Downloads.rar

General
Target

___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe

Filesize

139MB

Completed

19-11-2020 10:40

Score
10 /10
Malware Config

Extracted

Path C:\readme-warning.txt
Family makop
Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: akzhq412@aol.com or akzhq412@protonmail.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

akzhq412@aol.com

akzhq412@protonmail.com

Signatures 23

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Execution
Impact
Persistence
  • Makop

    Description

    Ransomware family discovered by @VK_Intel in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess
    svchost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 928 created 1404928svchost.exe전산 및 비전산자료 보존 요.exe
  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Deletes backup catalog
    wbadmin.exe

    Description

    Uses wbadmin.exe to inhibit system recovery.

    Tags

    TTPs

    Command-Line InterfaceFile DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    1400wbadmin.exe
  • Modifies Installed Components in the registry

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Modifies extensions of user files
    전산 및 비전산자료 보존 요.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\GetRestart.tiff전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Users\Admin\Pictures\RegisterShow.tiff전산 및 비전산자료 보존 요.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    전산 및 비전산자료 보존 요.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\___ _ _____ __ ___\\전산 및 비전산자료 보존 요청서\\전산 및 비전산자료 보존 요.exe\""전산 및 비전산자료 보존 요.exe
  • Enumerates connected drives
    explorer.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\D:explorer.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Drops file in Program Files directory
    전산 및 비전산자료 보존 요.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Inbox.winmd전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\dev-config.json전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\acrobat_parcel_generic_32.svg전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\skins\skin.catalog전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-400.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-24_altform-unplated.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-256.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10910_20x20x32.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-150.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_1c.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-100.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-unplated_contrast-white.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40_altform-unplated.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\EXPEDITN.ELM전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cv_60x42.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_BadgeLogo.scale-100.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\holoLens\en-US\toc.xml전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\PopUp\Pop_up_Ok.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256_altform-unplated.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\PREVIEW.GIF전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.jpg전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\logo.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\surprised.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\_Resources\0.rsrc전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common\Resources\Fonts\SegMVR2.ttf전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Images\fre_background.jpg전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\MedTile.scale-100.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-unplated.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadline.psm1전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Mozilla Firefox\firefox.exe.sig전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-high.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-96_altform-unplated.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\puking.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6124_32x32x32.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-400.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_10h.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\MedTile.scale-200.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms전산 및 비전산자료 보존 요.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\klondike\Blizzard-of_Bliss_.png전산 및 비전산자료 보존 요.exe
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    35443024WerFault.exe
  • Checks SCSI registry key(s)
    vds.exeexplorer.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyNamevds.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064explorer.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyNamevds.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilitiesexplorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003explorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064explorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000vds.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareIDexplorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000explorer.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareIDexplorer.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlagsexplorer.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilitiesexplorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003explorer.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000vds.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000explorer.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlagsexplorer.exe
  • Enumerates system info in registry
    SearchUI.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSSearchUI.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUSearchUI.exe
  • Interacts with shadow copies
    vssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    1300vssadmin.exe
  • Modifies Control Panel
    explorer.exeSearchUI.exeShellExperienceHost.exe

    Tags

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktopexplorer.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\TranscodedImageCount = "1"explorer.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\LastUpdated = "4294967295"explorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\ColorsSearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\ColorsShellExperienceHost.exe
  • Modifies registry class
    SearchUI.exeexplorer.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"SearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0"SearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0"SearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorageSearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortanaSearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"SearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settingsexplorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRUexplorer.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instanceexplorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageStateSearchUI.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c100000000000002000000e4070b004100720067006a006200650078000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000dd4be74064bed60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e4070b0047007500720020004e006800710076006200200046007200650069007600700072002000760066002000610062006700200065006800610061007600610074002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000009da31c4064bed60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e4070a004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000005aa40d5557add60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000explorer.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02explorer.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instanceexplorer.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefixSearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortanaSearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"SearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"SearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132483827320340134"explorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instanceexplorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortanaSearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\TotalSearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"SearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortanaSearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"SearchUI.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffffexplorer.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instanceexplorer.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"SearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorageSearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"SearchUI.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"SearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shellexplorer.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\TotalSearchUI.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotifyexplorer.exe
  • Suspicious behavior: EnumeratesProcesses
    전산 및 비전산자료 보존 요.exeWerFault.exe

    Reported IOCs

    pidprocess
    1404전산 및 비전산자료 보존 요.exe
    1404전산 및 비전산자료 보존 요.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
    3544WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    svchost.exevssvc.exewbengine.exeWMIC.exeWerFault.exeexplorer.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeTcbPrivilege928svchost.exe
    Token: SeTcbPrivilege928svchost.exe
    Token: SeBackupPrivilege2756vssvc.exe
    Token: SeRestorePrivilege2756vssvc.exe
    Token: SeAuditPrivilege2756vssvc.exe
    Token: SeBackupPrivilege3752wbengine.exe
    Token: SeRestorePrivilege3752wbengine.exe
    Token: SeSecurityPrivilege3752wbengine.exe
    Token: SeIncreaseQuotaPrivilege2936WMIC.exe
    Token: SeSecurityPrivilege2936WMIC.exe
    Token: SeTakeOwnershipPrivilege2936WMIC.exe
    Token: SeLoadDriverPrivilege2936WMIC.exe
    Token: SeSystemProfilePrivilege2936WMIC.exe
    Token: SeSystemtimePrivilege2936WMIC.exe
    Token: SeProfSingleProcessPrivilege2936WMIC.exe
    Token: SeIncBasePriorityPrivilege2936WMIC.exe
    Token: SeCreatePagefilePrivilege2936WMIC.exe
    Token: SeBackupPrivilege2936WMIC.exe
    Token: SeRestorePrivilege2936WMIC.exe
    Token: SeShutdownPrivilege2936WMIC.exe
    Token: SeDebugPrivilege2936WMIC.exe
    Token: SeSystemEnvironmentPrivilege2936WMIC.exe
    Token: SeRemoteShutdownPrivilege2936WMIC.exe
    Token: SeUndockPrivilege2936WMIC.exe
    Token: SeManageVolumePrivilege2936WMIC.exe
    Token: 332936WMIC.exe
    Token: 342936WMIC.exe
    Token: 352936WMIC.exe
    Token: 362936WMIC.exe
    Token: SeIncreaseQuotaPrivilege2936WMIC.exe
    Token: SeSecurityPrivilege2936WMIC.exe
    Token: SeTakeOwnershipPrivilege2936WMIC.exe
    Token: SeLoadDriverPrivilege2936WMIC.exe
    Token: SeSystemProfilePrivilege2936WMIC.exe
    Token: SeSystemtimePrivilege2936WMIC.exe
    Token: SeProfSingleProcessPrivilege2936WMIC.exe
    Token: SeIncBasePriorityPrivilege2936WMIC.exe
    Token: SeCreatePagefilePrivilege2936WMIC.exe
    Token: SeBackupPrivilege2936WMIC.exe
    Token: SeRestorePrivilege2936WMIC.exe
    Token: SeShutdownPrivilege2936WMIC.exe
    Token: SeDebugPrivilege2936WMIC.exe
    Token: SeSystemEnvironmentPrivilege2936WMIC.exe
    Token: SeRemoteShutdownPrivilege2936WMIC.exe
    Token: SeUndockPrivilege2936WMIC.exe
    Token: SeManageVolumePrivilege2936WMIC.exe
    Token: 332936WMIC.exe
    Token: 342936WMIC.exe
    Token: 352936WMIC.exe
    Token: 362936WMIC.exe
    Token: SeDebugPrivilege3544WerFault.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
    Token: SeCreatePagefilePrivilege1500explorer.exe
    Token: SeShutdownPrivilege1500explorer.exe
  • Suspicious use of FindShellTrayWindow
    explorer.exe

    Reported IOCs

    pidprocess
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
  • Suspicious use of SendNotifyMessage
    explorer.exe

    Reported IOCs

    pidprocess
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
    1500explorer.exe
  • Suspicious use of SetWindowsHookEx
    SearchUI.exeShellExperienceHost.exe

    Reported IOCs

    pidprocess
    3264SearchUI.exe
    3144ShellExperienceHost.exe
    3144ShellExperienceHost.exe
  • Suspicious use of WriteProcessMemory
    svchost.exe전산 및 비전산자료 보존 요.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 928 wrote to memory of 2008928svchost.exe전산 및 비전산자료 보존 요.exe
    PID 1404 wrote to memory of 13441404전산 및 비전산자료 보존 요.execmd.exe
    PID 1404 wrote to memory of 13441404전산 및 비전산자료 보존 요.execmd.exe
    PID 1344 wrote to memory of 13001344cmd.exevssadmin.exe
    PID 1344 wrote to memory of 13001344cmd.exevssadmin.exe
    PID 1344 wrote to memory of 14001344cmd.exewbadmin.exe
    PID 1344 wrote to memory of 14001344cmd.exewbadmin.exe
    PID 1344 wrote to memory of 29361344cmd.exeWMIC.exe
    PID 1344 wrote to memory of 29361344cmd.exeWMIC.exe
Processes 15
  • C:\Users\Admin\AppData\Local\Temp\___ _ _____ __ ___\전산 및 비전산자료 보존 요청서\전산 및 비전산자료 보존 요.exe
    "C:\Users\Admin\AppData\Local\Temp\___ _ _____ __ ___\전산 및 비전산자료 보존 요청서\전산 및 비전산자료 보존 요.exe"
    Modifies extensions of user files
    Adds Run key to start application
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\___ _ _____ __ ___\전산 및 비전산자료 보존 요청서\전산 및 비전산자료 보존 요.exe
      "C:\Users\Admin\AppData\Local\Temp\___ _ _____ __ ___\전산 및 비전산자료 보존 요청서\전산 및 비전산자료 보존 요.exe" n1404
      PID:2008
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        Interacts with shadow copies
        PID:1300
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        Deletes backup catalog
        PID:1400
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        Suspicious use of AdjustPrivilegeToken
        PID:2936
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
    Suspicious use of NtCreateUserProcessOtherParentProcess
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:928
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:2756
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:3752
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    PID:1752
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    Checks SCSI registry key(s)
    PID:2676
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3024 -s 2452
    Program crash
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:3544
  • C:\Windows\explorer.exe
    explorer.exe
    Enumerates connected drives
    Checks SCSI registry key(s)
    Modifies Control Panel
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:1500
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    Modifies Control Panel
    Suspicious use of SetWindowsHookEx
    PID:3144
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    Enumerates system info in registry
    Modifies Control Panel
    Modifies registry class
    Suspicious use of SetWindowsHookEx
    PID:3264
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Exfiltration
      Initial Access
        Lateral Movement
          Privilege Escalation
            Replay Monitor
            00:00 00:00
            Downloads
            • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_02ae2547\Report.wer

              MD5

              18480f0382c7f04cd695dcb85d970bf5

              SHA1

              c24ed330f02c5ffdeb8c0d703008dfc1cabff70c

              SHA256

              99f69c7bf77b74c68457f60def23a68d0dac5f5bb827796d00fec52abc9d01cb

              SHA512

              e8dfc7f847ed319ea20a1bf42fe0f45418e8e29e3f02b2194289338cb952a50e21afd4885fde8e37545925aa66896cd2e92687f203524ba96a0c78e410b44e71

            • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_02ae2547\WER2401.tmp.appcompat.txt

              MD5

              05b6d301dd1e685bdfcd3a0b1f0e42d2

              SHA1

              de8b5b5aaddbd33303ede9d7e1579fa58021947c

              SHA256

              17e67bab35cfc716852bafc73a8eafe1493029567a1873ce228b3d0de3a31ebd

              SHA512

              570418a55fa61762ff003cba19cf9aaa97ab789d374c10f745d7181a28506c654f12b167bbb1bcf618455e66c30c16f3f69baa2abfc438ec32fbdb741ca2164e

            • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_02ae2547\memory.hdmp

              MD5

              75fa0589092182e0a6ced1799a6b9530

              SHA1

              ffdd98c2eaaf34d9fdde2ecf8bacc9c222d49755

              SHA256

              6c01e9e42d0ba36de9ed052d3b74c35f628577174bd30280838a0e0197e3fcd4

              SHA512

              b5368bcec183af4a4d5993b512cc67319166a18b8c85d82cc6cda9811e62b844c18c55bbeea47163d0cd55dbba26e8161f4e7a33ecbc28a0678867f24d5da5b6

            • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_02ae2547\minidump.mdmp

              MD5

              03a3a470225002e098bf43a8831700ef

              SHA1

              5c0a5f35bd311b4657433a9181981a1a4dbc2e5f

              SHA256

              2e38617dc6ba4e6ed8e53c8f16b03b93357b490e31c9cf24c3fbc992591bec54

              SHA512

              afb99564b6341905782655b02e2aa634e02177c87182eb82f8c95869fe85e67e5a96a8c2bb50cf0fdd16f86a624ea5e7fa339aa75116b6ecfa71a35e3245ee2c

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

              MD5

              7f618dd68cd70797740e22724ce2f8b9

              SHA1

              93437e167d57c97ea4c7105441fc172d6ed80978

              SHA256

              24389354b385d83e6151845b9d39af1bb2cc08f85c2cb6e7f4dd65b41e2af240

              SHA512

              5665e2d987aca3395fa8d026e990dd14dc6b95d9816dba4bd94199237453317e6bd905a31a69a4a773aaf96bb56f0968e7ea908ed6e69b1bc4af8689997dd4e4

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

              MD5

              827696b2ac3dd95133b79942303547f5

              SHA1

              e10bb6049abba012b2e74247954d7c01a742d1ad

              SHA256

              3ca829dea182fc4cfc59e478d504c7165cd87d2c5d61ebfe08033dd16ac32415

              SHA512

              6a77bc1b536d54465591859e7a9dcbd8c91146409312454595ea857599b2788f073d3740e29ff143dd8a07433aa1c8aa02078b8a392da96deeb6c332f065925c

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db

              MD5

              1bd8f4e72a7c8a0cb3299898761491b1

              SHA1

              34fe6eb37b7d7fef302814f282780c7e1a3d4f39

              SHA256

              bc3f6b0c90ac4d31d45bf2b7aada93684eaaa69869474bb23cc684f670241699

              SHA512

              2c28e60637c66001767599826a96c423d5d8ca3784f7bb08533d9ea49b8d8a375537e90563fee134347a5803e985dec42fce113efd894ada182991c3c2080b4f

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db

              MD5

              a72b1e4c6ec5518227519906475d688c

              SHA1

              3c8d63ce4c7aae36892bfc8b40a1630331c12abd

              SHA256

              52e848aefb0f933ed5029376616e613f73dc9bb26e2e7441af19f2a6174c144f

              SHA512

              855297c22208d05fe8e2f80419723440da9a124d60c39a2bef61b5730137b27063678678e1dbbe73ab156bdb630998e0dd3509ee7ce70e809b3068fcfc255707

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

              MD5

              8b4c91defd428700a8e1b8911aa73ba3

              SHA1

              64b21f6c1578c21f7a5f670d8b10f260cc45ba33

              SHA256

              756fd7c1f808d150b25fc5f5f3d57e9fa94af73aebcbc64c75e9e174ea32c6d1

              SHA512

              1eb2136811abbbb6f9c8a756da9b6a90e88aa06ddba2020e81eac7dc273af5e453ad4ff8d9975db2f957aca5a9d8993eb513368b7b5d38507763e29ce9c9e696

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db

              MD5

              6ac617206b2c9d4e0a77d84c7fe2a9d0

              SHA1

              fd3d9a72797388aad4b5599db0c242edb64d9eaa

              SHA256

              e30d7524e572e29ba84d8f2f7e44770b9a77703fc0697643f22b5ba9f268573f

              SHA512

              db11ccea20ca24bed7067221634409373de90b99f9b2c59dd3eda021512f38f34ed367243dff8acfa75fa600cca005e51df3c9a6ca09884c479244b308901776

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

              MD5

              3d695673d2e010c919f40a1485001e20

              SHA1

              ff0d577d1db971c3bd5f6b8fe827cdd76937298b

              SHA256

              bca07ae93eecfcb58a4e9cbbb17a4b646349592a20eb16ac196b3dcf9fcc5255

              SHA512

              24c997520c3e92525a803e966b013eb0a599c23c959b54f26a8676f83c784e5541171cae7df8415e7edd5e734bd3f716510173212bfdcc939005c6002b5e4808

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db

              MD5

              d9a3514dcb2e7001ff0a92fce9a222c1

              SHA1

              9e413b69372134a4b57bfd9c0bf037c94b2cb711

              SHA256

              95a1917925edbda33a839799be2ad4f2ec9d625b4c693930c75c338210f8f810

              SHA512

              d9674cba37d6398b7ddaefbef00005ff2e8536dee1fcad94e8bd2d010a452fed98ae4084112c60b765c79c1ba6aab4d08a66ae4dc696a7a619fce892e5b9fc1a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

              MD5

              e344a3a096e63358f46fdb07fe7e8a09

              SHA1

              339fd5ef7db59b787e06c0ed781f9623690558b9

              SHA256

              bc97ba5e737740e88a841052329046b8b64ed11b234a08b52c25ef3a7d8969c9

              SHA512

              3a84389712069c316949c834c3dd6678d9c805acf56a28a4a6e5d941b2473a3795ab07a6eebe8cf7843f5f1e4c9b028cc0ab12eadb750d9c4eefbae4fef8b2f6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

              MD5

              b102268261e4990677967751feb56c10

              SHA1

              67f03624e93fe7a830546af313ebfee1ceb0fb9a

              SHA256

              28417ee4d3838d7e503b6728d85e62a1e7af2b1b1081ad2c274d2e8120d27e0c

              SHA512

              05d90b49f78ae742a123f151ede7d5bbefc4fda05e807b2a5a17038f65f91e75a2d64571d63afdf0f8e665aa0c44013e4214f78e0915a449af2e9fd8aca179a2

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

              MD5

              586769220eb100cdd8eecc8fa4d4f6d4

              SHA1

              9234e8cfc9077771d259f5c0162981ee2ebb0841

              SHA256

              43d65562ad52e5d883ab254eb33636965603c7e233253794723271e5bf5cfe9a

              SHA512

              056714abd2838a661965dcc6dd6a96f0653f288d7eac56061fbf9020b2687c98b4c3fe95b118c072a7eb685b43c54b4ba4c5c324303af37f806086a141dec335

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

              MD5

              13eb5304faf3a4fea82cc4bb60041936

              SHA1

              6eabfb0609339f9e9b064095f75b378a4fe3f353

              SHA256

              a6a81a8185fcbd840daf7ca07fc252f4a1ee9c305a04d0b7affa1eb867e9998e

              SHA512

              badac679cd7b034481a56f0b7ca3cef20cd6959bb96c008e5b6e605c015655f4ec5a070394ebb50665275fd950b795f5833c0d1fa0cbe122424529c85bde46f6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

              MD5

              b15ea89154a0d7372bd3423ab8b0f917

              SHA1

              0052a7222127ac286e99fa8c987002e4fb29d26c

              SHA256

              043ace38950422a1607a6cd2864b242d3e23d4bcf6f91e9a1b5af8daf6db1b52

              SHA512

              3aaeb07b04a90a5b3524219027932e5e7a588e7b0e5db14872a3bacb9cd6bf863752652d85dee956d7f89f0018e3e2dbf76cf7b43a3db6610322bb377e290dde

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

              MD5

              cf5ca2faa9bc35102e0d48cf74d3f9b2

              SHA1

              a94d0ee5a20de172b52ba2819771453a4408061a

              SHA256

              13959ea2936f24f46188669aa86d828834d5d9e98caad9f93e7e75f90a7532fc

              SHA512

              cfaa5a3f7030e55574a62930b84a6e0c738ec63f02640f7204d7cb2e575b28cc927f699ecd6dd23f978387210783109796f989857dc3d045d624f5ba55b9f886

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

              MD5

              845d195d5fdb6b7a889c453920142676

              SHA1

              217b3921d91860b1b775041a3541ea1140ea3bb6

              SHA256

              853a56cbde0b18addf4a9a54682ebd9557f838962c7f47df520e65bd6a70f0b6

              SHA512

              c3219493ba189377868ffbcf54f6aa9d0f70f3d2f52bda0b7de2ced6ee99af0bc9e2cf35d9f6a1855a2a31e1bf455e98ca387e650f2fab074364711d252c507f

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

              MD5

              8b43d30d287b07c165726819a7cbe446

              SHA1

              5e50705fdd1626fd1d86210a02f94725745cb117

              SHA256

              b8ea4c497413257ad2d355146677a506719c62e9d2580430f6bd64796f06843a

              SHA512

              1827124f3163db5e3d6d2eed1a05212ac3d7b475361e28727dcfa06823e5dee92aecf196c11957486008b4806e3e24ac3130a8867ccd22b9532fbd8a60378c79

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

              MD5

              3301bcd7896c38decff9eba7b28e0f51

              SHA1

              d5fda0652a37c2d67373a5cc3e57f5d7ffe92304

              SHA256

              c72d7c8b74fd77444887716cb4a303744c243c29d409ecf35e95b4487b2c80b8

              SHA512

              f2825ab294844c9148431a32192b29aa4349aa13f450264e59c0b89afac7b033294aef64d916a20237def433e53d80814c17bbf1805f1c46d5cae56b97ac2442

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

              MD5

              1d1bdd0040f6c8a00f8ea74917cf0c50

              SHA1

              1b83299ebba7d26d0f5be0bac5ddfc9e2f7f00ac

              SHA256

              9d2d6a39adeee60dd6fea7ef582fe076052d2826c6dd7387ba8486ca4b068621

              SHA512

              f3abd4fe57f1644bb4276aabd082cadad76297d623d23ee7805ee7141616e3df6aea42a93e2c16edfd3db4872630dba0ec8e715a3c4d9b0a3cdf6b4454203119

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

              MD5

              ded01d5dd5fce85623e45a340e35eabe

              SHA1

              d1628d82502419f14fc7e5ba9f20e44635856e30

              SHA256

              cb3f5db3d5756c1ab7d1e4c0309161f7bdd03093831dbf005b07fd40b7fad1e0

              SHA512

              7bc7a041d23c530986ef172bc966be09829808bb3abc29d2b1550855b45ca3743eaca1fab480af8cdfb7ca36dfa2565f31e1255c09986a0c3212350e3bbce17e

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

              MD5

              f8fd42b4dfa5687bb0baca6849b7904e

              SHA1

              90cbfc8f02b21acedaa9082bbacc03cb39f42179

              SHA256

              04b2e2c28d76b764006c856808d4587820c7e96c1c54c7700717ca8c7e47539f

              SHA512

              ad0ee671e4f0a897a9ca88f242ed6e422481de659edd37a13b44c5f65e360d1a96c3df12649e434afd0d26f54d3d21d661a5ed4b0853fc117956774f8f2db06c

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

              MD5

              4268bb9eaeb18a4ec406af401158d5c6

              SHA1

              5121ad6d53c3255887c9fefd525cb835846596b3

              SHA256

              2a21c3fbff763926e4393a4f860d06aab501f8315516a8a60a015906168f1bb8

              SHA512

              12ccf1049065e67ad613ce3c340c83e3c97ce7b8522a186d0810fe0d6a33d6fb8707a1a8580858b2f47b78d527e25ac3101b31e6e921675bb40a8426620f0162

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

              MD5

              b54bead0ab4c186cc35c67312436085d

              SHA1

              e39a74a977eeb35c3df4d3e41aeae5c9d0c1445f

              SHA256

              866ab160ec73b0392c53957188c44cac6f10ef4f3c6a02efecb2c8b8185dd1d0

              SHA512

              127543bb181be7b63a60afb20d8dc724d2b17ced70203cd496fb4d104d356b3d914cf3ba0403bf60ca07e3a74860cecbb74d2cc7f32ca4615c51ec6c9089ee4a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

              MD5

              a0b220408442482c9895ba33f3a17bdd

              SHA1

              feb40dc647018c7bef715bb4e8fbb2ff0513d404

              SHA256

              ee7bb48cd07bc2bb6927ec9cc9662fc8ddc0866804e6c280db3b880107c1809b

              SHA512

              b392ff5bf5f6a441b8a8a6a125981676103281d7376946b3dbd344662e7de62f77a141018cbc724818ab1778ab351e91994d4d45f2371c479d2bf15fd997ae32

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

              MD5

              e60ba48ec9b270353b1aea16796c9a69

              SHA1

              11c6e04418f57440771720b9c57016f9b88f2fd2

              SHA256

              e99d36c0786a156d9b9f485a76e57b7d800e6de33bb65ef46235032d0285bab2

              SHA512

              81d1c6385a3c528dfd14c8c295cf500f667bff0886d181d2b5d23892510e707939acb4985d13971b98bb51fb147e0cbf057e5a28d748c557023dee69a7d20b37

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

              MD5

              8bc873d17f03e5b5c2aa0d02a2805a09

              SHA1

              e0820702ef43f3a2d87f6b09caf93f22efbeebcc

              SHA256

              841e1dba934cf1f0769a1ae3fa50a68d1ad1961913dd61123118ce70bde5c3db

              SHA512

              369783eeea97b56cbd93d01655fb0122fb80ee17ff5efb752399fbcce388b192f9d0b91c44012cc0499e8f863e31c71e70464e61ed955ef0b8701de293fdbe54

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

              MD5

              3d89741d354083604e7efec15fc32f11

              SHA1

              c8735d09d210c6583fe51ba1634eea96365c82c5

              SHA256

              711de2ff4e2ba408ae80053dba2bc830cdd90e252724eeb6662a62a8ae7369ce

              SHA512

              a41a8428f761ea58d70a6545525ed2e18e48108c686faabb83d93dab895555742f9bec5e6d8ac1b6250f3581c93ff3ae245fadbb7d7549ee3a698e1e0b053c63

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

              MD5

              d1712c25bc52a973913d093436e711e4

              SHA1

              c28043002cfa2ebb77123405cee6242bebee987c

              SHA256

              0411c2a298c164219a0808422b49e0194a720dc228bb2eca59a21f980b0071a2

              SHA512

              1f703a18c7db096dca0da15c0483828faec99bd610103196978465058a4b07cd3538736437890606acd8804c31cfd457e4e023f504a2c33817528dd56a954a3b

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

              MD5

              43cbd2b7064c31d3a61d4fce6c7c0b3f

              SHA1

              426b7313bd319f1bc0532de8da1f3fb8a116c3cf

              SHA256

              df4a66281354824c1813cd49376170b07eac2902c1ae46753d63e84b8c1ad49b

              SHA512

              ac34a526487f7846cb603d7482dc7b0a240fd1d8a45ec4061938bf342488b09952ff926ddb1e9ec52c45a4c2ab71d8b40951ba30ffceda8ddb5a1dc9cdd80115

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

              MD5

              4018c78a9b97f624a7bab1d500702151

              SHA1

              7abc3a54e1aebcffeef900ba1fd25333853ffc88

              SHA256

              5d1fa89c07a450d784ab8a7dacd816c222eda32c755dc7622735e45f753283e8

              SHA512

              fd63ba48158a95e74a05879c779386807f5c336d21a95057969aaacde894daf876439fced204ce71ed092f17ddbc847a265f9c8cdba0a07257d2a0e2d5fc5b0a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

              MD5

              8aaafe05f0037e2fb48341cec1e2fe70

              SHA1

              a9d68acddc8479cf2fb8d73bb929d1ac75245a76

              SHA256

              1eeed8e699d4531c403f4bf8d206da5c24ce981f2bc1fb35c5034966afac7593

              SHA512

              12c2a32b199098405db78b0a387d8d5ee11034f7768bdb49dc1c3ed20195dd9531c946b45b8a85d193bd4f81357c49a354ded565133d82832c780f63f2a94600

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

              MD5

              0a03f3f8811510247052378c6de8be19

              SHA1

              6b1a392d8602017da805d4f0aae5cfda0ef81880

              SHA256

              73b169ccc60b13209a45312fe6b45fe59943312bf525de0e6e16a8806cc00679

              SHA512

              b2e05ad433d2d725dff7b05ec4a39b6e3cc6a3377c598ad3231a4e9c6e4697863a114c22d38945dbb23fc168d714d07c52850dc6f4ba3905438736a42486f2ab

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

              MD5

              dce64e4bf676adb695d06b564320123b

              SHA1

              06bbb3b82b8903c86f5b7687670530f7c0d99413

              SHA256

              1c1facfe6979033765f98079e14562154aab5a01f49d66896717c8dc8c61eb71

              SHA512

              1fa65893b5cfb43fba7fc0d564f076e869a413612c3ecf6fb17f9e92d924f410d045241eee42f26cebd8e244c4db0c9c15427af93d3eb7d1acad29e29d8de5d9

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

              MD5

              cb644b03e6133e99a44e75b632d2b9ab

              SHA1

              30fe33c2e916348a2691237cffb7ea5e973d08e2

              SHA256

              6998f3944bb4ed0d435e8d78dc074ee1d42e6641f52e0305882d183ce5d47d9d

              SHA512

              367ba5d73bc3282f6299eb1e0a6ac8c2fcf1edf8d13923aa606aff273ead4143c57dd979ed52ab893c5e5beaaed6ed6d94bfc31e0939fbc67b3129457ecfca51

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

              MD5

              61f6348680dbbca2fe96e2de60eefeb6

              SHA1

              050e89515b7a8cbd87ab675709bb1ac622c3e1a8

              SHA256

              6b3bd1c94ae41b7e5b4279e9475994c85cb05ddc2e955754d6eabab2f786f4bb

              SHA512

              08930003b9c9515192dab338a3c135150e9bd3161c352b851611f32cd2a15bcf9b8ead09a859d1afde51200eca160745ad470b3b75cdd62f5b4d94570f948a6d

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SIE944HI\microsoft.windows[1].xml

              MD5

              e94b8a5d35d636730f3c29f67305e6f5

              SHA1

              8a97ba7ae2d54871ab2312237b1a25c92237d369

              SHA256

              640d3e5013c28900b391ebc5f7ed90d9a65a98a595f8f024f26f4829c00912b7

              SHA512

              79e0082282227149c39163fc984d802187a8559e46e7febc602a48ebc19a6396c65b962ae71cb7300baf7f53e4ddf5a73107ca9c03b1e819422a7ac19723974b

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\UnifiedTileCache.dat

              MD5

              0c92293a7632cd1123d19863661a9ab6

              SHA1

              29845770563c15ebbe34e2ee15e0aabc5ab72c87

              SHA256

              6f851a68da7026d18695e83c489a6a769adb9907a2ebb4887b95ca9efc0f4ce5

              SHA512

              d730ba0f97b8698f9d3f2f59c626b6d80939fdc5f511fe3eb2344b0a060ba6585a4b75071566797fe32d0b7e71afcc25e48f67c53dd0ff3a11ce3059bd72f655

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

              MD5

              a1cce2677b85618291aff881f9100c99

              SHA1

              f970945ced732a34c3a151f656d7fa93ef66f315

              SHA256

              7cdf960545eda0e5df4d6471054de40141bc3d747f2578ca9193c9b295ef5cc8

              SHA512

              b7eb904e155e9643f249551a8343998284a561ab5cf1fa71d89e7e12b7f7a2e565486f544fd7d55cb81c67fe67376b5e0cccadff7be6a4b0a5e7bc528aa9f25c

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

              MD5

              88cc55633d468173e1d8f18a23820807

              SHA1

              768a590353fb8399d7202c89f1baa54f22cb61f2

              SHA256

              3947ed1f1dbd7734d64baad97b0e6653b13fb337b1e201127c7bcf7b3c7c6f66

              SHA512

              f75fd9b128e063056101ffc99c21b30cff3f56c39d8ad7b94ba1ee994ca2bfce0a716aa24180230ea218a83087375916595cca7be2815ee103ba76e17e5374b9

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

              MD5

              e5ac8bc077c81a3b4d01d4ceb5c954ba

              SHA1

              37d63611be8b5d5b412bfb45641482ad1a690076

              SHA256

              f9d1e8bc8c3f111c67052d28ceeefd015244fa1c17ada6e9aba0387e3870f1b0

              SHA512

              6280b0aa2133fe57037f1ab1d5a2c3d0f049973db4be573a129caf619a1c2cffc4d6e6fa6e986e1c4b28e5378b8fee8f1108cafd9dd5c475e5b998ecab1275c4

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.[E2B9C823].[akzhq412@aol.com].makop

              MD5

              358647228c9d8a556a703429a0e905d3

              SHA1

              4827ed79c9290f8515348bb8b223fe7f9c5031e4

              SHA256

              e443c21ea317f897a8507a97d320bc443ea93215379081390668f96a1b7d925f

              SHA512

              aed0227ba327ca05f629ac74a987797e000df2f090df75d1fed97f70b24b6200a257e940b7c39917dd6b9b131fc01910ba9a5302d374fe80acac77d055ca6ac6

            • C:\Users\All Users\Microsoft\Windows\WER\Temp\WER2259.tmp.WERInternalMetadata.xml

              MD5

              b7f331a2e66de525c9b19af9a54c2757

              SHA1

              6395c756819cb20310700da338e7047fea737c86

              SHA256

              5bb43360ee0c9883ee0b146fdcb49470f014f7859f96be2bbe8de268e379e110

              SHA512

              abc1e073a4c06c8ab372dee4dba27df81520265c7143babac8bcb68c8dff30d7f742ef826090cbffda54493dc1597a2c8d6fef9238e5f9532e53a1309d46db01

            • memory/1300-4-0x0000000000000000-mapping.dmp

            • memory/1344-3-0x0000000000000000-mapping.dmp

            • memory/1400-5-0x0000000000000000-mapping.dmp

            • memory/1404-0-0x0000000000B29000-0x0000000000B2A000-memory.dmp

            • memory/1404-1-0x00000000024B0000-0x00000000024B1000-memory.dmp

            • memory/2008-8-0x0000000002670000-0x0000000002671000-memory.dmp

            • memory/2008-7-0x000000000096D000-0x000000000096F000-memory.dmp

            • memory/2008-2-0x0000000000000000-mapping.dmp

            • memory/2936-6-0x0000000000000000-mapping.dmp

            • memory/3544-9-0x00000230FDB00000-0x00000230FDB01000-memory.dmp

            • memory/3544-10-0x00000230FDB00000-0x00000230FDB01000-memory.dmp

            • memory/3544-12-0x00000230FF170000-0x00000230FF171000-memory.dmp

            • memory/3544-13-0x00000230FF170000-0x00000230FF171000-memory.dmp

            • memory/3544-25-0x00000230FF6E0000-0x00000230FF6E1000-memory.dmp

            • memory/3544-26-0x000002308A570000-0x000002308A571000-memory.dmp