGRA~2\SNIPEO~1\tracert.exe

Filesize
10KB

MD5
9b4976f23d26be71ead311dc13184a73

SHA1
fac39f5597afaf4a0c60e0618847bcb64a6a5f74

SHA256
5c9a1a4b1d3877762aaefa806c67b1b7382bb8dc0619ba1954af9d1056151e6c

SHA512
f2afb8461a2afb68ac7e9143611dea71561e26af3243f2af7c153be43a176d6a6f39f68d13c3f8057075e2ffb29a64cfe51605d83fd3a7506e8b5d4f623420c2

Download Submit
C:\PROGRA~2\SNIPEO~1\tracertsettings.html

Filesize
3KB

MD5
86a6a5fd8128a2cf8401d7cd84525581

SHA1
ff02ab29b6ba344ace4c62b807b5b87167fd876d

SHA256
63da9d985a598aaa5c5d4e5e5e7569bd64b3877f73aba371b8ec72565900b7d5

SHA512
df9a951f25610a29a48da3625206afd9fc03cb4fbcf1b9ef65a9dfc78442e062e3250e3451d9163addce7a385ecd544d26065153e20b400970ca873944ac59d8

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\MSVCP60.dll

Filesize
392KB

MD5
cb21d826d9c39aed19dd431c1880f5de

SHA1
6eafcc2fdfdf73abea334ac7afb903829f6ff2a6

SHA256
f1fd0f1a54f196b19a6f21044092c89c02353dad173c236d80f6474cb8a7ea7f

SHA512
d4223a0ad6118b1dae8505ad4675f6e87e4fa9ebca6fdbe2ee3f0ea868ced15f07fb5ae2d9a41d8992a9d41a9bbe4b16f7ac6eeb1c99324ed8fa3a8fc47af150

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\autofill_plugin.dll

Filesize
148KB

MD5
b7713a243e845d4a94e660609cb38184

SHA1
ed0fe02af87bf34fc42772a64810dfcf358be1c8

SHA256
64a5d90a5acdba9cda5ffe1ea4065b120b7a137300efcf12a0b2a9a3e6861ee8

SHA512
fc984fce63387c164273e8be57eb8005e92b9246e061bd298e9297fb16559851ef1abac180f7e11c3d7ccdefd2b1a67ded39aaaedd689b87731b8cc7cc8c6ab6

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\basis.xml

Filesize
9KB

MD5
e5afc0d6c61d50b92f85ea549d251737

SHA1
0fec11351de4028b312e23f2fc974624127e2fde

SHA256
2d1354e210573d2e4ae30899606978ce946c970ae8a99026565aa98d9366c23b

SHA512
01da484816937a0a1e686934506c76c3afbf72bda2c9817db6c2c92668eb6212e37d46da034a5f74539a6cda919e7bae08852005773a34106324ec204822c1de

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\msvcrt.dll

Filesize
284KB

MD5
e054edafdb3997d84201275a743488ad

SHA1
2df120342d1befe0329d4941a60a3205fee5e597

SHA256
11b2e109ba8012d8ddcee1dd8b6ca060aedccbb60663f964d34d4ae50449d105

SHA512
f58549d4900e996637880685b4d6e69318ee7d1ff229a1e3931c226ffcf9f6d2375713ad5587a58dccf36257b13901231f523116ce54b4587d254a579301e713

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\snipetoolfull.dll

Filesize
532KB

MD5
168160f56873fbd542d0f3870609fbe5

SHA1
c2f142a14b8f1c512f452e9ffc82a756985e2c01

SHA256
ff8c2c025efe03bec848bf614e752f44fbcc2ef6e3253ef4e45fa86da015bb89

SHA512
58edab6c072bc946fd807be66d22535352ffda54858659a350c4b03b0614cfd7776cd2b21c87b977a6a2df3ce1d2a89d191c649a8772b32550ca94e18c92f33c

Download Submit
C:\Program Files (x86)\Snipeomatic Toolbar\version.txt

Filesize
53B

MD5
69baf51b16b1bc0e7de892d0698ec59a

SHA1
0910a119c9e6f773e021d1b51142e8b6d65e48f1

SHA256
eeaeeb1bdfeca6493d71b29f8f4449a24998f1c7f8e520c4008e8bb75c85c94f

SHA512
d093c4e860827ee5d3e44a917fbafbc1b72f3afd6e56dfb4df38fcf89c80673c79399bed785df63960dced50bb41f813d65aba4d75984fec9b0ca6050dd76c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
2KB

MD5
b26eaa0539b91fc17ddfa00b785b3370

SHA1
d82452e97f2f857b3d67d2a304e7e4b56fe804cd

SHA256
3c5092a1d46123b14f9cfd8ecf27298d61ac0b1576947b415cecb71c985b62e3

SHA512
d68834aa32c2f1d570bf4efc442548f4b304833c397ba4a416a2b74f737a097808272ac373f8e61e7f7efb9af96a051e9e1c7cd103772736a91ae35021ab3998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
2KB

MD5
872a5abb53b670a47ffe5a6488868b00

SHA1
8d2bf9271f652dcb552ce3978d3076dda508a21e

SHA256
c80b223512aa937b03958c51ac2807303c8108829aeed70f44b596b6d1246071

SHA512
769235bc22f73dc54e4b3c062f09f6b23a2cefb62385e83e5f06544bbe0362caf176c801be1480b7d48bc57442749bd2a3ac32450b85b1b3106db6b92356f6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
2KB

MD5
112afb8daa762ee3831756903f517f06

SHA1
8573da89e05e53786c8995e7cd4510be837e593e

SHA256
6afa7fbb53fa7ee927dd1daf980f6f8a8006e9424cf9815a62569be41328d711

SHA512
3453f67c4fbc43e0dc536015698277fd283b22737868565852f0d08fb072b5e92faba709f8b2c55c7902cb85bcc45bac9b3f00fa665614583758573056cea19b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
3d6369c7b766bc365846cc8a4cbf342b

SHA1
593cdf5d7fae21b31813f20db26f7452218ff8af

SHA256
9b9b6a3af40491ff920270c0be40c0e8484adb1bac0ea0e9da6ce17464591010

SHA512
2fcc65941c227cb765e0c94417f6bbda00c7b4acc428906e6e98300c3e1deb08479728284f39ecbef7de02f7b0357487d2ebf0d9f3065069cc955d9643e14d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
a6da704e1db8224ebff36f3992cdab8e

SHA1
4806892a8cc70f92c6922f1a21cf3a652cc6eb09

SHA256
e5a51d724b8acf9eeb55bafc9a5eb2aa4d4e3fbd71211fb65697303ceb29c396

SHA512
41ba6c4c3b6ffa1784da20eb37b6c3fad90ffaa0128b68dae0818b047c2468228aa3d9d14f0da39310b92238767d9ddce877632595ac5c4f804b5fa03a680970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
d7e39e4d4a839b3686b7bb08a2096a5d

SHA1
ac39181d266a4ce97b4327ca5825a835915e3bb5

SHA256
f0a4835c191606efefcd5ccc1f103cd20d18754b92765b1a7e42560415b0464d

SHA512
580e4b2021dbc406d1c81f84fdcb804fa09fdf4f228863b90435c7c6136a1bc5a2a1d5e0ed8f440834a6d2bb950b276c643a5609235836623076b43c366c3e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
536a4d48af5825e8ce1449fdb98c6f08

SHA1
71391bcea0a729cfcf1a5b44e53f911a793266bd

SHA256
9515e19c3bb420cf45de5251aa0253bb1bce3e078b1734c53a63458670443717

SHA512
32a160f4fd9a15b7da1c79f68e5055d876453ecf5ea498bead4239faa43a8b38d9a6f5092e0e5d68e7d79874dc8429a913999a6b92944ac462b96bbb4839c0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
7f0b9c428b527acf253bbadfc196773d

SHA1
7544b255fa441b7670db81d7b5e509cdf8465591

SHA256
77e4eda9605b8cdf6f7c85b1bc4d0c44f29db0e27736133f72954e998db385f3

SHA512
eb307bad23c7aa9e7a9093fae67efdd22f3b2c4662326c4f29a7b38c3242647152f820c1e82b599b947ae4b2ff820726a9927ace631308318f7a3117e45f753c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13aa77b9-f8d3-403e-b959-57ea35d84cda.tmp

Filesize
5KB

MD5
3122a0c4b04a52b5dcd9f1ada5995804

SHA1
63e529150b95a3d6814f8d25d578fa7f2fbb7d47

SHA256
b633a78acdb33d9a73680a394a43c8e30dc2de4db57e7bfe89ff43ef6707c34a

SHA512
ceae241a76f6afaf10fe7d35012e31cd6cb7dc5720e12575dea193fdb2fb403d76b54c5a8b3ea3377068fca638aaf5fd12338c472c2b61fdc89d1b6cb3e56938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
1dfab44cc70f7e0ccf0bf29e5fd05947

SHA1
3d9a479290ef809ab360d3000fa1cd8cf2e26fc5

SHA256
6a238713bf2f4eeffb1dda59abe88c9103816f897aaa6044d45d0cd25c9d74ea

SHA512
a10cef6b518bf1ac49f5395ac34f7dec7542c3a9d14da81d8d021f601bf71c6a903ed17126d9a9e8d0f402da837ef08c13bf10f115c0c500c2b5d02e56780755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
830B

MD5
a31660ddbab173277d6c9c4748b5a950

SHA1
a82baf032771b8b07c6e2fe4455b64a0362dac36

SHA256
d4a7c53aa4fcd98401f9be1f845d23515d1158e9ec1263c3bab93f02f8bdc3ea

SHA512
997b611d5dc87dc82a4878f7a5507d5c75734d7a8198bf768188f578aa67b5276a1203b7035ebffca768260f5e62a86013321bd65443d87cf1a97eee0f87dfac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
567d10a24693ce365072a46a63da96e2

SHA1
387fd52ea0bdaa94ae1d273aef19723104a992d5

SHA256
bec50c606e1e88c13989adc458e5467e25bb43e4df2ce043554e97fe53af5dba

SHA512
cc930fde8567c08d8d689fa4d4e3fdb7d1c79add901229c1766e74a81bc576115d5e773e2bd43fa5ac7b958b4cf33e95b5e0d740ec27fc4dfd9a8ecfa06a44a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7f5962cb1cef46fd698e9487a3f82c17

SHA1
92dd81e0affb684a8114594b90317c59a62fdc43

SHA256
b7965fbfb8ebf1a826ee27e86d53f4a86ff91c3bd398c11d87e9545ef037684b

SHA512
65b21d08b0192ba2ad6684c0e13414c3e58f1c408a463ae167fc61670810cbad7bd227920ed7603a19febaebe9c8475165c5598ff81062f710d730e74d2c06e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5807ac.TMP

Filesize
48B

MD5
e96ad900f67d36ccef4b6b40bdad62c4

SHA1
18472e1236515513004b666e740c9f01fd679c22

SHA256
23040f9e2fad55c8bca26068c1c9aa12a9fec453fad9d5dac9f62f441fec2daa

SHA512
3ce2f7b181c4a4d169adcf1191b5cd42a1fc953cefb869801956967f7edcf375df644db75b123a44c12eefe50a90d97fa9e792248b45e48c2366f98cf9ea3f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
f4a6505ac9ac85ee2bbd5f65042f9088

SHA1
11651622e28d36aa64fbd3b046263e36ac0a4b79

SHA256
b195b33c2967e6fef4b8b849646ed877c4cc68cd3fa50378577c37040996a106

SHA512
74b6e265d247db0f85ca32294ae43437798d246c56cc7ed44d4273ab60c2ef8fdd5f6dc4356f4738c9aecae8fd02557e2b6fe336bcd0887c761509c01db5be11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580858.TMP

Filesize
537B

MD5
330acd99e9b4634e22e36bb92de9f042

SHA1
bc4d1bb6034ead3bdfd628ac613cbeb2bd5fb1bd

SHA256
111f34de50b60d960934000b02b3c657dbc106d92d1713a432dbc81ec82c4250

SHA512
05ce664b02af7cb3319bd267aab2b03252a4721ea2c7caaf70b43d681c630ca62bb257c398af81786b796ceae6ee6cb0e07ab3073f5cea4e0174cfd10c630244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
eb0d8766a7c3b27f7fb2dd299ecafbe9

SHA1
2a979afafdbe4a47d23229af3038c2f34d0280ab

SHA256
21b9cd177d8d3292002f8d5ea70bf563c38024f77b99909669c2ef0aed29523d

SHA512
260dd01dd209a910c89599903e444a9f8232b3cdd9e894926773eab2bc16e62b9892fb71ad6552e89d67afb474ca0c26b22107c890652dfd93c495dc08199e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8657ae81c1564049922dd9a12572dcf

SHA1
227f4002f3e24f34e3a78569e923942cf1fa99c1

SHA256
3d7c7c5d5db04cfdc2d878f3029e7f3b5ad2da82758db1ea7a57b3a3b3972704

SHA512
d1f57dd4999e164a1ae00e0c8de865f0e16a070bdd2a773287cc7d1d30b3450b3c8aa981e0eead741607963a269ecb993340e55dbb5516385a61ecf20f55f311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SZWOD4P8\support.microsoft[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\joriajv\imagestore.dat

Filesize
771B

MD5
8a3ff81b10cf5c5ea46f8f69cfc1082f

SHA1
aa3b1986680ccf22fb8653bb6e1acafcbf8c7f4f

SHA256
0d7cd1b7b5a1f384ef344a467bd1cf716d4c50378f3400b26cb09f6abc92f51f

SHA512
924c03bf7dfd0dd8d1947f360c1ef236c2bf57912b8323302a4ca0fd177273a14f5db5ba3073a238d806a311b79f4402a1a49dc54c96df9d73f5916c3b83c722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O4PTG2YB\favicon-32x32[1].png

Filesize
631B

MD5
fb2ed9313c602f40b7a2762acc15ff89

SHA1
8a390d07a8401d40cbc1a16d873911fa4cb463f5

SHA256
b241d02fab4b17291af37993eb249f9303eb5897610abafac4c9f6aa6a878369

SHA512
9cbcf5c7b8409494f6d543434ecaff42de8a2d0632a17931062d7d1cc130d43e61162eedb0965b545e65e0687ded4d4b51e29631568af34b157a7d02a3852508

Download Submit
memory/2296-30-0x0000000003390000-0x00000000033B5000-memory.dmp

Filesize
148KB

Download