makop | 7405d8aafbe729e470d31e0cbf9badf3a99b65256d4b9aad81c9f197b9ba7886

Analysis

max time kernel
149s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
07-12-2020 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.bin.exe
Size

26KB
MD5

f74616a400973b5d1a5d8c039817ff03
SHA1

2ddd74b84fa10350f4435967f7b1c7a3c82ac124
SHA256

dc9fed631827723135571dfd135b442f2cad1cfa822bd7d4edfa757e2c3790a8
SHA512

9299a16cc30e342ba1a882fcadeee118425997a808e73a994b08aa7351c38be8bacd7ea97eadbc850694bcb42b49ecfa8ff2648eafde41c565eaade42c95a5cf

Score

10^/10

makop evasion persistence ransomware spyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "CARLOS" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: carlosrestore2020@aol.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

carlosrestore2020@aol.com

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description pid process target process

PID 4036 created 580 4036 svchost.exe 1.bin.exe
PID 4036 created 580 4036 svchost.exe 1.bin.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2660 bcdedit.exe
4008 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1352 wbadmin.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

description	pid	process	target process
PID 4036 created 580	4036	svchost.exe	1.bin.exe
PID 4036 created 580	4036	svchost.exe	1.bin.exe

pid	process
2660	bcdedit.exe
4008	bcdedit.exe

pid	process
1352	wbadmin.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\SyncComplete.tiff	1.bin.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterUse.tiff	1.bin.exe

Drops startup file 1 IoCs

Processes:

1.bin.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1.bin.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1.bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.bin.exe\""	1.bin.exe

Drops desktop.ini file(s) 72 IoCs

Processes:

1.bin.exeexplorer.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	1.bin.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1.bin.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	1.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	1.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	1.bin.exe
File opened for modification	C:\Program Files\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1.bin.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1.bin.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	1.bin.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	1.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1.bin.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1.bin.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe

Drops file in Program Files directory 18757 IoCs

Processes:

1.bin.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Microsoft.People.Controls.winmd	1.bin.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-unplated.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-200.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-200.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-72_altform-unplated.png	1.bin.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll	1.bin.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-100.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8201_40x40x32.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-16_altform-unplated.png	1.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ci_16x11.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-fullcolor.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-200.png	1.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close_dark.svg	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\settle.scale-140.png	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-24_altform-unplated.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Klondike\klondikeassets.xml	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5613_48x48x32.png	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-100.png	1.bin.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\ko.pak	1.bin.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\sqmapi.dll	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_11s.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureUIStyles.xaml	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.VideoTk\InvertColorEffectPS_UV.cso	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsStoreLogo.scale-200.png	1.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	1.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	1.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7260_32x32x32.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-125.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\pages\winrthost.htm	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-white.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	1.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ui-strings.js	1.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso20win32client.dll	1.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-125.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\EmbossContour.scale-180.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.scale-100.png	1.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp	1.bin.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	1.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png	1.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\MedTile.scale-125.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\9px.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\themes_frame.png	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-16_altform-unplated.png	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\resources.pri	1.bin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-400.png	1.bin.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2444 3040 WerFault.exe

pid	pid_target	process	target process
2444	3040	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exevds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3612 vssadmin.exe

pid	process
3612	vssadmin.exe

Modifies Control Panel 5 IoCs

evasion

Processes:

SearchUI.exeexplorer.exeShellExperienceHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\TranscodedImageCount = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\LastUpdated = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	ShellExperienceHost.exe

Modifies registry class 34 IoCs

Processes:

SearchUI.exeexplorer.exe1.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	1.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e4070c004100720067006a006200650078000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000002516120098ccd60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e4070c004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000e1efebff97ccd60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e4070a004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000005aa40d5557add60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132483827320340134"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

1.bin.exeWerFault.exe

pid	process
580	1.bin.exe
580	1.bin.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe

Suspicious use of AdjustPrivilegeToken 99 IoCs

Processes:

svchost.exevssvc.exeWMIC.exewbengine.exeWerFault.exeexplorer.exe

description	pid	process
Token: SeTcbPrivilege	4036	svchost.exe
Token: SeTcbPrivilege	4036	svchost.exe
Token: SeBackupPrivilege	3192	vssvc.exe
Token: SeRestorePrivilege	3192	vssvc.exe
Token: SeAuditPrivilege	3192	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe
Token: SeSecurityPrivilege	3792	WMIC.exe
Token: SeTakeOwnershipPrivilege	3792	WMIC.exe
Token: SeLoadDriverPrivilege	3792	WMIC.exe
Token: SeSystemProfilePrivilege	3792	WMIC.exe
Token: SeSystemtimePrivilege	3792	WMIC.exe
Token: SeProfSingleProcessPrivilege	3792	WMIC.exe
Token: SeIncBasePriorityPrivilege	3792	WMIC.exe
Token: SeCreatePagefilePrivilege	3792	WMIC.exe
Token: SeBackupPrivilege	3792	WMIC.exe
Token: SeRestorePrivilege	3792	WMIC.exe
Token: SeShutdownPrivilege	3792	WMIC.exe
Token: SeDebugPrivilege	3792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3792	WMIC.exe
Token: SeRemoteShutdownPrivilege	3792	WMIC.exe
Token: SeUndockPrivilege	3792	WMIC.exe
Token: SeManageVolumePrivilege	3792	WMIC.exe
Token: 33	3792	WMIC.exe
Token: 34	3792	WMIC.exe
Token: 35	3792	WMIC.exe
Token: 36	3792	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe
Token: SeSecurityPrivilege	3792	WMIC.exe
Token: SeTakeOwnershipPrivilege	3792	WMIC.exe
Token: SeLoadDriverPrivilege	3792	WMIC.exe
Token: SeSystemProfilePrivilege	3792	WMIC.exe
Token: SeSystemtimePrivilege	3792	WMIC.exe
Token: SeProfSingleProcessPrivilege	3792	WMIC.exe
Token: SeIncBasePriorityPrivilege	3792	WMIC.exe
Token: SeCreatePagefilePrivilege	3792	WMIC.exe
Token: SeBackupPrivilege	3792	WMIC.exe
Token: SeRestorePrivilege	3792	WMIC.exe
Token: SeShutdownPrivilege	3792	WMIC.exe
Token: SeDebugPrivilege	3792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3792	WMIC.exe
Token: SeRemoteShutdownPrivilege	3792	WMIC.exe
Token: SeUndockPrivilege	3792	WMIC.exe
Token: SeManageVolumePrivilege	3792	WMIC.exe
Token: 33	3792	WMIC.exe
Token: 34	3792	WMIC.exe
Token: 35	3792	WMIC.exe
Token: 36	3792	WMIC.exe
Token: SeBackupPrivilege	2064	wbengine.exe
Token: SeRestorePrivilege	2064	wbengine.exe
Token: SeSecurityPrivilege	2064	wbengine.exe
Token: SeDebugPrivilege	2444	WerFault.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe
Token: SeCreatePagefilePrivilege	1704	explorer.exe
Token: SeShutdownPrivilege	1704	explorer.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

explorer.exe

pid	process
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

explorer.exe

pid	process
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ShellExperienceHost.exeSearchUI.exe

pid process

1144 ShellExperienceHost.exe
636 SearchUI.exe
1144 ShellExperienceHost.exe

pid	process
1144	ShellExperienceHost.exe
636	SearchUI.exe
1144	ShellExperienceHost.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

svchost.exe1.bin.execmd.exe

description	pid	process	target process
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3588	4036	svchost.exe	1.bin.exe
PID 580 wrote to memory of 3024	580	1.bin.exe	cmd.exe
PID 580 wrote to memory of 3024	580	1.bin.exe	cmd.exe
PID 3024 wrote to memory of 3612	3024	cmd.exe	vssadmin.exe
PID 3024 wrote to memory of 3612	3024	cmd.exe	vssadmin.exe
PID 3024 wrote to memory of 3792	3024	cmd.exe	WMIC.exe
PID 3024 wrote to memory of 3792	3024	cmd.exe	WMIC.exe
PID 3024 wrote to memory of 2660	3024	cmd.exe	bcdedit.exe
PID 3024 wrote to memory of 2660	3024	cmd.exe	bcdedit.exe
PID 3024 wrote to memory of 4008	3024	cmd.exe	bcdedit.exe
PID 3024 wrote to memory of 4008	3024	cmd.exe	bcdedit.exe
PID 3024 wrote to memory of 1352	3024	cmd.exe	wbadmin.exe
PID 3024 wrote to memory of 1352	3024	cmd.exe	wbadmin.exe
PID 580 wrote to memory of 3628	580	1.bin.exe	NOTEPAD.EXE
PID 580 wrote to memory of 3628	580	1.bin.exe	NOTEPAD.EXE
PID 580 wrote to memory of 3628	580	1.bin.exe	NOTEPAD.EXE
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe
PID 4036 wrote to memory of 3172	4036	svchost.exe	1.bin.exe

C:\Users\Admin\AppData\Local\Temp\1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\1.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\1.bin.exe" n
2⤵
PID:3588

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3612

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:2660

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:4008

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1352

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
2⤵
PID:3628

C:\Users\Admin\AppData\Local\Temp\1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\1.bin.exe" n
2⤵
PID:3172

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3040 -s 2288
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\explorer.exe
explorer.exe
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:636

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini
MD5
8f143509591d6a92376ddb7e20ffab21

SHA1
d7608c202f79ec5286cebcb1219dd88db0aec5f1

SHA256
34293149af8549959ecc0e730ecc877deb714a9eefea004626a3f76160f4e924

SHA512
788a4320a2d7703364b6b093c195d839e066ede963d951f18848b4520a5fae80dfbd91fb39ad18762ac4f6df3dbc58f74e377e6355d1fa49d5611ddefa576831

Download Submit
C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini
MD5
839d24d4227171fb05174dbc5ec3b684

SHA1
0b95001ebd36696bc4d91dc70954015f446f39eb

SHA256
fe2432e3651cace7ad850dafee6e93ecbee71de9cd2af3cbf4a609dca44980d0

SHA512
b6f3ee6b617b91d3fd7bb7c7b6cf473d91c1cc883f792b1238aff3823454180ccb541ac8fea70951dd872c7fa7fc15a5e7872ab734bda3fc8751538b164eff38

Download Submit
C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini
MD5
839d24d4227171fb05174dbc5ec3b684

SHA1
0b95001ebd36696bc4d91dc70954015f446f39eb

SHA256
fe2432e3651cace7ad850dafee6e93ecbee71de9cd2af3cbf4a609dca44980d0

SHA512
b6f3ee6b617b91d3fd7bb7c7b6cf473d91c1cc883f792b1238aff3823454180ccb541ac8fea70951dd872c7fa7fc15a5e7872ab734bda3fc8751538b164eff38

Download Submit
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_06f9e36b\Report.wer
MD5
15e34b8e971d33c18d0c7eeff02c6065

SHA1
ae2179cdb1e27a5e6af2a3984b0fd13862eb7a86

SHA256
aa3660d5be819f6b98938e1947f9f7a58dfba3869e93e9ef4ccad5bfe4f58acd

SHA512
1c8bc76507e0fac782eb361184b7c8a755dd99920657fe463cf3dd956f972fa2fe462e6f2d67ca75b774d00563e601a204277d756f5a15825fcdb4c6e5810f72

Download Submit
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_06f9e36b\memory.hdmp
MD5
96e09d72800567c8145cdb3cfb18e25f

SHA1
2edff8a3a543dba98b5ea7830467b72d0f002999

SHA256
ad8ff2ba7501316b4bd23d0712c8b44d7f8a4d718c8ba1d6a617a1b9b839848a

SHA512
83da6ac777795246ec9dd3a78afde0a5c3d05dd74c8619caab81e487ead992ced714c2e8aaf6e27c5920f771bbda207e9d53824e7cdca10ff9ac856068b93338

Download Submit
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_c6ca591eef4409ae8d6c1c735561eafe9a96f4_41822faa_cab_06f9e36b\minidump.mdmp
MD5
b74903af506950b9b6b0e49aa52eac1c

SHA1
43e7800a82463bcebf5a679f59c131952671b818

SHA256
8c3de00eb0765f222b1530327d5f32ddad977a9ff4fbf5c843c7b6557a4df16b

SHA512
e926afd7d7a85631fb039033d273f8c5478e6c3b9f1b822f2ef46cbbf9e3e48ef7d96b166ceb4349c0b6697cd44cbe3eef04a0d4cdf2e544b4111170f9f86883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
MD5
08ada02ba6365b88b47bcc91d47d7fa3

SHA1
001e9f17be73e6703991f672c5b48272082bf21a

SHA256
d95cf49a088c0dab2ef4d9cf6425f2bb42495d293ada539fe4a1d3404cfb8004

SHA512
e947c813ce5df7ffda1a3855c172ba124881280f589e7e4124327fbccf2dcd5207e6fa7e0dae736b2b8a0f8b56a951183762074253954bf342ee049c3ce0fd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
MD5
4d75ff328c0f1aed8c6d159c93343ffd

SHA1
7ac338a0a4a5b3773d9e34894650a401bab5fc70

SHA256
caf9e2cbd4ecc751b862da19dd51fe37ccc2c484eef583658d6248751d370f81

SHA512
7d95ef8fc91fee6f0f3e9ceffccab565d8236863045742bc86557fd6439ece749043ef25822fcb04d2838ceeebc05961e2cda7d60ed55eb64e4b44f5811bafd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db
MD5
b34de88d9a0163393549cf16b1e0b9df

SHA1
d1040fb250a59d222910971d6f9e7e6a9d6d9636

SHA256
623b037d1b7a238efd65afa586adca6ac7faffec95e4fba0dfdcde4fb01d4d8e

SHA512
5d77ad7bde2c8f13b43c3274c5c031ca4becfffb37acef882e8ac218d9407647330c81476102dcf1354614fdfa6160c0dc8f00aa37431aa6d938e7e8030a025b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db
MD5
accda0d1b2e2458345d1ced8654c59cc

SHA1
c688152712d6ec7288d9a36da8f4b93911c17529

SHA256
f305ce514a589849c84eef231271d4a917e021826446c76ebc7d4a96ba8d9293

SHA512
d6f9bdbcb4d60aefa92bfdba6441b1121d29dbd8193aea27060f9faa53f03e313dc4d2bb2b3afa5dc31e1655eaa57100110799af251586529052a8d1a629a8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db
MD5
8e62d7c3fa76f60599680c2a66becae6

SHA1
677acc8a30bc6d8cb7295f66897d1c3fbda8b45a

SHA256
95dd3c043f2298678eb45218958295a0d2ebf21d5f293cddf606c53742300c66

SHA512
bf5e7e02a0555ad3c35bc0355ccc5aec172ab13fe449cf51aeeae63767fd9fa9cdcfa0ff1161291c38cb71340489d6790cb4c6182efc73bb16f972048c4bab66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db
MD5
669375049bcfc5534a997805b41f9ac9

SHA1
e653611da85df61066fbb26481d56d6abd263f01

SHA256
2526fdf690317c5fa23c459e382973750e96a55ef2650003cb3ecf4c416fffc7

SHA512
533c2464ae8a69960e2ca8970ed845d746e887e40b3ecf47ea3d37d465a20d76f7f8756988d932eaf434a39558af711ee0b548751d6a86a131f7a7e7fbaab197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
MD5
101c44c3ea224b4061270102be84b76b

SHA1
54ae4a7d9949de180360a26387bc79496ac2e561

SHA256
1a7f8f4b829decafdb8b31bce5f55955a2aa41ec20a39c3b0fba760b52392ae3

SHA512
13a50e7c3f3eb8b86713cf5d0a9dfef03f8effae951b8e3b458fd29315d1ba65cf27028ffc64c2b50f77fdaa25b685291fdc6c7e41cac5cce78a3c9010acd141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db
MD5
50874d5380d9f77b4a6ea295fb7066d0

SHA1
b4b8f45cd986aba9e46917cac7b296abda225d3d

SHA256
7bb84b86336cb40826bc2b7215d8bfc9505fd11733b714f8d99ab95eeabce9af

SHA512
9d7d220dc1d2759cad2aabe8bbf658db9f38a3895a35098078a126788511f3fb8be654cb10d689279988250a5602c2e3bd3c9e88d33ec5c08f58e4b3fc5707a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
MD5
421ba7ed239de5a049ee037e125e5eae

SHA1
3c98d52448a1f796580c96116446e058da926e0a

SHA256
328c34e2997bef38395c742b7ac13ddca9a4c1517345a2b2fde878e968b0e518

SHA512
0c559fab2a11e34d6a94d1fd30fee3c9bccd3b432785dd62b8e5b42dd94a81d923deea857854ab89e837663b0427eb3972dcd139f1be1a7a3a4cd3d37cb37b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
MD5
c62b41e66176e3cf475b637227879045

SHA1
e693d1481d73e881a5ea22349565be0b04b6df2e

SHA256
ebd486aaf0cd90e5d4d1d5cf7adfecd8a70abc5417c45fe259c957e7a218fdab

SHA512
077e263400113b31bf081fef4f2f16a6b81422bc2af7d8cfe8de6396b14b50898644da876ebc6db543249246d814d2708be1977f640eccbcc4bd424e1115f6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db
MD5
4c9b650d30198113e5d9173941655313

SHA1
322adb992840a1f52ce0e8ba9a49679f8caa918e

SHA256
5289cb251819dcc482440d2b26f268d36be5662b46feb9832516b4668b2dcb60

SHA512
2555d620f4460a138746ba06ab47eb55f251580dca60c46e57734ecbf4837b1a8734e24def89a018bbd6870177ce412a0cc02af48df5df84f87f8651f69fc2f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db
MD5
3069c48a48626b6818a7612d742058a7

SHA1
fae24634bfb902217154523061f1fcc3e125810f

SHA256
263e0902475e1ef0d3e5386a539bc4eabbe390bd0532722fadadc35f72a7faa4

SHA512
2f48d4941f20e3002ee8bfffb8e9ad220c6d03a4784aa3e1d5c3a8b5c6166f964a81b7fa6b92881271f6b590abcd736ab7d26370bd18b8c559ef746354059011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db
MD5
8dd257281ead9ca6f005a19a65aa4606

SHA1
6af800aebe6dde4b7b6c4e09e6ab8344ecba1526

SHA256
17474f904e67da95b35ae0ce4de69c915d1d1fe5cde73f6327f873df299dd8f7

SHA512
39bbef1af86b2ff6d5de044b2faf33f78d0c337f49c9545d4b7ac1c8471c40d58d8a6b04dc1664aa46c0ffa301d4440a8230bd0631184c1f97dcc02de42ef646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db
MD5
ccb1ba9ae1aefeb1a0b6d56cf3a93c34

SHA1
d0a246c21a5b5a920d37931263cbb5d8505e7748

SHA256
5e452a4a8d5affec8210ed537d3e8dbe699b94efd0aba6862dc7831e917154f5

SHA512
c28b3ca45ece3100fa1953e77a9b1b4f0195688c25fe81dbf38c7d0553be0aeade6e53b2d7192f7c3a6bdb7eaeab5ae6a932d5299732940444cee3b13210cc2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db
MD5
d8c1a59cb35130e0d9d71c700820ba59

SHA1
f1f4b5bc780538f5a17b361e61bd6f0a8922074b

SHA256
2b4a7b399925428822ac32ad2a310d4f7441fec3361f8f8f00a0525067657e0c

SHA512
72c9df56f04618484e09b2c4bb709dee6e70e2f0ac3962725b716778874d341b5852f0e42825c0722130d76369e650580c9840f4104f4db576006bb6e66cb1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
MD5
6125a045c42615aec214a557930d5868

SHA1
b560897b13220ddc542dbea15210b153a8e71676

SHA256
11b09a9d2d2322e2e3d0122d6f0b8ac5446f06b9ecfa6a802d43f0e193032272

SHA512
0461ec28f4d60d70f6b3d842f39c8e35f3dac1ad28b4c5a41337675d4f3c91f012ef077975b60f5458220f306abc77de5700e88184b88a0a3f5b7c4f4c335bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
MD5
7f141051b53af10aca7937af997ac229

SHA1
0d1bec0530c36872ad9d1d8120d16e485a790aea

SHA256
86d661c4fecd53e405550a92e9273cd15bc4a21c739cec39e86c8f60c4f6ad66

SHA512
b33037671e3c64f0a488470f3e019e09402a1d8e392d5a9dcba63001183e33ea119914bcc2f40157e75c282e7139dbdd0013e623209e03e2e28d149730d4dd56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
MD5
cec891741c317887a2d3aa4ae87230be

SHA1
111dbfa92142571daa44c914238062991302cd9d

SHA256
ff72adfc8cbee6f6d505040d91af6b84977d3598ad5c3cf1fac2a129c50e5ea7

SHA512
951d3981c5a2d40ef84613601338adf8f521e1b7bbf3779a4282b4ced9a2de669fea548f2c293652e206276d4c45e955aacb6f4faa499e9c780fb3aa0fdadf03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
MD5
edca23de6827d26de10405a7404a9815

SHA1
faa338b59d5039bd5f009464a50e37996108a0f7

SHA256
8441469c9471f52710a86de0419a54eab9afb8836e1f3349c993abb09520a5d0

SHA512
bb630365ba7280f662f7ff8a7dff3ca93c5b74527ec78cdc785705c35e70d8c1b2baaf29dad154d49d85be686aea982aa2f46b2d81edea6ced01d8cc2daf5095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
MD5
65f9ad5faa670cf9a1ad60b67417a2c9

SHA1
c3f5665471461947fb655e63c765761cad1ca911

SHA256
f3e0ebfafb0fdb70c5737cf889e9b5d9a50009dc186b4c07c1df6b8758c0ad0f

SHA512
eba0eb17914e44ed2eeb20acddee405204fa9aa1d7d248b267b267dd6e523ace596fed810b9f58ab84c7e0957d8d48a22657b3e06817f1a12e54223827a3c6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
MD5
06026ac3b69e9b89749ff470f5d93a06

SHA1
67154c08b93d6520c2bf50b386f61a4b70cf01ef

SHA256
bbb6e087f5adbb4f86123afa236719e56cbc5366d017d0f3b2d81fc0bc26b672

SHA512
08ead4bf6ebfd07263e5b4f6b026ebdb19a0f75e341fc20ff489b6eeda71fee7d776b9cb0400c01d2908bcfe3682ae48dcd8b7dcbb840296092e990681ec69ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
MD5
fbc58cd31edd26f96ef17f5999c253dd

SHA1
0888b9226de23f251c3c7bf51281cad2f1b17821

SHA256
6ea8f37312f5570fc2e35876dd3106151e493fb312389c8ec021a15d0cef5e51

SHA512
cae14bfdc895ee3583c3c53e12cc6d7c342abce72a8f0a6fa3dd38a84c66a7ac02b0c07ffb3c6ba0860ce85443991dd4344526b7496e2040bf7c15f1d69301e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
MD5
d9bea394e6c0a090e043e855a7ef8d53

SHA1
287ecb1c788b35c2c6ca3ee2bf9c1d88188b9ea9

SHA256
bf419379dad6caf357b96774249f37d6f1e2ae9009b52843bc4c8e1b2b9a9f15

SHA512
1a6bfaa692b9484a1261c981859663600609b7d28e60ff56c30ca3dfa9fbcd32871dbb6a91137531a2c9281b151c1fbaeedde64c7e749dbc4a807e3de52a6e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
MD5
ab9fa8c4f889efe297368ec59a727906

SHA1
536c201bbf46f405ac224466f164f90c520d17a8

SHA256
60af110448e040c763837e6d664433039073cc0a90039b1bae7c450300f233e4

SHA512
c54ee58a14137aa0f9e734dba63d02221a8cb5b76661004ce1c57c7627bde8927036cd4d44d6bdbe85b7cba09882f8dfd8297180a17badd1659aba991ce06a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
MD5
25d450d890a5f0106de17609ce654338

SHA1
58e50a5e0252081b00a52d3cae8819554bf54c0c

SHA256
f71b90c21a402a74961b787297f30188871c1989c9e4485af77d680d4c342551

SHA512
47699b2d825555a356a313b4d62656133036657f8e4c031a737e8402c9f4e7795338ad4bfcdbdc599b89a1a8370186fb1d3419a04b5a07d5db7a086d2aeadd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
MD5
b562c038583ac4f88354e0d8b8d19a29

SHA1
7db72f3db3e953401886775e8ec9d390b6c46634

SHA256
3c4073cf8ff222eaba38b2c4858ffab67e04e8d01bcb4fda08ff978559e65a8a

SHA512
c9d727e03fa12c6528b903b7c9ff9161275e20772f4b2222343af74cc8bb7960a8bbf4fac22b5d4751df835b09073b030d7c60998894bf6f1bd6b17e123b3a6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SIE944HI\microsoft.windows[1].xml
MD5
1823d5d727d63612485f24b0409371ee

SHA1
833e22f5212c72fced763dba90fbe0666584e449

SHA256
7f7749e80ca8438672053b8de5b60ce0324f701d984bafee739e1df46a15accf

SHA512
17e4e109c7ae1ecdbae720dcd66978776421a1f67757bb772b59073a2f97d6f465f3fdd8d5f8e91b95c8fa48bd0d18e72b32e9290a8f8230900a5d703e7549eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\UnifiedTileCache.dat
MD5
3d731432119b286cad6053fca9513b05

SHA1
906e447a8eb82ac94fa58713f4a5c77d80000192

SHA256
9fb324cb5a879dd92f402c5210ecaca7be7905a3dfec1115bb605fe38ef6ac71

SHA512
7bc626d232866a44bd47f6ffbbc63126df45b4c40b76e027eadbaebcf8c847fc6b1a28b7c7e74e9dda2b49b4cc8db5d994ca80d18cfe257e16873e3e03e78e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\WERE254.tmp.appcompat.txt
MD5
91cf86d69e3b74d4fcf1380cd790351a

SHA1
1d5addb8efcc2c671d3e8f47f395a62b107007ad

SHA256
16c0c58d87f53d77e6288cd248a2e833a77be1a88b071a27ef2205c89b2371a8

SHA512
87bfd08714081b83e0c9895709cb3b4d8457ca2806d82e5ffa6dcfd4496d8e00d01a4cf8f62c3d181fd7a4196dfb48401ccec43d0d6b68ebdca7306aaca7d6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0854BA13-7E24-49A5-9968-7E341EB0EFE6}.png
MD5
58de235e342faf4fa126e847fe1125cf

SHA1
a2ee44a5a392edb14b0efac0b125d629b140ceb7

SHA256
76d639a51fcb29ff613b0398847abfeeea588ddfe5d96c274a0ab0b9d50447e0

SHA512
5fceead6749fee3d82c6069972262a2ca495e5e1db7b5d6bd3ef14434f81be99a93cbd9d66d835529d6558efa6d0e496fb57d83250c81a014e676d2aee0d971a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
MD5
ce94cc5a22167ace27124cf1cea8d6a5

SHA1
8475cfa66a9f81673532380abb2b60b536995f19

SHA256
576d19c0dd6f8bd56d723844d2e64aab084b342d67dac11cf79d2929bf13cdbc

SHA512
426bbd661817b34969353671a5be5812b5e33a6a245f42357d5886f903c3ae3f0e73195e04175f048f52c3fb42546091ecf6f048674a53010e02987c059539fd

Download Submit
C:\Users\Admin\Desktop\readme-warning.txt
MD5
a070b8e37f3a29de5c5bf7ac37641991

SHA1
bcc2f5475096250d4de73e8fce8d90bf8d6899ad

SHA256
e1712e942e5f08b5206d610cef1dc3892219fefecac8cba574df177f6972188f

SHA512
96afafa11f5c8eac46b5cbdcf2542847ec4e587defad72b8fefa59a92d991fe21c9527ccdedc96e28946be6ed75f9bac14d25b69ace6fba96ce347a5c9ff50c3

Download Submit
C:\Users\All Users\Microsoft\Windows\WER\Temp\WERE0CC.tmp.WERInternalMetadata.xml
MD5
0c560227bdc62179bcfc9d8046bf1783

SHA1
a36fcbe7b685836554ffbe283034f1013c2f40a3

SHA256
82e1911c41ad5535c6355637e5b08bea5540d4884e212f44633af27726235cdc

SHA512
73f5cd650bab84355ae0b7ad2c8b70820e5923710ae02964648e245fbbac05e12e03344146cc226234d49940e139b1dde1f1b64caedb805577511997b5f260ef

Download Submit
memory/1352-8-0x0000000000000000-mapping.dmp

Download
memory/1704-21-0x0000000008CE0000-0x0000000008DE1000-memory.dmp

Filesize
1.0MB

Download
memory/2444-159-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-199-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-73-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-75-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-76-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-79-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-81-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-83-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-85-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-87-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-89-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-91-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-93-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-95-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-97-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-99-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-101-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-103-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-106-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-105-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-109-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-111-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-113-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-116-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-115-0x0000022396AC0000-0x0000022396AC1000-memory.dmp

Filesize
4KB

Download
memory/2444-119-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-121-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-123-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-125-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-127-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-129-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-131-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-133-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-135-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-137-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-139-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-141-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-143-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-145-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-147-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-149-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-151-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-153-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-155-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-157-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-69-0x0000022396AC0000-0x0000022396AC1000-memory.dmp

Filesize
4KB

Download
memory/2444-162-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-161-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-165-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-167-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-169-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-175-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-171-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-173-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-177-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-179-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-181-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-183-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-185-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-187-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-189-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-191-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-193-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-195-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-197-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-70-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-201-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-203-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-205-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-207-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-209-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-211-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-213-0x0000022396AC0000-0x0000022396AC1000-memory.dmp

Filesize
4KB

Download
memory/2444-214-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-217-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-219-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-221-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-223-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-225-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-227-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-229-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-231-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-233-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-235-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-237-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-239-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-241-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-243-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-245-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-247-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-249-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-251-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-253-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-255-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-257-0x00000223A0F70000-0x00000223A0F71000-memory.dmp

Filesize
4KB

Download
memory/2444-258-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-10-0x0000022395050000-0x0000022395051000-memory.dmp

Filesize
4KB

Download
memory/2444-67-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-65-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-63-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-61-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-59-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-57-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-55-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-53-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-51-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-48-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-47-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-45-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-43-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-40-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-39-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-36-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-35-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-31-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-32-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-29-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-27-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-25-0x0000022396AA0000-0x0000022396AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-24-0x0000022396AD0000-0x0000022396AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-11-0x0000022395050000-0x0000022395051000-memory.dmp

Filesize
4KB

Download
memory/2444-13-0x00000223964C0000-0x00000223964C1000-memory.dmp

Filesize
4KB

Download
memory/2444-14-0x00000223964C0000-0x00000223964C1000-memory.dmp

Filesize
4KB

Download
memory/2660-6-0x0000000000000000-mapping.dmp

Download
memory/3024-3-0x0000000000000000-mapping.dmp

Download
memory/3172-259-0x0000000000000000-mapping.dmp

Download
memory/3588-2-0x0000000000000000-mapping.dmp

Download
memory/3612-4-0x0000000000000000-mapping.dmp

Download
memory/3628-19-0x0000000000000000-mapping.dmp

Download
memory/3792-5-0x0000000000000000-mapping.dmp

Download
memory/4008-7-0x0000000000000000-mapping.dmp

Download