Analysis
-
max time kernel
277s -
max time network
289s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 23:51
Static task
static1
Behavioral task
behavioral1
Sample
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe
Resource
win10v2004-20221111-en
General
-
Target
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe
-
Size
848KB
-
MD5
5ff6c4af76faf74394c79161579e8a4f
-
SHA1
c36bca787b4629814a34d116b7c3ca5262fc4cfc
-
SHA256
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d
-
SHA512
d15f6aeb2c2ac911a1c50356a8db5960d299b440bbf2e059a7ee5cfc4d3efc8c121ccc7fe737434ad04ef76f64000e77ca7fdc34b0193a2ad103b735e9ccf6d3
-
SSDEEP
12288:ivBIQKCR4KeHs+1M2R2D3wOLDvBQhA0UWgyjh/jWydrkaYEYhl97bjHk8OtAut01:rQKCR9uMVZBr0UWdwAYF7Ei1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exea69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
notepad.exea69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exedescription pid process target process PID 1760 set thread context of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exeexplorer.exedescription ioc process File opened for modification C:\Windows\PCGWIN32.LI5 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe File opened for modification C:\Windows\PCGWIN32.LI5 explorer.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Modifies registry class 8 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exeexplorer.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = 9377b63d7b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d2ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7ba0c73dc1b13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = 772256ba7b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d2ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7b266423c1b13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = 93f40a177b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d5ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7b266423c1b13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC} explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = e8f73c137b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d5ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7b738c24eeb13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = b9ee73667b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d5ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7ba2b42feeb13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC}\ = fae0227a7b62487433ac5fb5031dff3998a53e72182247a4cfafc8176acf4ae8d2100b3e8bd90c7969dd51b94d26890eee6837902f77f7af10e875cf51f74d20556fb1b7daa03c7b269be1fc61dbe983919c36c5200198317fe66720ff7c27a6ff5118b9841a43bc43dbc3c42caef5d71d804553510b3db325a35e24c64d5d53b553ae33c9636ddb29c3b584decfb9976680208ab24dd5d581415a25c4bd60a6d4ff7027ee3f76a7d0b076e920319c11fbb1dc5e8406ff419829862ddf09383118d2fc4467c0df6cb8c861aaf9351e5ef90625107d066530711c95fac21dca85cb62eb5c348451efb5e85eec78ebe2331d1b85bb429c44fbd0230d0ba9ab4e6c5614c07fc5e761f04dac29d54d4e0956f230ac280b286ce94a3514ad43353351e3457c01da4dbdc966e9d0763d9eda473c5f66c780d06d8449ede94af1129abcbce7998f818886cd7115a93deee60920d680c01a15440d2295d372836a2c8a4bcb6bd3338c1bb63bef1b68030accaa7494a00141f241dabd05a5722e92d775ffa158cebcf665df8dc7f6f01ee806c9e1cd590ac132a5ea122b7dab5914394d5e49385122814d82e90a8ef228a35013444b1c3306e46f8097c9b08e5b88bbf51c528474cfdca8fa719bdd8306aca0aa354b52ab4a132acb0aec54348c624bb4539ec379c3e59c01c7d17f0a27738f93e874ed5cc9fad6233edc180684a09104c252124c0c168a7eadd835f8ed5bea43123b0a1bcb7ba2b42feeb13a1264d775e52cc732cda28deb5ae25af854063e6063a5b441a57ca066c75ddc92379a53379b4c87c85c52baca248adc6dfb3563ad63d6e3f1ec9994c6b1af9d9786b0baa27783dfbb07a4afbe37a79f9f07b8af9ae8bbcc64b58cd2f5b2ee5b8803b383d4d4728d5c89c4b2239a937b74db6043982b83ab44ecceb74950e9feb62751f035dead79a95df6052f62c804d430411a81c41663bec3e764e0e2e89d37396019504634fe53d93b85239e23f93359ec3956e2be9a26fdee9a894509f111227ea4e603e18ba5d482bf8ca797a0bfb25895fa4e5cd6f84f6617c0cf7248dab484216d81d51a3d8299337e646602eefc369bdefcf9986587a19f5278b4e02366fc209aff3d6719cf8597914032e2eb02d39a04433203dab37ddc99b8469b4e83b6ac91b4056f0197bd3f9aa73ad01ac443a38b8baccc5535b1d2d6f4c151e98d321653f1b3d9ac3e77679f8ff848197601908d8176316e1db685d19235cd21359911baf2dd6279fa25a4b14396c3cf7357eb0f73b7d3e073fb1ba38384c4ef91174e0f36b75ea0061e1006007104d5e0ce0f9668ff8a58553c7de6e5a1eeeaa8b4b39f93f88458737aeb22142a8c0a6b0c6bd5cb71f499ae42a982d615708152da32c31c937bf4db51c43daee5d78eb0d7654f3d7765ef01e8ea8c5495fc815a9e3c47e78f8fc8e82d57357f91e78d3f0ae72ce0885473802b088bceccf7aa6f53970b0f4cd708b0f222656a9d323ad3dd73f9eb22b31c14c6002faab7aa602d62eac4f41f51f875e02d5b297b511bc903895b2efb49db5184399e5ec73800e21265fa91253ead98363f5fa70720cf92483d885a6b7c7324eb2eec487692ae4d2895b20e14c9b0a9ef2af734909ec747bf3f586738df65873d40e532725b92c33d84da6fbcf7e550aefea859b73d50d9804629a0b501d285f3eed3c9fc9118ca3e4dd9490135992d3d75a5a1315261446d9e69f969e1918ebab61ae13a56653e8dd84abd7219e241354dad750a51b2b1dd92fa3a9ae2bde5da510489106ac54c4dcac9d4958f7ee818b4849f8387337013e04c22c8cc8bcb540bc253357bad5b6a7b54a3bccc992b012bc1ebd2543c8e6469ac91a8c649e0919d3d85a59e0db88999ee7ac8a2b10b91ccf2ca2d130974cd6c364a614a4992358a212b41cce1d4d90146298e9137b5e012a2cd23e91b2a432ae3d4b3415c81c65e20b8fe18e7823f1c2786bf2e98883cebe48bfd742522717351eb3d9425433103dd9346bbb02417edbfb518d2ba75e51d82f9535afb842421cd85d5127ebc98257d42a51c21f8955bfefbd864850ceec896b5b1d2a5447e40a6fe20d9a8bdd1a6b5df6e0716ff41180d8215157eb1981abd7d6619a0c13166daa0821f05f80d9a55fdfd9ad943bacba22ccdb6161ff18711d071c35dbb39e419730513cdc34a8cb4166f3e97a6f0bf12d8c47edd5845c28dfb295bd5bbc264125c7a86a2b0756151a98931ade55682b0db207bfe1bd9c43d5259c441b0791d9d46c6100ecc288bb20b654b51338d1b963b411be5c33e0ca677219fa9b80a5b4bfb53243b925c75c411d17eb1d8dab945251101c55262bcac99553d4119d542328c9c8b070b502b46742eac49692d5135c152c2fc8aa7d52f82177540118cb99799403ee0d963c13b2aa32ce4f6be215962f97a2124b912194479d02588116f71d7a90f7297a270d550f2f8aa26b5a0a116767eae18e9fbe96392ab8c2bd7ab4013327ba25bfb3be323944cbe88a76b608bd83339db9dfc46583e4298c2c303ecab8a348b51ab415421c27a02e2acb577622f0cb748af0ee8e92f7517dd8f7997ddc045392de6892eb296244f1c37b85f9dc739ff219889b86add4a7ad42233eca36b2c8b774c5f9647c15f2d87d5f00e18b6f86f1d5746ffaed8497c71a4ed2cd696400e7076e45ed1787da4a5dd52398a210de2ea04f490613ab5642e0ea8d7097fb5a72240b440d1e6ce00d6f80f231764ff92187dbc591bfd441a0cc336136173f55ba2430c9374c4621c5c3846a0ae8bb72b602bd05437f0d0d1f88d25aa428c526972d5aa3dd39904421204fc9227ba9f1b783b5e63868b9f6c78b6a411e3b1e4da8c85974e8f28884c6df6b5deee7937651fe187d5704e18b6422102da22fc7a19a40582913376e45e8ec6e9ce969771c0216ebd3699e13e41e7e5ff7d58d942813a3a1a5b7a7be4239e7c07242fc2b7b350e4404ed828c09685ffee988845a9e1b1325e94f80d5c6ac4148ccc75b711e04660f06caf28484eced677f0ef5d8879571dcf46680ed616413ee1d8764510cdf8aaa334336223547c30985eb9f82598d179f6e1207d1e25b8e29d42c6f27e6c26c8d1484914b18256f3709c9886f9ff1d58f97ee6265e5f7807e42fd11771cf6548e1d40abfd527011f757891a4b9bd1e6638a0a417638f23c843cbcbb393ac34f7221f9c07b8bf1958397c61a48db35623402bb27494ec3fe9276d5f4987f58fee2868308c6e0ab6b4a0223142e644fe72595c81b86e9956018e2989ad4e6aa834379c9fbb381b5ffb47a42ffd489916823eb467918fbd889a087dcae5b52edef7b82f63b713604440eceea9d656813eeaa68adf6bc733905cb2c69ba183315451ce0d36eade8ac7f32fac17698f2d48552acd53a90b320b636c43d46b81530d8349d469ce71b75daf79a85d73b99ba63c619aa1c522c28c84cbc1ac6e9676bfdea7f8b05b5bbbc32404e3cfa3f7dc10857da1a58e8e8816adf0a9a15201c4591c05bad21c4446d21e4a38cc6696b04f53d78b3ff4a7210ff277226f5a17840f5d37851ff20713efc4682cd08a45733d1ba57bfe1be6c48face8d588425122fd9c1986fddf263861db65c3115c39b8211b explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{80EFCC3D-7231E77A-CBAD456E-14BE20BC} a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeSecurityPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeTakeOwnershipPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeLoadDriverPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeSystemProfilePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeSystemtimePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeProfSingleProcessPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeIncBasePriorityPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeCreatePagefilePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeBackupPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeRestorePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeShutdownPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeDebugPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeSystemEnvironmentPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeChangeNotifyPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeRemoteShutdownPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeUndockPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeManageVolumePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeImpersonatePrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeCreateGlobalPrivilege 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: 33 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: 34 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: 35 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: 36 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe Token: SeIncreaseQuotaPrivilege 1764 explorer.exe Token: SeSecurityPrivilege 1764 explorer.exe Token: SeTakeOwnershipPrivilege 1764 explorer.exe Token: SeLoadDriverPrivilege 1764 explorer.exe Token: SeSystemProfilePrivilege 1764 explorer.exe Token: SeSystemtimePrivilege 1764 explorer.exe Token: SeProfSingleProcessPrivilege 1764 explorer.exe Token: SeIncBasePriorityPrivilege 1764 explorer.exe Token: SeCreatePagefilePrivilege 1764 explorer.exe Token: SeBackupPrivilege 1764 explorer.exe Token: SeRestorePrivilege 1764 explorer.exe Token: SeShutdownPrivilege 1764 explorer.exe Token: SeDebugPrivilege 1764 explorer.exe Token: SeSystemEnvironmentPrivilege 1764 explorer.exe Token: SeChangeNotifyPrivilege 1764 explorer.exe Token: SeRemoteShutdownPrivilege 1764 explorer.exe Token: SeUndockPrivilege 1764 explorer.exe Token: SeManageVolumePrivilege 1764 explorer.exe Token: SeImpersonatePrivilege 1764 explorer.exe Token: SeCreateGlobalPrivilege 1764 explorer.exe Token: 33 1764 explorer.exe Token: 34 1764 explorer.exe Token: 35 1764 explorer.exe Token: 36 1764 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1764 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exedescription pid process target process PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 4680 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe notepad.exe PID 1760 wrote to memory of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe PID 1760 wrote to memory of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe PID 1760 wrote to memory of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe PID 1760 wrote to memory of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe PID 1760 wrote to memory of 1764 1760 a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe"C:\Users\Admin\AppData\Local\Temp\a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\PCGWIN32.LI5Filesize
2KB
MD5c97fef508a81b044c78544eca1642610
SHA19b19f1022011d8c76406997d1887ae695b02ce28
SHA256f277463d1a87a532f0f183fa71c0f35f3fff4177cf8a7a10bacdcc47939fb1f5
SHA512aed92585bef7b4a2fd3c37771f0c07c926d29a2f1c1713aa2783827d81f99f6abfd441ba016ad73583e350a9ee3dfe43ff756fad3123d4cf98c86928cbe6d123
-
C:\Windupdt\winupdate.exeFilesize
848KB
MD55ff6c4af76faf74394c79161579e8a4f
SHA1c36bca787b4629814a34d116b7c3ca5262fc4cfc
SHA256a69effb9cb8cb766f84043fe5b8417d223a46e3ec3f3e02152f844f7774cf51d
SHA512d15f6aeb2c2ac911a1c50356a8db5960d299b440bbf2e059a7ee5cfc4d3efc8c121ccc7fe737434ad04ef76f64000e77ca7fdc34b0193a2ad103b735e9ccf6d3
-
memory/1760-133-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1760-132-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1760-138-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-135-0x0000000000000000-mapping.dmp
-
memory/1764-139-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-136-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-140-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-142-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-143-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/1764-144-0x0000000013140000-0x0000000013226000-memory.dmpFilesize
920KB
-
memory/4680-134-0x0000000000000000-mapping.dmp