cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c

System Information Discovery

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Control Panel\International\Geo\Nation	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Drops startup file 1 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exeRundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\g:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\j:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\m:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\p:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\t:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\u:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\b:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\e:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\y:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\k:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\a:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\h:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\q:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\r:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\v:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\x:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\z:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\f:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\l:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\o:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\s:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\w:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\i:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened (read-only)	\??\n:	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/3676-170-0x0000000001050000-0x00000000036DF000-memory.dmp	autoit_exe
behavioral1/memory/1872-338-0x0000000001050000-0x00000000036DF000-memory.dmp	autoit_exe
behavioral1/memory/2116-339-0x0000000000AC0000-0x000000000314F000-memory.dmp	autoit_exe
behavioral1/memory/2448-340-0x0000000000990000-0x000000000301F000-memory.dmp	autoit_exe
behavioral1/memory/1872-492-0x0000000001050000-0x00000000036DF000-memory.dmp	autoit_exe
behavioral1/memory/2116-493-0x0000000000AC0000-0x000000000314F000-memory.dmp	autoit_exe
behavioral1/memory/2448-512-0x0000000000990000-0x000000000301F000-memory.dmp	autoit_exe
behavioral1/memory/496-563-0x0000000001010000-0x000000000369F000-memory.dmp	autoit_exe
behavioral1/memory/496-581-0x0000000001010000-0x000000000369F000-memory.dmp	autoit_exe
behavioral1/memory/3676-593-0x0000000001050000-0x00000000036DF000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
File created	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Drops file in Windows directory 3 IoCs

Processes:

explorer.exeSearchUI.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\2717123927\3950266016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\2900507189.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

Processes:

~ympbsuq.execea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe~ympbsuq.exe~ympbsuq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~ympbsuq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\First Home Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~ympbsuq.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~ympbsuq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\First Home Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\Microsoft\Internet Explorer\Main	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Modifies Internet Explorer start page 1 TTPs 3 IoCs

stealer

Modify Registry

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://web.503118.com/?30528"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Modifies registry class 54 IoCs

Processes:

explorer.exeSearchUI.execea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\ = "在没有加载项的情况下启动"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\ = "打开主页(&H)"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -extoff"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\ieframe.dll,-190"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\ = "Internet Explorer"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command\ = "C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,Control_RunDLL C:\\Windows\\SysWOW64\\inetcpl.cpl"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e60705004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000dadabf15e972d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e60705004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000058a74815e972d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e60704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc76000000000000000000000000544fdbdc5350d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e6070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e6070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\ = "属性(&R)"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132944508945364454"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\""	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

3800 PING.EXE
3236 PING.EXE
2448 PING.EXE

pid	process
3800	PING.EXE
3236	PING.EXE
2448	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

pid	process
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

pid process

3676 cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe~ympbsuq.exe~ympbsuq.execea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exeuteuzfs.exescraxkr.exe~ympbsuq.exeibazlzq.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Token: SeBackupPrivilege	640	~ympbsuq.exe
Token: SeRestorePrivilege	640	~ympbsuq.exe
Token: SeTakeOwnershipPrivilege	640	~ympbsuq.exe
Token: SeBackupPrivilege	1276	~ympbsuq.exe
Token: SeRestorePrivilege	1276	~ympbsuq.exe
Token: SeTakeOwnershipPrivilege	1276	~ympbsuq.exe
Token: SeDebugPrivilege	1872	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Token: SeDebugPrivilege	2116	uteuzfs.exe
Token: SeDebugPrivilege	2448	scraxkr.exe
Token: SeRestorePrivilege	2448	scraxkr.exe
Token: SeTakeOwnershipPrivilege	2448	scraxkr.exe
Token: SeDebugPrivilege	2448	scraxkr.exe
Token: SeSecurityPrivilege	2448	scraxkr.exe
Token: SeBackupPrivilege	2656	~ympbsuq.exe
Token: SeRestorePrivilege	2656	~ympbsuq.exe
Token: SeTakeOwnershipPrivilege	2656	~ympbsuq.exe
Token: SeDebugPrivilege	496	ibazlzq.exe
Token: SeRestorePrivilege	496	ibazlzq.exe
Token: SeTakeOwnershipPrivilege	496	ibazlzq.exe
Token: SeDebugPrivilege	496	ibazlzq.exe
Token: SeSecurityPrivilege	496	ibazlzq.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe
Token: SeShutdownPrivilege	3784	explorer.exe
Token: SeCreatePagefilePrivilege	3784	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

pid	process
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

pid	process
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchUI.exe

pid process

1396 SearchUI.exe

pid	process
1396	SearchUI.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exeuteuzfs.execmd.exeRundll32.exerunonce.execmd.execmd.exe

description	pid	process	target process
PID 3676 wrote to memory of 1872	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
PID 3676 wrote to memory of 1872	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
PID 3676 wrote to memory of 1872	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
PID 3676 wrote to memory of 2116	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	uteuzfs.exe
PID 3676 wrote to memory of 2116	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	uteuzfs.exe
PID 3676 wrote to memory of 2116	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	uteuzfs.exe
PID 3676 wrote to memory of 2448	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	scraxkr.exe
PID 3676 wrote to memory of 2448	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	scraxkr.exe
PID 3676 wrote to memory of 2448	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	scraxkr.exe
PID 3676 wrote to memory of 640	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 3676 wrote to memory of 640	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 3676 wrote to memory of 1276	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 3676 wrote to memory of 1276	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 2116 wrote to memory of 68	2116	uteuzfs.exe	cmd.exe
PID 2116 wrote to memory of 68	2116	uteuzfs.exe	cmd.exe
PID 68 wrote to memory of 3800	68	cmd.exe	PING.EXE
PID 68 wrote to memory of 3800	68	cmd.exe	PING.EXE
PID 3676 wrote to memory of 496	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	ibazlzq.exe
PID 3676 wrote to memory of 496	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	ibazlzq.exe
PID 3676 wrote to memory of 496	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	ibazlzq.exe
PID 3676 wrote to memory of 2656	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 3676 wrote to memory of 2656	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	~ympbsuq.exe
PID 3676 wrote to memory of 2340	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	Rundll32.exe
PID 3676 wrote to memory of 2340	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	Rundll32.exe
PID 2340 wrote to memory of 2508	2340	Rundll32.exe	runonce.exe
PID 2340 wrote to memory of 2508	2340	Rundll32.exe	runonce.exe
PID 2508 wrote to memory of 4044	2508	runonce.exe	grpconv.exe
PID 2508 wrote to memory of 4044	2508	runonce.exe	grpconv.exe
PID 3676 wrote to memory of 724	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cmd.exe
PID 3676 wrote to memory of 724	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cmd.exe
PID 3676 wrote to memory of 1176	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cmd.exe
PID 3676 wrote to memory of 1176	3676	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe	cmd.exe
PID 1176 wrote to memory of 3236	1176	cmd.exe	PING.EXE
PID 1176 wrote to memory of 3236	1176	cmd.exe	PING.EXE
PID 724 wrote to memory of 2448	724	cmd.exe	PING.EXE
PID 724 wrote to memory of 2448	724	cmd.exe	PING.EXE

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe

C:\Users\Admin\AppData\Local\Temp\cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
"C:\Users\Admin\AppData\Local\Temp\cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3676

C:\Users\Admin\AppData\Local\Temp\cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe
C:\Users\Admin\AppData\Local\Temp\cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c.exe /nstart
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Users\Admin\AppData\Local\Temp\fmvprwb\uteuzfs.exe
C:\Users\Admin\AppData\Local\Temp\fmvprwb\uteuzfs.exe /nys
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\QWIQHse.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:68

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
4⤵
- Runs ping.exe
PID:3800

C:\Users\Admin\AppData\Local\Temp\scraxkr.exe
C:\Users\Admin\AppData\Local\Temp\scraxkr.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe
C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe
C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Users\Admin\AppData\Local\Temp\ibazlzq.exe
C:\Users\Admin\AppData\Local\Temp\ibazlzq.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:496

C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe
C:\Users\Admin\AppData\Local\Temp\~ympbsuq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\SYSTEM32\Rundll32.exe
Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~vfuneys.inf
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:4044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\F612gaf.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\KP2MmY5.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:3236

C:\Windows\explorer.exe
explorer.exe
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery