Analysis
-
max time kernel
70s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2023, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Resource
win10v2004-20220812-en
General
-
Target
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
-
Size
1.2MB
-
MD5
16bcc3b7f32c41e7c7222bf37fe39fe6
-
SHA1
a25bc5442c86bdeb0dec6583f0e80e241745fb73
-
SHA256
eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
-
SHA512
f3e7087f569b3bcc201c006c5dfcea6cf560cad480bc03e6f17790190bc35bf6659e91a9f91219952bd139a3c9afde961032ee1d0861158409206feaa6540f9e
-
SSDEEP
24576:uj/6CtkHRos9l+zan4Q6eQqF5ZgQibE2zkMiJHic9OuTw258tox6T9G0SKoRl:A/NtkHRos9l+zan4QTB/2zkPtBq2itoP
Malware Config
Extracted
C:\Users\Public\Desktop\README_LOCKED.txt
Signatures
-
LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UnblockTrace.raw => C:\Users\Admin\Pictures\UnblockTrace.raw.locked yxugwjud7677.exe File renamed C:\Users\Admin\Pictures\DisableTest.tif => C:\Users\Admin\Pictures\DisableTest.tif.locked yxugwjud7677.exe File opened for modification C:\Users\Admin\Pictures\SyncConnect.tiff yxugwjud7677.exe File renamed C:\Users\Admin\Pictures\SyncConnect.tiff => C:\Users\Admin\Pictures\SyncConnect.tiff.locked yxugwjud7677.exe File opened for modification C:\Users\Admin\Pictures\DisablePop.tiff yxugwjud7677.exe File renamed C:\Users\Admin\Pictures\DisablePop.tiff => C:\Users\Admin\Pictures\DisablePop.tiff.locked yxugwjud7677.exe File renamed C:\Users\Admin\Pictures\FindOut.raw => C:\Users\Admin\Pictures\FindOut.raw.locked yxugwjud7677.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini yxugwjud7677.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\icudtl.dat.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gd.pak.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\MEIPreload\manifest.json.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\mip_protection_sdk.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\as.pak yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\resources.pak.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\v8_context_snapshot.bin.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdfmap.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ru.pak.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gl.pak.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\wns_push_client.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\Reader_DC.helpcfg yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\plugin.X.manifest yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\selector.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\hr.pak yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\telclient.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TabTip32.exe.mui yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\vcruntime140_1.dll yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\manifest.json yxugwjud7677.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\Trust Protection Lists\Mu\TransparentAdvertisers yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Locales\gu.pak.DATA yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\Mu\TransparentAdvertisers yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js yxugwjud7677.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js yxugwjud7677.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\rescache\_merged\92721896\130097424.pri svchost.exe File created C:\Windows\rescache\_merged\1712550052\3834906535.pri svchost.exe File created C:\Windows\rescache\_merged\2928961003\3463267371.pri svchost.exe File created C:\Windows\rescache\_merged\2137598169\2348912703.pri svchost.exe File created C:\Windows\rescache\_merged\3479232320\3338711889.pri svchost.exe File created C:\Windows\rescache\_merged\4278325366\2693064308.pri svchost.exe File created C:\Windows\rescache\_merged\431186354\805790391.pri svchost.exe File created C:\Windows\rescache\_merged\2562634990\1263512796.pri svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
pid pid_target Process procid_target 3640 2688 WerFault.exe 54 4704 912 WerFault.exe 118 2544 1920 WerFault.exe 125 1188 1920 WerFault.exe 125 4908 2376 WerFault.exe 160 2004 3172 WerFault.exe 196 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mrw svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Photos_8wekyb3d8bbwe!App\windows.protocol\micro = "App.AppXywc6hnzjb6gprp40xt9c2w2s2eva2d4v.mca" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX4tfstxv315ny2wmswr55fgry1ym3yp3h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mp2v\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\msnweather\AppXzg6fdzp57dpmt1dqardd3y48kkx0qb78 svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.adts\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXdg4j5zg5vk11bk8bqnf1evbx9vc1b8wa svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXgtz62cfp9761w8h33sbaykyt1vkbm4vj svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowscommunicationsapps_8wekyb3d8bbwe!mic = "microsoft.windowslive.manageaccounts.AppXk5qy3a2bkaxenczgh7r8tmbhgc4eke4n.mca" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\skype\AppX1np6bckd8pzgmy0k7rjk4xshe55bac6q svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\xbox-captures\AppXc1x9cg0rhxs9h00f1m585kyrywt0pn74 svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.srw\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mpeg\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mos svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-walk-to svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.rw2\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXppqdgckcm0rkmm7y6v63w1ckey9065gr svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-inputapp\AppX6006hzyfsdm0v5mhzsyjgvyh29vvj9sp svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\mswindowsmusic\AppXtggqqtcfspt6ks3fjzyfppwc05yxwtwy svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mpg\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-holographicfirstrun svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Microsoft.549981C3F5F10_8wekyb3d8bbwe!App\windows.protocol\ms-cortana2 = "Cortana" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DView = "C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.wmv\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.3fr svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.erf\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX7rm9drdg8sk7vqndwj3sdjw11x96jc0y svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.svg svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\mailto\AppXydk58wgm44se4b399557yyyj1w7mbmvd svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.WindowsStore_8wekyb3d8bbwe!App\windows.protocol\microsoftvide = "App.AppXqvphjpvny68mn1gsbhhw858gwke2mfee.mca" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\mswindowsmusic svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.sr2\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.ShellExperienceHost_cw5n1h = "Action Center" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.heic\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXak1hygz1tpjjnxhr1pwtcgnkpr24r5e7 svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.arw\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\skypewin svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.jxr\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-insights\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675 svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.jpg\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\ms-phone\Logo = "C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\AppIcon.scale-200.png" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX7nv11hc795928dfdxbjgrnt50tez0eh7 svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.3gp svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\windows.fileTypeAssociation\.b = "App.AppX99naa8pv4a8nkjghzyt7drksgwxwbtsg.mca" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.jpeg\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Windows.PrintDialog_cw5n1h2txyewy!Microsoft.Windows.PrintDialog\window = "C:\\Windows\\PrintDialog\\Assets\\logo.png" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.m1v\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mts\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\bingmaps\AppXp9gkwccvk6fa6yyfq3tmsk8ws2nprk1p svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.divx\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.mpa\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.dib\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-people\AppX0resaq7r5ermbh4b96ke39yqc1atfhjr svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXsgg0wwjjmjm918zvy6bkrfq4a5dxgtfh svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App\windows.protocol\fe = "App.AppXt9fyr0wmympv92qr265n9cf3rts532xy.mca" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-default-location\AppXegssybx65447k2q6prgacs1t5gzge8at svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\xbox-tcui\AppX4jbzrhvphxte25e0gxha6bq555nrgqzy svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\windows.protocol\ms-screensket = "App.AppXwnmr9952bptdbfyz5zk8cebdbtcyf7na.mca" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-voip-call svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.dcr\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.c5e2524a-ea46-4f67-841f-6a9465d9d515 svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-penworkspace svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3896 yxugwjud7677.exe 3508 yxugwjud7677.exe 3896 yxugwjud7677.exe 3508 yxugwjud7677.exe 4156 yxugwjud7677.exe 4156 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 3896 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4156 yxugwjud7677.exe 4156 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4156 yxugwjud7677.exe 4156 yxugwjud7677.exe 3508 yxugwjud7677.exe 3508 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4944 yxugwjud7677.exe 4156 yxugwjud7677.exe 4156 yxugwjud7677.exe 4156 yxugwjud7677.exe 4944 yxugwjud7677.exe 4156 yxugwjud7677.exe 4944 yxugwjud7677.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2196 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe Token: SeBackupPrivilege 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe Token: SeRestorePrivilege 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe Token: SeLockMemoryPrivilege 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe Token: SeCreateGlobalPrivilege 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe Token: SeDebugPrivilege 780 yxugwjud7677.exe Token: SeBackupPrivilege 780 yxugwjud7677.exe Token: SeRestorePrivilege 780 yxugwjud7677.exe Token: SeLockMemoryPrivilege 780 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 780 yxugwjud7677.exe Token: SeDebugPrivilege 3508 yxugwjud7677.exe Token: SeBackupPrivilege 3508 yxugwjud7677.exe Token: SeRestorePrivilege 3508 yxugwjud7677.exe Token: SeDebugPrivilege 3896 yxugwjud7677.exe Token: SeLockMemoryPrivilege 3508 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 3508 yxugwjud7677.exe Token: SeBackupPrivilege 3896 yxugwjud7677.exe Token: SeRestorePrivilege 3896 yxugwjud7677.exe Token: SeLockMemoryPrivilege 3896 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 3896 yxugwjud7677.exe Token: SeDebugPrivilege 4944 yxugwjud7677.exe Token: SeBackupPrivilege 4944 yxugwjud7677.exe Token: SeRestorePrivilege 4944 yxugwjud7677.exe Token: SeLockMemoryPrivilege 4944 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 4944 yxugwjud7677.exe Token: SeDebugPrivilege 4156 yxugwjud7677.exe Token: SeBackupPrivilege 4156 yxugwjud7677.exe Token: SeRestorePrivilege 4156 yxugwjud7677.exe Token: SeLockMemoryPrivilege 4156 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 4156 yxugwjud7677.exe Token: SeDebugPrivilege 1628 yxugwjud7677.exe Token: SeBackupPrivilege 1628 yxugwjud7677.exe Token: SeRestorePrivilege 1628 yxugwjud7677.exe Token: SeLockMemoryPrivilege 1628 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 1628 yxugwjud7677.exe Token: SeDebugPrivilege 2644 yxugwjud7677.exe Token: SeBackupPrivilege 2644 yxugwjud7677.exe Token: SeRestorePrivilege 2644 yxugwjud7677.exe Token: SeLockMemoryPrivilege 2644 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 2644 yxugwjud7677.exe Token: SeDebugPrivilege 4668 yxugwjud7677.exe Token: SeBackupPrivilege 4668 yxugwjud7677.exe Token: SeRestorePrivilege 4668 yxugwjud7677.exe Token: SeLockMemoryPrivilege 4668 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 4668 yxugwjud7677.exe Token: SeDebugPrivilege 4440 yxugwjud7677.exe Token: SeBackupPrivilege 4440 yxugwjud7677.exe Token: SeRestorePrivilege 4440 yxugwjud7677.exe Token: SeLockMemoryPrivilege 4440 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 4440 yxugwjud7677.exe Token: SeDebugPrivilege 1864 yxugwjud7677.exe Token: SeBackupPrivilege 1864 yxugwjud7677.exe Token: SeRestorePrivilege 1864 yxugwjud7677.exe Token: SeLockMemoryPrivilege 1864 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 1864 yxugwjud7677.exe Token: SeDebugPrivilege 4152 yxugwjud7677.exe Token: SeBackupPrivilege 4152 yxugwjud7677.exe Token: SeRestorePrivilege 4152 yxugwjud7677.exe Token: SeLockMemoryPrivilege 4152 yxugwjud7677.exe Token: SeCreateGlobalPrivilege 4152 yxugwjud7677.exe Token: SeDebugPrivilege 2288 yxugwjud7677.exe Token: SeBackupPrivilege 2288 yxugwjud7677.exe Token: SeRestorePrivilege 2288 yxugwjud7677.exe Token: SeLockMemoryPrivilege 2288 yxugwjud7677.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe 1920 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2196 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe 76 PID 1944 wrote to memory of 2196 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe 76 PID 1944 wrote to memory of 780 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe 78 PID 1944 wrote to memory of 780 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe 78 PID 1944 wrote to memory of 780 1944 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe 78 PID 780 wrote to memory of 4944 780 yxugwjud7677.exe 79 PID 780 wrote to memory of 4944 780 yxugwjud7677.exe 79 PID 780 wrote to memory of 4944 780 yxugwjud7677.exe 79 PID 780 wrote to memory of 3508 780 yxugwjud7677.exe 80 PID 780 wrote to memory of 3508 780 yxugwjud7677.exe 80 PID 780 wrote to memory of 3508 780 yxugwjud7677.exe 80 PID 780 wrote to memory of 3896 780 yxugwjud7677.exe 81 PID 780 wrote to memory of 3896 780 yxugwjud7677.exe 81 PID 780 wrote to memory of 3896 780 yxugwjud7677.exe 81 PID 780 wrote to memory of 4156 780 yxugwjud7677.exe 82 PID 780 wrote to memory of 4156 780 yxugwjud7677.exe 82 PID 780 wrote to memory of 4156 780 yxugwjud7677.exe 82 PID 780 wrote to memory of 1628 780 yxugwjud7677.exe 84 PID 780 wrote to memory of 1628 780 yxugwjud7677.exe 84 PID 780 wrote to memory of 1628 780 yxugwjud7677.exe 84 PID 780 wrote to memory of 2644 780 yxugwjud7677.exe 85 PID 780 wrote to memory of 2644 780 yxugwjud7677.exe 85 PID 780 wrote to memory of 2644 780 yxugwjud7677.exe 85 PID 780 wrote to memory of 4668 780 yxugwjud7677.exe 87 PID 780 wrote to memory of 4668 780 yxugwjud7677.exe 87 PID 780 wrote to memory of 4668 780 yxugwjud7677.exe 87 PID 780 wrote to memory of 4440 780 yxugwjud7677.exe 86 PID 780 wrote to memory of 4440 780 yxugwjud7677.exe 86 PID 780 wrote to memory of 4440 780 yxugwjud7677.exe 86 PID 780 wrote to memory of 1864 780 yxugwjud7677.exe 88 PID 780 wrote to memory of 1864 780 yxugwjud7677.exe 88 PID 780 wrote to memory of 1864 780 yxugwjud7677.exe 88 PID 780 wrote to memory of 4152 780 yxugwjud7677.exe 89 PID 780 wrote to memory of 4152 780 yxugwjud7677.exe 89 PID 780 wrote to memory of 4152 780 yxugwjud7677.exe 89 PID 780 wrote to memory of 2288 780 yxugwjud7677.exe 91 PID 780 wrote to memory of 2288 780 yxugwjud7677.exe 91 PID 780 wrote to memory of 2288 780 yxugwjud7677.exe 91 PID 780 wrote to memory of 1472 780 yxugwjud7677.exe 92 PID 780 wrote to memory of 1472 780 yxugwjud7677.exe 92 PID 780 wrote to memory of 1472 780 yxugwjud7677.exe 92 PID 780 wrote to memory of 4172 780 yxugwjud7677.exe 93 PID 780 wrote to memory of 4172 780 yxugwjud7677.exe 93 PID 780 wrote to memory of 4172 780 yxugwjud7677.exe 93 PID 780 wrote to memory of 4504 780 yxugwjud7677.exe 94 PID 780 wrote to memory of 4504 780 yxugwjud7677.exe 94 PID 780 wrote to memory of 4504 780 yxugwjud7677.exe 94 PID 780 wrote to memory of 1084 780 yxugwjud7677.exe 95 PID 780 wrote to memory of 1084 780 yxugwjud7677.exe 95 PID 780 wrote to memory of 1084 780 yxugwjud7677.exe 95 PID 780 wrote to memory of 4520 780 yxugwjud7677.exe 96 PID 780 wrote to memory of 4520 780 yxugwjud7677.exe 96 PID 780 wrote to memory of 4520 780 yxugwjud7677.exe 96 PID 780 wrote to memory of 3556 780 yxugwjud7677.exe 97 PID 780 wrote to memory of 3556 780 yxugwjud7677.exe 97 PID 780 wrote to memory of 3556 780 yxugwjud7677.exe 97 PID 780 wrote to memory of 4220 780 yxugwjud7677.exe 98 PID 780 wrote to memory of 4220 780 yxugwjud7677.exe 98 PID 780 wrote to memory of 4220 780 yxugwjud7677.exe 98 PID 780 wrote to memory of 4888 780 yxugwjud7677.exe 99 PID 780 wrote to memory of 4888 780 yxugwjud7677.exe 99 PID 780 wrote to memory of 4888 780 yxugwjud7677.exe 99 PID 780 wrote to memory of 4752 780 yxugwjud7677.exe 100 PID 780 wrote to memory of 4752 780 yxugwjud7677.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe"C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe2⤵
- Suspicious behavior: RenamesItself
PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -m2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4152
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:1084
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4520
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3556
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4220
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4752
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Drops file in Program Files directory
PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:212
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 8444⤵
- Program crash
PID:4704
-
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:628
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Modifies extensions of user files
PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Modifies extensions of user files
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Modifies extensions of user files
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵
- Modifies extensions of user files
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3288
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:772
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4052
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1028
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3556
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1084
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4840
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:724
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3472
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:112
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:648
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 7044⤵
- Program crash
PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3600
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3124
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3188
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4912
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3484
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2272
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3176
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4472
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4308
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:3328
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:4744
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exeC:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s3⤵PID:1944
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 2688 -ip 26881⤵PID:4396
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2688 -s 10161⤵
- Program crash
PID:3640
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1920 -s 23242⤵
- Program crash
PID:2544
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1920 -s 23242⤵
- Program crash
PID:1188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 912 -ip 9121⤵PID:4004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3880
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 512 -p 1920 -ip 19201⤵PID:3240
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 1920 -ip 19201⤵PID:2764
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 2376 -ip 23761⤵PID:3560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2376 -s 4441⤵
- Program crash
PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3172 -ip 31721⤵PID:2492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA
Filesize3KB
MD57c608af13cddd27f9820fe57d2ea8645
SHA16bbf83473153f200a54547b80309066233d3de76
SHA25661b76dd40f05f1ca331c8a0c0229e604b9dbf8b4b4b093949256e8c6b46949a1
SHA512b8aa3f7142945a66ab39a3fc7ce1e771a828a62c3ee57b7c218f6cfb6073d29d36a26327e5de13d43c08dd614c2967aaf53004cb328844664642760a5498d37e
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA
Filesize428B
MD50685949c584726206b9733e74959ff65
SHA1b0d00ade8423c4f876b5907b11647231925639c1
SHA25696a7b22e420adc36104c38009fb01cdf6f0f4d710ba1f233c3c5ea6bf4ac4b2c
SHA5128fbc4b9a8cecc92cb3ae38f731c595f3872bbd5dce2648f9c5020e09dab9371081b67c5570064475e2f5ff4559687bf2227507f11beec2c1047570f29514b89a
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\Mu\TransparentAdvertisers
Filesize401B
MD586561953037fa758920ea57c8cb5f354
SHA165ba83df0496dc03b3b1023c4edb414c958fdb0e
SHA25623fd904cef3b75810c35f367feb08196b97be9b752d4b9ce2902319c02b91280
SHA51225ec22d8de9c1d607ac4caee379efb0eccb0cc9cfccac6f406cc4e73730db7e9455200eb986da849cd7937876fe277cbb9f997549b0154337757edc8f45bb349
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\manifest.json
Filesize576B
MD504e7c91fd693137759854683f79e0103
SHA1abe067368835dd7930b1f9ff977bfb0ad85daebf
SHA2564c6cd7242eb6e02dbff738ecc6724699886753aee5c56e85349cede34e823093
SHA51223065ec10f36271e19c3ed6891a8c29f2bc6ec5262b3337e6aba3e0477fa2d51210a77eefb126d466257b2b095b56c620b531ff3f9aaf2cfa4597d97ff04225d
-
Filesize
20.2MB
MD5ac33c762972c60c6be89eb8ead1f6841
SHA1b8d4d2bd7b3e9077395a0c61d86fc68948593367
SHA2569866ba963675436ecf61091764df80830ba8c4c0793bfe7e61af09e5ba455865
SHA512a3c6e3007334a1b3c90848470f720e3bc5ed165451b75ab980b393a9bf76bbe1af13d205f9771616b5f825c7394eb60cd86c3158647394a12d8e185de2f5e97f
-
Filesize
20.2MB
MD5e767de76002a73b10f73d965563a331d
SHA163d27a5feb569cf78c578ac79022efa11769aa10
SHA256dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f
SHA51287f82800fbcfc500af9d5a9e56c46a7387679b1439967ee39a762b843efa762f7cc4a5bd84d2d9a0da64f3c89b561ea4d2bc67474daadfbbccc6ef72e0580e94
-
Filesize
20.2MB
MD5e767de76002a73b10f73d965563a331d
SHA163d27a5feb569cf78c578ac79022efa11769aa10
SHA256dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f
SHA51287f82800fbcfc500af9d5a9e56c46a7387679b1439967ee39a762b843efa762f7cc4a5bd84d2d9a0da64f3c89b561ea4d2bc67474daadfbbccc6ef72e0580e94
-
Filesize
2.3MB
MD58bb3996c72bbdd60c152189e9d7aa5e9
SHA1840e6199ad0d8a7d7ca6177dc4b5e2d2a33167ef
SHA25682486a6df9cc723438d2f9174f8ffbbd1ddc5d5a7ae689dee4d1b2203b089461
SHA512be2cad23908f62da8101e30503a80eda1f57585d807dc9f961443f851d3f8a82a6bc2e4f396f3ce96a02e82399088bf09eaa4233d1840a57049e7aae3d2935be
-
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.locked
Filesize289KB
MD533ec85690d13fc55ceb204c65b691e68
SHA116d5a73f43e88138fd3b0fafb577fa05cae34576
SHA256165b3a41587d2f1ba154b86b82cb6a926c30404c4467603dd5782a1b64bd012b
SHA5129ca684e417891d6bb4f86267053ed6bab993e7d1c54c1f9a745c91eaf05a580a9c3593fe87b1fe9048224ad53335524b40b9305e9befb30ce74508434fe5feeb
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.locked
Filesize623KB
MD55a38fd2a86a7a491b86e0a5701cc97e6
SHA177416e366cc60d8b31d72f9e9525c30e9acef6c2
SHA256e5a2e5109ba4fe6eb1ddc3451e54d894c98774f0409b248925fc5426f324c9c6
SHA512bec7b4d2cfce82ea8d60acabe2c3aa65cf82b89975ad5adda79375270c87e9665258a53e7722449f7ee10af000d9feae5bb9f6b48ab3ab057ed32df67e41da8f
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335
-
Filesize
1KB
MD5bf41f65f8a5b7c27752368238ea18595
SHA14bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb
SHA256544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
SHA5123864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335