dcrat | 0102ee1516fd47fc9cb7ffb31c922e747cc5ce638e2fb0d5e133275e271cd492

Analysis

max time kernel
251s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fortnite.exe
Size

1.1MB
MD5

f795b0bb519a53aa55f3a1f8b421708d
SHA1

18b0c53280f120d18e224ef389e21a09902da4f4
SHA256

0102ee1516fd47fc9cb7ffb31c922e747cc5ce638e2fb0d5e133275e271cd492
SHA512

d3a1908461508c6bf322e1aa809b6b04ed27e0722957fcdf5d4f828060f4d4ba76d415ba56b8dad1d9d07129603590fc75699d98014fd79f3bfb8ea051e70180
SSDEEP

24576:U2G/nvxW3Ww0tEiau4VjR/qCUzDG6bNUa1BMJWl:UbA30klYS6b26

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 37 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4248	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	1612	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	1612	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	1612	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	1612	schtasks.exe

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Windows\syscom32.exe	dcrat
C:\Windows\syscom32.exe	dcrat
behavioral2/memory/1724-145-0x0000000000A90000-0x0000000000B66000-memory.dmp	dcrat
C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe	dcrat
C:\Program Files\Windows Sidebar\Registry.exe	dcrat
C:\Program Files\Windows Sidebar\Registry.exe	dcrat
C:\odt\SppExtComObj.exe	dcrat
C:\odt\spoolsv.exe	dcrat
C:\Program Files\Windows Mail\wininit.exe	dcrat
C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe	dcrat
C:\Windows\security\EDP\Logs\csrss.exe	dcrat
C:\Program Files (x86)\Common Files\conhost.exe	dcrat
C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe	dcrat
C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe	dcrat
C:\Recovery\WindowsRE\RuntimeBroker.exe	dcrat
C:\USERS\PUBLIC\DESKTOP\CONHOST.EXE	dcrat

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exesyscom32.exeFortnite.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	syscom32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Fortnite.exe

Executes dropped EXE 2 IoCs

Processes:

syscom32.exeRegistry.exe

pid process

1724 syscom32.exe
3904 Registry.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

Registry.exe

description ioc process

File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf Registry.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe

description	ioc	process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	Registry.exe

Drops file in Program Files directory 64 IoCs

Processes:

Registry.exe

description	ioc	process
File opened for modification	C:\Program Files\Internet Explorer\IEShims.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\Native3d.TextureRendererPixelShader.cso	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.ViewModel.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ArchiveToastQuickAction.scale-80.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-100.png	Registry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui	Registry.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-16.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightCalendar_2017-03.gif	Registry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	Registry.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-150.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\MicrosoftLogo.scale-200.png	Registry.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msadcor.dll	Registry.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-black_scale-200.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\resources.pri	Registry.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-200.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\StandardShader.vs.cso	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-100_contrast-white.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-150.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-200.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-200.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\29.jpg	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-400_contrast-white.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-lightunplated.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-100.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\ControlStyles.xbf	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-36_altform-unplated.png	Registry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-black_scale-125.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80.png	Registry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\OperationValidationResources.psd1	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-colorize.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-100.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.scale-200.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-16.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-125.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-80.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks_webp.winmd	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-60.png	Registry.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-48_altform-unplated_contrast-black.png	Registry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\omsautintlimm.dll	Registry.exe

Drops file in Windows directory 64 IoCs

Processes:

Registry.exe

description	ioc	process
File opened for modification	C:\Windows\PolicyDefinitions\en-US\srm-fci.adml	Registry.exe
File opened for modification	C:\Windows\Cursors\aero_working_xl.ani	Registry.exe
File opened for modification	C:\Windows\Fonts\LeelUIsl.ttf	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\mscorrc.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\de\PresentationFramework.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.ServiceModel.Routing.resources.dll	Registry.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Storage-QoS-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	Registry.exe
File opened for modification	C:\Windows\INF\.NETFramework\040C\corperfmonsymbols_d.ini	Registry.exe
File opened for modification	C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini	Registry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcp100_x86	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.tlb	Registry.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\WirelessDisplay.adml	Registry.exe
File opened for modification	C:\Windows\rescache\_merged\24768367\1765378471.pri	Registry.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\ja-JP\DiagPackage.dll.mui	Registry.exe
File opened for modification	C:\Windows\INF\PerceptionSimulationSixDofModels.inf	Registry.exe
File opened for modification	C:\Windows\Globalization\Sorting\SortDefault.nls	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\ServiceModelPerformanceCounters.dll.mui	Registry.exe
File opened for modification	C:\Windows\Boot\DVD\EFI\BCD	Registry.exe
File opened for modification	C:\Windows\Fonts\courfe.fon	Registry.exe
File opened for modification	C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.TextToSpeech~el-gr~1.0.mum	Registry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64	Registry.exe
File opened for modification	C:\Windows\PLA\Reports\de-DE\Report.System.Configuration.xml	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\aspnet_compiler.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CustomMarshalers.dll	Registry.exe
File opened for modification	C:\Windows\servicing\de-DE\CbsMsg.dll.mui	Registry.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Host-Devices-EmulatedChipset-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	Registry.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\indexa.dat	Registry.exe
File opened for modification	C:\Windows\Boot\EFI\uk-UA\bootmgr.efi.mui	Registry.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\Kerberos.adml	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.RunTime.Serialization.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr-FR\ServiceModelEvents.dll.mui	Registry.exe
File opened for modification	C:\Windows\INF\MSDTC\0411\msdtcprf.ini	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.DirectoryServices.Protocols.resources.dll	Registry.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-RDP4VS-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.84.cat	Registry.exe
File opened for modification	C:\Windows\diagnostics\system\Power\en-US\RS_Adjustwirelessadaptersettings.psd1	Registry.exe
File opened for modification	C:\Windows\INF\sti.inf	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\mscorrc.dll	Registry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Device.resources.dll	Registry.exe
File opened for modification	C:\Windows\PolicyDefinitions\WindowsExplorer.admx	Registry.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\RS_IESecuritylevels.ps1	Registry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\wide.TimeLanguage.png	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\CustomMarshalers.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.DirectoryServices.resources.dll	Registry.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	Registry.exe
File opened for modification	C:\Windows\Cursors\pin_im.cur	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.ServiceProcess.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.default	Registry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\logo.png	Registry.exe
File opened for modification	C:\Windows\INF\pmem.inf	Registry.exe
File opened for modification	C:\Windows\INF\netmyk64.inf	Registry.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-IsolatedVM-SVC-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\ServiceModelEvents.dll.mui	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\en-US\PresentationHostDLL.dll.mui	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Windows.Forms.resources.dll	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Runtime.Caching.resources.dll	Registry.exe
File opened for modification	C:\Windows\InputMethod\CHS\ChsPinyinHAP.lex	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\Microsoft.VisualBasic.Compatibility.resources.dll	Registry.exe
File opened for modification	C:\Windows\INF\c_scmdisk.inf	Registry.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\aspnet_regbrowsers.resources.dll	Registry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 2244 WerFault.exe StartMenuExperienceHost.exe

pid	pid_target	process	target process
1352	2244	WerFault.exe	StartMenuExperienceHost.exe

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1872	schtasks.exe
4032	schtasks.exe
560	schtasks.exe
1312	schtasks.exe
3736	schtasks.exe
1508	schtasks.exe
3876	schtasks.exe
2204	schtasks.exe
2652	schtasks.exe
3844	schtasks.exe
4200	schtasks.exe
2216	schtasks.exe
640	schtasks.exe
432	schtasks.exe
4848	schtasks.exe
3252	schtasks.exe
2472	schtasks.exe
4444	schtasks.exe
916	schtasks.exe
1156	schtasks.exe
1044	schtasks.exe
4620	schtasks.exe
4228	schtasks.exe
2128	schtasks.exe
4648	schtasks.exe
496	schtasks.exe
4852	schtasks.exe
4688	schtasks.exe
3292	schtasks.exe
5104	schtasks.exe
948	schtasks.exe
1464	schtasks.exe
552	schtasks.exe

Modifies registry class 10 IoCs

Processes:

syscom32.exeexplorer.exeFortnite.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	syscom32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4238149048-355649189-894321705-1000\{4AB405A9-9883-40BE-86E3-583383343ECB}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	Fortnite.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4000 reg.exe

pid	process
4000	reg.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

syscom32.exeRegistry.exe

pid	process
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
1724	syscom32.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe
3904	Registry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Registry.exe

pid process

3904 Registry.exe

pid	process
3904	Registry.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

syscom32.exeRegistry.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1724	syscom32.exe
Token: SeDebugPrivilege	3904	Registry.exe
Token: SeShutdownPrivilege	4632	explorer.exe
Token: SeCreatePagefilePrivilege	4632	explorer.exe
Token: SeShutdownPrivilege	4632	explorer.exe
Token: SeCreatePagefilePrivilege	4632	explorer.exe
Token: SeShutdownPrivilege	4632	explorer.exe
Token: SeCreatePagefilePrivilege	4632	explorer.exe
Token: SeShutdownPrivilege	4632	explorer.exe
Token: SeCreatePagefilePrivilege	4632	explorer.exe
Token: SeShutdownPrivilege	4632	explorer.exe
Token: SeCreatePagefilePrivilege	4632	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

explorer.exe

pid process

4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

explorer.exe

pid	process
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Fortnite.exeWScript.execmd.exesyscom32.execmd.exeRegistry.execmd.exe

description	pid	process	target process
PID 3420 wrote to memory of 3780	3420	Fortnite.exe	WScript.exe
PID 3420 wrote to memory of 3780	3420	Fortnite.exe	WScript.exe
PID 3420 wrote to memory of 3780	3420	Fortnite.exe	WScript.exe
PID 3780 wrote to memory of 5112	3780	WScript.exe	cmd.exe
PID 3780 wrote to memory of 5112	3780	WScript.exe	cmd.exe
PID 3780 wrote to memory of 5112	3780	WScript.exe	cmd.exe
PID 5112 wrote to memory of 1724	5112	cmd.exe	syscom32.exe
PID 5112 wrote to memory of 1724	5112	cmd.exe	syscom32.exe
PID 1724 wrote to memory of 4992	1724	syscom32.exe	cmd.exe
PID 1724 wrote to memory of 4992	1724	syscom32.exe	cmd.exe
PID 5112 wrote to memory of 4000	5112	cmd.exe	reg.exe
PID 5112 wrote to memory of 4000	5112	cmd.exe	reg.exe
PID 5112 wrote to memory of 4000	5112	cmd.exe	reg.exe
PID 4992 wrote to memory of 3104	4992	cmd.exe	w32tm.exe
PID 4992 wrote to memory of 3104	4992	cmd.exe	w32tm.exe
PID 4992 wrote to memory of 3904	4992	cmd.exe	Registry.exe
PID 4992 wrote to memory of 3904	4992	cmd.exe	Registry.exe
PID 3904 wrote to memory of 4984	3904	Registry.exe	cmd.exe
PID 3904 wrote to memory of 4984	3904	Registry.exe	cmd.exe
PID 4984 wrote to memory of 4216	4984	cmd.exe	chcp.com
PID 4984 wrote to memory of 4216	4984	cmd.exe	chcp.com
PID 4984 wrote to memory of 1708	4984	cmd.exe	Taskmgr.exe
PID 4984 wrote to memory of 1708	4984	cmd.exe	Taskmgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\wJSrXid0UUwHHOMygNV3xLBKK.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\kkLuA.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\syscom32.exe
"C:\Windows\syscom32.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bc5KfCiDAt.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:3104

C:\Program Files\Windows Sidebar\Registry.exe
"C:\Program Files\Windows Sidebar\Registry.exe"
6⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /K CHCP 437
7⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\system32\chcp.com
CHCP 437
8⤵
PID:4216

C:\Windows\system32\Taskmgr.exe
taskmgr
8⤵
PID:1708

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
7⤵
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat" "
7⤵
PID:1984

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:4100

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\security\EDP\Logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\security\EDP\Logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\security\EDP\Logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2244

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2244 -s 1808
2⤵
- Program crash
PID:1352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2244 -ip 2244
1⤵
PID:4460

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 MicrosoftWindows.Client.CBS_cw5n1h2txyewy
1⤵
PID:3776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:4556

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
1⤵
PID:2980

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1980

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 MicrosoftWindows.Client.CBS_cw5n1h2txyewy
1⤵
PID:3892

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
1⤵
PID:1216

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
1⤵
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "Registry" /f
1⤵
- Process spawned unexpected child process
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RegistryR" /f
1⤵
- Process spawned unexpected child process
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "Registry" /f
1⤵
- Process spawned unexpected child process
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RegistryR" /f
1⤵
- Process spawned unexpected child process
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\088424020bedd6
Filesize
295B

MD5
75ddaebca29a6c52664b5bd3ca608e65

SHA1
4182214e2da05117ec94d9ff344c130033970385

SHA256
737f3f286dbb67045e6110f05109fc6ebcbfaeda81491d674aba3e63f2b20df9

SHA512
923ae6a36517ec6e1406d72367bd48dfd240342d21666dfbe076f79055e30ecf8b11cc3c174f4dd45502b039a810c588fbede25f81aeace74f1e71094cf8b87c

Download Submit
C:\Program Files (x86)\Common Files\conhost.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files (x86)\Windows Media Player\en-US\5b884080fd4f94
Filesize
430B

MD5
3c41dbdf234cdad230e2941781cfd9a6

SHA1
1551ce98e983fe6c0f85b2e7faf05be226f1a230

SHA256
9d1c962f7fd5084430102c2f8ac1f8f149dd43cfbf86eccf49fb20a0506972f3

SHA512
f5ece6bc889e32fb9f2e3129aeac1cbd110f6e06646908188f526b35e1852b0159d710b240d3217034de895553c7b303112d34e9e4daa53ed20c285bac0cc458

Download Submit
C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\en-US\6203df4a6bafc7
Filesize
222B

MD5
c49dd6adf3afbf4c657adfd11c92aac7

SHA1
0f3e29437980a82a2e79a1cbb3d14fee9bd1cbaa

SHA256
3c7ee9c98d42ddb7f51184dbcd9f7f4fddce963047f7880e92bf50bd1681b9cb

SHA512
eef95f28efb09e4b1384bb152d3b7afdd9fc0656639733cb6ea17528526e0cde187dd8b1c6ba944e10024810fe7ac06c3490bca2c3aeb898d2cbebfbc244c6e7

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files\Windows Mail\56085415360792
Filesize
72B

MD5
f03f58d041db86c4f4d68934b4e0e636

SHA1
cba89a01ed89af4062f8c8f980e4e8f8bfe6a86f

SHA256
552482a8ba0347bae01caa133f75e78916a4dc0953be88e0bc93dba97cc0d659

SHA512
1d8038b02c648770a00751c57da97dcf476560df1cab86981467f89679ded15a1f341f73dab5d3a39a51aec74d81c965a12f55b5d7f258eb0600ba120610f961

Download Submit
C:\Program Files\Windows Mail\wininit.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\55b276f4edf653
Filesize
872B

MD5
b0c41728597ddad7c58123fb7e63c6a7

SHA1
3bafa2dca2647fef608a5c106232a162edc72837

SHA256
b2daf3509bcb3b94a025ed2a3d5ce902891f536df34c63f5157edcd874a30b76

SHA512
e237bf4e44f13b7d7c9bb1ca8d9050966001d608e76d2cfce5e3a32468717601b800859a1162061a8fe03d30456c9bab2af768bee265001dbb8de7ce4fac53ea

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files\Windows Sidebar\Registry.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files\Windows Sidebar\Registry.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Program Files\Windows Sidebar\ee2ad38f3d4382
Filesize
13B

MD5
708d439d6ff0ab5c893e07a450f9425e

SHA1
8864caa87b35a616d9bb2768e8fc72ea62ea3225

SHA256
ce6bcbe91c2a05d0dd9944436e82a4be6099a82f1bb1cfb7ac81567b1f3b77a8

SHA512
50ed144b48052ef172dd6ec9a88cc415e915a19733c5f75ab30beddd08d8a968bbfff21d2b4db27b32fc058fcd2e3befd666a754ab1041934da6ced4f36b7f1c

Download Submit
C:\Recovery\WindowsRE\9e8d7a4ca61bd9
Filesize
708B

MD5
7564203cccc11485158651d7621b0633

SHA1
f5a82e976dcb9cf63f5348563d05ae86c8276589

SHA256
6fb47e6bbda305ef20443219224a7372455c72a2a7201dc7dbe58524269d9304

SHA512
cfb05885de77aebefb89e67c05f9f89cf82a284258f947b1ffca9efffb4e094cde2fa3a669f2ff68e7fd3f9bf5c6e8ff20ff07293e6a844fbb3d6a45379675bf

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\USERS\PUBLIC\DESKTOP\088424020BEDD6
Filesize
94B

MD5
ce1dcec41175a05e7f7717ecc51088ea

SHA1
2d7fd5b56bc0091211ff8c56fd232a45e8669d48

SHA256
819d4a09e8a8f8c3276ec945feb2395e381874151af37d8e5a6e92a8febdeebc

SHA512
a84cdae5afdfb92c5f5207bb14b972fd0897a982d3dba92fc3b0f9989a83644cc583a0542695bb0666f20411452f9ce92ea7787686ef56900476c3f7acc94619

Download Submit
C:\USERS\PUBLIC\DESKTOP\CONHOST.EXE
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\syscom32.exe.log
Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
Filesize
174B

MD5
e0fd7e6b4853592ac9ac73df9d83783f

SHA1
2834e77dfa1269ddad948b87d88887e84179594a

SHA256
feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

SHA512
289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Filesize
44KB

MD5
78baa6cc4884432842f645c9bbb51ff7

SHA1
d37283ae0cb9a2f4ff05c8751006dc664958544f

SHA256
6e607b1eb635214ee68497a35f59b13da630ba5e1cfa786cc4dc2db233497334

SHA512
e950099a21d237f3de18d0fa693233ad8537842b33563e3b4f6458ed7fb5f36b8cddcc122e68f6a9ca337c08ed222192d94c734768653a7c64748dae28833329

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HKSWY2PS\microsoft.windows[1].xml
Filesize
97B

MD5
6db89d94548a4020333e385020895ca4

SHA1
8cd6a83e0812bc065d1bee6bb7a910856f7db10e

SHA256
cc5dcc5c2caa45157bdd40c5b76f78b68e3e4795cef6a5fd6e7e04d0c5eb0575

SHA512
917fde745f969e659c1b04028edef22494cce3f6314af8ed83c0c86a3812ccf3133c45ddbe31ec9dfb2a493a34ce8c1aa5dac5d5725108227ba94d622cd94ea3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a0561dd-b842-442e-9278-26a5da5ed655}\0.0.filtertrie.intermediate.txt
Filesize
1KB

MD5
9913dee3ab28ad6ebd60b930d6ee8da3

SHA1
6e6327df9f85d9037d83a4f537f32541f46a1dbc

SHA256
3bfac338a56813338b62dba88261ff9b1aa7e505af5f7a50ab9960a35f6ed5e4

SHA512
e7dead4ccbd7468e7d3d1cc930be40bc5fa0a881b406318bd56346b27651c3a58611c086b369de641f058af5748fa02eb5e02b9f482ff2443d2fbf442c04188d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a0561dd-b842-442e-9278-26a5da5ed655}\0.1.filtertrie.intermediate.txt
Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a0561dd-b842-442e-9278-26a5da5ed655}\0.2.filtertrie.intermediate.txt
Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a0561dd-b842-442e-9278-26a5da5ed655}\Apps.ft
Filesize
2KB

MD5
ae92d8e34c6863d31010632e1472cd7e

SHA1
b6a286b8bc20d4b8fa1b29d234d71a89d696de9a

SHA256
ed6fdb649852ae050e65b42f4b2f0151f06aeb57f58aee36818fd6925ce1e217

SHA512
589e9ee259b2efe4cd4d94307075850274d324ba4232d2870ba4bf8fc570ad0b2d9b9ba1ea31f9aa81615b144c61418c6d09d6b24200a5d16b01eb36450e5eab

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a0561dd-b842-442e-9278-26a5da5ed655}\Apps.index
Filesize
881KB

MD5
832fb9cd22b122f6c9d68f9f4fcc3424

SHA1
d398a299d12f6aeb005c724d1abd62edebabbac3

SHA256
e439f475eb0b32c6dfc9fc485c979b3e15126b54995e2ff9719bc4aa1910339a

SHA512
ba9e934a0880d09c4675d012215001feb282beca68d6c9885caaaabb31d6d3ef32bfb0d48cc9132bb977eee64ade2245fba29c6d5878e9dc9d3c740268d47922

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e983e5d7-a8a4-42af-a760-abd5e221e239}\apps.csg
Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e983e5d7-a8a4-42af-a760-abd5e221e239}\apps.schema
Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e983e5d7-a8a4-42af-a760-abd5e221e239}\appsconversions.txt
Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e983e5d7-a8a4-42af-a760-abd5e221e239}\appsglobals.txt
Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e983e5d7-a8a4-42af-a760-abd5e221e239}\appssynonyms.txt
Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133303915336685922.txt
Filesize
2KB

MD5
ecaea544af9da1114077b951d8cb520d

SHA1
5820b2d71e7b2543cf1804eb91716c4e9f732fde

SHA256
9117b26ab2c8fdbb8223fe1f2d1770c50a6cf0d9849a5849d6aebcbe90435be6

SHA512
dc7bedbc581818011aa2d313429f234b12e5e9cf320b02b8d7ceeaf9cdc1c921ffc51af7f4080b02740f2d2146fbb006ccbf37cdcba3e3a10009142daffdb919

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize
1KB

MD5
e9d7d0c14d3eead94c69916ea9a6604b

SHA1
ca8f22d9d9b4163cd7604aff27442946534c17d2

SHA256
085f51307bbc7a14e4598e274ff342ba1e7e940d63f6690b26fdbce0cd9303f8

SHA512
a2cc213d9fdd7ed764283df6bf34eda9f9e44464b52e2f6079e479220cd69c133afbf9d29374ba16ac6c536c104c5d325af8c222c0e9a7d32eafc81a30b6ae04

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize
1KB

MD5
2b22450c37a3272b912e7923b23d8c6c

SHA1
ad154114b1f98486d8df582012e0c483d80e33d4

SHA256
84de0b88f7e19173616cd164cc34bca4c84626e57bb31e9857722c3f8632f69d

SHA512
a7a397a0a7e765fc62acaba418cf014a2f4a16f4123395e108624afca0a6f12853a62fa16a21a669cca431cf4b4dfb89074e0af9682b40ff0fc06b6b99396526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bc5KfCiDAt.bat
Filesize
210B

MD5
7a7d56e4d7090b9566ef4a3c6ac7b156

SHA1
b6956435df22e20d6c67b47cb663a5ac1a442346

SHA256
fcd844b8a01e80c4d369d6ef1a90616ea225406190ff7a8193927ce882a13c12

SHA512
cc0e91e9216748928750b680a53e5c11ceff07e3d9d314dc9d67212a74f5a953054ae30cc6788440eef8374f34baadf402820e313a41fd5c47e38df6e01f981b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat
Filesize
278B

MD5
26a28b577b73baa639b6c1c369efe3ee

SHA1
bacb65791df7438b19e59b4f38d04a082fe61178

SHA256
60ef7741a081436f388dfca30c5e23170a82d6007359a47d9f8dbbc3914d649a

SHA512
5b1829f4c67a662c7aa42db510a71455694fbc01fe2157f44c15c7e9268b039f4200b2bf5a35448017887e8bce176ddf4dcf8c3cdb5b85a62c514b1988f07d41

Download Submit
C:\Windows\INF\acpi.PNF
Filesize
10KB

MD5
3ce242c8db015f609038f72496be55a6

SHA1
266dbf6ddf55ad93057710f52472f671ac0d426e

SHA256
d5a2e501f68e350d2dca3d3ad4f279cc6393ebfd1d048f3ca85c0c2517f9725b

SHA512
fe9d68ddc0975430618689610d90f6c326e48b26f8dbda8940ac762e1fc19c6da38114981780c8a8737177e505961bf5a8aa5a73a9fa8fbfecce405fe321965f

Download Submit
C:\Windows\INF\basicdisplay.PNF
Filesize
7KB

MD5
25c29c02c6cd04b7e3f00cd2a8d7f256

SHA1
97e3a8fece5274d91f962e5c54c022b929e9741a

SHA256
8813fcf203e554227571585880140dfc7d1c07d5374da0ad1f11782e314af5a1

SHA512
63989991405c9e435fa8d0f5107d72936fd41b34eea51b814b209e4f86021f5e656a3445b3504f0566319c1d221803cfba85cc76049db41a57b945b96b2aa8c9

Download Submit
C:\Windows\INF\basicrender.PNF
Filesize
7KB

MD5
ef298180fe6d90ffb19ca188643854ca

SHA1
332754d77b289440d7f28656306d10c6d46bec9f

SHA256
91cd021afc6d538bb77714d27015a62f9c0ec10ae261c25ed9e9b13c572bb07d

SHA512
f5f1d87e4073014db996e3573544b6ae634bf56f56923510e377e1adfb4e88998cc52d73a90c363111e21a4b792971d65b7810cae9245c8428c3b8298bb95c00

Download Submit
C:\Windows\INF\cdrom.PNF
Filesize
11KB

MD5
85780e5845fa90cee922baace3b47665

SHA1
8d324e081faf5d17d45298f5d7c789bf6deebeb4

SHA256
7e6f6bbbefbf3fb7cc3d6c95109d619198aa2b4bb35a2d725034596139da9601

SHA512
57f823364e90e475625ff49dfc64a48936284138dfeafbcf1d15995f7975c93e0d1c22da7c5b8a94c854037c81f2d017de76ef02961259bb3d2d2e984f67ba55

Download Submit
C:\Windows\INF\compositebus.PNF
Filesize
7KB

MD5
4339aa8229777b145dfa7bb052b31766

SHA1
1649f9addff2e084be1edff65f02325f9bea3161

SHA256
c1339c8e1a24a1fb9e36c77a25f7e6ae66ce75f32c29add51a66084f9f619317

SHA512
e424166c1209a62a91507479fcd3de44234c730c243ddb8a9e1e7feacacdf90021db8e3cfeb85884f4a308949fd6f9554474bc3ee1e6a4cd0310db8eeaea6d0a

Download Submit
C:\Windows\INF\display.PNF
Filesize
7KB

MD5
35b11e024ed5bf51bb6fc623019cd37f

SHA1
e719471d7d7c47e323e19f024fb96b5e566f1cbb

SHA256
b5050d2139fb4dc5e6b76d61b55e44ed3a7d48547777fad60db8c03c859a1775

SHA512
a6515a3c41de4495929ae0420acdc8e903a1b12214f9cace3dd5c0d777c9fedf426c8a14d55b41b191ec15a16198aa8e4e4b99491b673c6ae8c7f02d4624b418

Download Submit
C:\Windows\INF\hal.PNF
Filesize
5KB

MD5
7a61ed18dbc6c43e741167a11e774ff6

SHA1
475ae86ea2c60248b04bb79f0aaa601ea42e9859

SHA256
651496583971a2995b32d03e5c29d428263cad6b540c7f8c961df5d4ec3dbef5

SHA512
a7c0a2c53907631d372d485ba75254527cfdab3973d97be4299203ccf2bed0fb73f800956bfea91c1a2eb5d25ea12b85eed10c08336b0370ec3371fc8f0abc9e

Download Submit
C:\Windows\INF\hdaudbus.PNF
Filesize
9KB

MD5
6789afec1cf920ebc73ce376bbc8d175

SHA1
c9f7202e1c6a777f9b0304222630555b110abfdb

SHA256
932201797c953e82216e9af7032c56ced73e9b27081373e4ffca5286ecb83b99

SHA512
868235f29cbca5c6f1469ae9dc75af6f58c9cb415597e15c68110cdfc6a05f3f95e13074ad0ca41a4e282df1291032e46a6cee2f37ad8ecd8d66c9166e219c25

Download Submit
C:\Windows\INF\hdaudio.PNF
Filesize
94KB

MD5
2509c448160f8e514ac27aa960284d76

SHA1
e9781939ae7c726e84ec78065354e97c2b686445

SHA256
16bb0dfe5ff6919fce45181afe51b81e72561bb245b2ca0794cd21f4a19dc55a

SHA512
c07bd4b4564fd165bbffddcf891fdd5a5b5dfe0169f2117f674dd440957f347bd0af509f376ac176d2c40ab40dd795f9f22edebb2508dce456369504e22d4222

Download Submit
C:\Windows\INF\input.PNF
Filesize
138KB

MD5
e7579dd05b878f8d62f3b39cf8efd720

SHA1
d62ec97d3ded6ce775c8ddc5f6b44167f0f2e71c

SHA256
068d1e41daa2037b33eadd295dabf9334a36dad4f08f1bd093db37fb24b79e44

SHA512
feb11d6636f3f85fb27fb48ecd8c9641b7964ba7e5608f40989741628720f2a9bf6fdada6e5e2abca6eba7ef6d580b482e1601327083f90059043a0bfa0d79bc

Download Submit
C:\Windows\INF\keyboard.PNF
Filesize
109KB

MD5
d067d976ad1b5cc7e5a198fcf90de878

SHA1
f53e413b4d27806bd32f4dc8d983eb1d27629f79

SHA256
88b785449391aeca5d7a3b982ab76b99c97a95453a7c1d59d2750bc5f53a1829

SHA512
2be7f89343ae009aa3d4176f7d30dd99043aa8d7b916823a319a0c9ce29c66e00758e21ce2b1fe702a621361df563d6b3ccbe44ebacfa2511b0d9aa853fd859d

Download Submit
C:\Windows\INF\machine.PNF
Filesize
150KB

MD5
c7c396686626fbf3a17ac147e1e54e7a

SHA1
d047e0f56e343d83ce6f41d026ca6da2ba14a3db

SHA256
d9472bc3bd04d063f3ca1b3b72b727c594a621f7114654774410888b7785c3f2

SHA512
eb89629ac5a6d4185650cbdf35b90969dca1294d9c62bc943bf39885651b5e522f8bc46d20743d62c56148b59432e6df0b05c08fce1aa64fb8bb3ab4f732e871

Download Submit
C:\Windows\INF\machine.PNF
Filesize
150KB

MD5
c7c396686626fbf3a17ac147e1e54e7a

SHA1
d047e0f56e343d83ce6f41d026ca6da2ba14a3db

SHA256
d9472bc3bd04d063f3ca1b3b72b727c594a621f7114654774410888b7785c3f2

SHA512
eb89629ac5a6d4185650cbdf35b90969dca1294d9c62bc943bf39885651b5e522f8bc46d20743d62c56148b59432e6df0b05c08fce1aa64fb8bb3ab4f732e871

Download Submit
C:\Windows\INF\monitor.PNF
Filesize
1.1MB

MD5
26f8120ddf6755c54123eb72df367fea

SHA1
febcb1e42c0f22f837d10bef495e1d72233cfb82

SHA256
f85dd7ed62e13ef33620516864670ea6bdd77242453b799061e9cd652dceb40f

SHA512
044da694d403ed4a221406f39fef310346964b3f2b55525ba7c10195aa5d5a17427b31db762cbd6db7682cb2359019b5dd1c5dde70f569420ae76fb7c4b6525a

Download Submit
C:\Windows\INF\mshdc.PNF
Filesize
64KB

MD5
520c44412e24b66159fe4feb507194c2

SHA1
261276195996a56d36ca102ebe4c231dc4647074

SHA256
714f4e41907dec6ab07299b59ba8fe80747702a1aba65e6464e8110123c2c78f

SHA512
bc9b7c1d2d75d8d2e4323f2a7b33248871e6a6a0f8e113921b0b693a447d855e4bd5d998128fc68c0426ca626396dce6681cc6868f09aaa4f74a7fc24ecaee15

Download Submit
C:\Windows\INF\msmouse.PNF
Filesize
89KB

MD5
d09b4ed753cb718ba7384ee8f09c3567

SHA1
e52051f92bc6f5e66c8789b97a2ba1f76222336c

SHA256
69e5ef428c09af5906f1b88fffeae4c7777b75beaed2b545fd9c8fce9f96bdbe

SHA512
459504eb4c39de2b4a04cda25007df94a327bb9a0d4c2908844bab408e40fb760a0640cd6ee3f613919275dafc194d02811c2dc4a0ca2c185fc360f4be3466cf

Download Submit
C:\Windows\INF\mssmbios.PNF
Filesize
7KB

MD5
516d5e9ff249b267bd2f6a5041cdd198

SHA1
b11d0340cefec34320f3e47f8349ffbf0e625f11

SHA256
9327bc50797a5c7d3c6a171193a1fa32308cb822d190c13f7c7e99658b9f472e

SHA512
3c80f832664ed3a26aaff1fb3051ea44b893208b51346b72e556604ae763b1adc0ac348055dd5eb7523fdb48ea4ebf88fab9ede9a4094458b498bdb0069eb238

Download Submit
C:\Windows\INF\ndisvirtualbus.PNF
Filesize
6KB

MD5
cadcb0b3258e2adf1ab63a2a38da1cac

SHA1
29f2cc4ed8f60bf24ec969343fa0f1884ab617e5

SHA256
db2ad5f22b3822fda3d962d6e4f2f2236060d1d8593d446a117a8f37d3bab4bb

SHA512
78f4601acc0a01f3b9c40948b6b7467d291d6ec9c16fe0e8f8607dc61e2cf4d2273eadc596f7cb1b24563548129c20ca4a7037c1b9f3fced5956c3d7567a2829

Download Submit
C:\Windows\INF\pci.PNF
Filesize
20KB

MD5
471a0c70c736a75d5831c87563d30435

SHA1
4d0992ae1257bb048029561f71ce3ae1e7470215

SHA256
fb0f1f3980dac90ddf4ef6aca2718268129d14e726c0924974ecb2b2b9130cef

SHA512
a59d1eae43bf47de2358f8fa78c84da39d0300fde5e230700b85c74c1fa4e5c8e1ed569677ef262362dbf982f3383ef998c006814d1acee2b7b10f74af03e6f7

Download Submit
C:\Windows\INF\rdpbus.PNF
Filesize
7KB

MD5
3836912c38d6b3d422dce3bbb4bc701c

SHA1
3da744397553b987f88f0c023fee38c3bcfc8197

SHA256
e5f7d54d3011e9504ed31806419d36b63c97cba25c07b663a5382b4cb26f08e8

SHA512
7b69bcfccb045aaed035326b49eec47ff0d40dc7c07a01b8c34eda65f3a7432ab73c6697f67ee7873569a4d293ad1069fec2159660a4000baa50473ebbe382cb

Download Submit
C:\Windows\INF\spaceport.PNF
Filesize
7KB

MD5
d3137e5bde600f9c9f102ec2be3d8e15

SHA1
5a39dc9f871b05b6de1109120aafb1e69cd38cc1

SHA256
d15323886ecbd437daf7f9c6135508ea47a524cfaa0b7fe14ebcda4a06bbd933

SHA512
b744b88e3845cc3ba77c7b1df2e99248ee501a5465a0164e5b01765d1db7da614ffe63e925dea8135f276750f3542406ce8ab254a03acbe9b3409a5a42232c92

Download Submit
C:\Windows\INF\swenum.PNF
Filesize
7KB

MD5
c4be1b8fda21efff0a6e4f0ec7742343

SHA1
8ce5457b033dc7ccc421cc0139cef5d9bf3899aa

SHA256
3db28b90ca95c16a658c18a7c00c6ccec6b0aabe4721902c962941f27f610efc

SHA512
d52cf19c6b5f3000d76f62ff0a7d0e6080519fc886a379409eba418dc49275315e8a9cf333c5667b0245342a8ca6824a169209bfcbd33ff8d5c06d2419f6f4c6

Download Submit
C:\Windows\INF\umbus.PNF
Filesize
9KB

MD5
4c9cc46e4583dad8cfb9f6d60ec630cd

SHA1
3fc1c76b3f6777c694ca9ad89ce42d51b2665d56

SHA256
fde39c66aa4d00ca31569524f969bdb004cf4c4313617cfbd675da8406cc44f2

SHA512
39086a39421942b0322f10ab6c667f5cb599452827abd274e2100719f16c932178e0044378a976a05cc3807e2cf7ae53a42b49661859b610a3b3eaa024cd0083

Download Submit
C:\Windows\INF\usbport.PNF
Filesize
131KB

MD5
2c193da55feed76bb08f7305f038f3de

SHA1
c0ce2c816867365c4c9561456e9ecd566b3c0e4f

SHA256
6dab95ccff7a8f6777a0d14c28249a22be7e47bf59f30cd7eb0b7afd1693b5b4

SHA512
5a142fb9247839b2921380e8d032e9b8bbd71c0be5df216d2e22cdcfd12f77057ae00436e9158d4373f080783300e9591e3f601321b99d6f711e3a9962718eb3

Download Submit
C:\Windows\INF\vdrvroot.PNF
Filesize
7KB

MD5
ac2654ef29e8de981eaeb699d053e81a

SHA1
9a6ef9200d42929d62d2bfc57147323da94508bc

SHA256
b89da7df096818d95a6d9cb21b43b0b07fdf82ab1bb9022d5ef2bbfe53c5cdd4

SHA512
c4a0113aca9f0c057e043198033c81704bf808385a3ec935bcc7c4d7c4cec13a65c952bcbefb6eecb2b38345167f3deee5dc80459e981534e1ff963cdbe610e5

Download Submit
C:\Windows\INF\vhdmp.PNF
Filesize
7KB

MD5
816dee2f457fbe98698decd941c4d9a3

SHA1
9c2e5e05e1f0d60f06e0e25889f0ee67986847bc

SHA256
fbc90402ee565b9e4635bdd4128ee20bf98129972796161d7498378d4d4674b2

SHA512
c6adf1851243205dbde096dbb48913e48440536bd60acf6948c1a76c56d9aa4f303f52f5e16387da5aac69a5dd6df428d217c4113f9d784cb72b040e583972b3

Download Submit
C:\Windows\INF\volmgr.PNF
Filesize
8KB

MD5
375a22ff0f81b1ced420a6747ab1b13e

SHA1
b46ef64175840d56fc9ecc528561d7826669a4ae

SHA256
e3a2eb9da6ac6dc05dddb677149ae272a822733ceb0741d277845fa7681e293a

SHA512
d5158edfe74022478733f0e6f4b311c04da7d6c96fd72e4f2b72688f5e501fbfc449e5659225efe9e647ead0ff6528e5e695196013a438b3a67c7f133fe576ce

Download Submit
C:\Windows\INF\volsnap.PNF
Filesize
5KB

MD5
d41560a0e78bc6a89efa4bd4b6a13c17

SHA1
b66a1cfd13f0ba1ece73fe04602aad8e372a19ef

SHA256
08fd030bc27787019d453a2371a3b0e72cd05f31f48faf8b2aecca9f68f686ad

SHA512
6deb6b0896f65b4ebcee110a79c472a687a57060670f616729e06737a9dd91439ea6e393aba15b754072925ff1c71fc16ef680e7cd22a4721ec77d693316816b

Download Submit
C:\Windows\INF\volume.PNF
Filesize
5KB

MD5
cf3446cf77c9e1466208dbeed4261264

SHA1
2e0d09e67d664996a0fcc01505bc2793255abc3e

SHA256
5fa2266264e5b9ad316dd6c28e2f3a084ddcdfe07e3202a66e971b4821d62762

SHA512
ee84250ad9435b65fd3348ccd2d4a7c7b06d5483100a35cc8912cdb74f412b6c1bb2e4a83717d0d354d7a5b4e3e7e9261ae02fed946cd35196be5271a55400a8

Download Submit
C:\Windows\INF\wvid.PNF
Filesize
9KB

MD5
ca9dfd15c73637a89f00fcc61ffab2fb

SHA1
f9ba5a431076c278b729b9d8b589340c027cd9c4

SHA256
4103dfbc1bcf66e6ddbd562b24c17c81606844449c77f90d596fe167bbd12cac

SHA512
4aae087d2382e47a41e3f938c94a66837ed9671d3b5c023d5c82feb5f57234b98eb12bfa2780a06a15eca07aa989d47dccc069db0d65e029b7952dd780696b6c

Download Submit
C:\Windows\kkLuA.bat
Filesize
137B

MD5
eddbf02b8f63229a6f4670d77d49f965

SHA1
84dc5aa13c3a7144742df74e28da6a7ad9177a69

SHA256
12646d50947198b1c27be43e89905ce71902c186c21f1abbe0dc16919d4ce7ae

SHA512
be87f2ec9e7371a7999b8c552af765374d8c5c186df18dea61caa5ca57b1ac9e95b194a31d459e090a5cb32c7908af3e90cb4b2576ccfc191a6043879436681d

Download Submit
C:\Windows\security\EDP\Logs\886983d96e3d3e
Filesize
955B

MD5
d411e863c428a2e20ce11dfadaa219b1

SHA1
22cb646705ca4a6f5678ddb999f3b6ac4295db2f

SHA256
ee4e18348942d8077e33beb353b8b89a3fc79ec53fc282017c46ea1418aecfba

SHA512
8e6f12501715a6524eca2f8e02942dca423a0359f1e6fdbe7499f41806af791137d937e0c01801e19f65f10991263fe45fcef7cf768a8d71e3f77fda05579640

Download Submit
C:\Windows\security\EDP\Logs\csrss.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Windows\syscom32.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Windows\syscom32.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\Windows\wJSrXid0UUwHHOMygNV3xLBKK.vbe
Filesize
189B

MD5
c7c7ffa475aef8dff75df4c55df974af

SHA1
ef0427f4f4091c69d488443079477b1d4416e9b2

SHA256
19a4bf5506db87cf645f4a6e9af79b85e0d04ac4e7bc948585510dfe99d5ef16

SHA512
72fa6c18a83eb5edb303a85de4fb5f759a570aa5281525da6021cc1f0613257fbb5305f7a1bf6f6e3337d9ef707776a372b938f6ae6be777b7e6fe18a9dcba66

Download Submit
C:\odt\SppExtComObj.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
C:\odt\e1ef82546f0b02
Filesize
516B

MD5
a5415e54fdc9098f7c88878491da78e3

SHA1
9bd5c3ac2dbeb9338adb21291dfc32991a6cef6e

SHA256
0b5ea9b28fcaaa86271e966e0d258687f288acaf91f629341a027022a8a06f86

SHA512
0eac76fb5a410db5373ddd3c8f93abc8b297986514c9b18448b69d3da9d3a2921b2d5b1d9f85de1fa09c86924d338b641bfc4d3b8fd882a39e1f6b4f4f0bcf10

Download Submit
C:\odt\f3b6ecef712a24
Filesize
182B

MD5
f11566b35afc71b3546459a7e5bf232d

SHA1
0280a34a56b8d87065537fdc665f5432df1ad404

SHA256
1eadfc6c074cd88cdddc9e73e6676dff5cdb4cd1a228802eefb910deaa15cdbb

SHA512
12df06c8fc070a81149b825ad915796ce7dae9c6ea276b2bc4a3882d89cc11512959bd223ad79a4e9452e4b8cedeab8db2ffbcbf43be08642a64fede2a9836d0

Download Submit
C:\odt\spoolsv.exe
Filesize
829KB

MD5
a0ae20389c09fb809b4d4a842cb890d4

SHA1
f30474f81d60a8c27a722dc822c15639eec30f28

SHA256
dd1deb85892dfd059f6989123cd1d742c252006d09e5d94f57dbe9f0c3cb0fb7

SHA512
2af2aa987e8afc62d2d7a16168e688879bc0b2f3c717dff2a00d96079c3bc6ba6346adecd23334a9409bb7ca885b9eb7ad0be2eb6cd0592fd0fd3348aef559ce

Download Submit
memory/1724-148-0x000000001B8F0000-0x000000001B900000-memory.dmp

Filesize
64KB

Download
memory/1724-145-0x0000000000A90000-0x0000000000B66000-memory.dmp

Filesize
856KB

Download
memory/1980-322-0x000001A84EEE0000-0x000001A84EF00000-memory.dmp

Filesize
128KB

Download
memory/1980-326-0x000001A84EEA0000-0x000001A84EEC0000-memory.dmp

Filesize
128KB

Download
memory/1980-328-0x000001A84F230000-0x000001A84F250000-memory.dmp

Filesize
128KB

Download
memory/3904-189-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/3904-178-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/3904-179-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/3904-192-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/3904-190-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/3904-191-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/4632-305-0x0000000004860000-0x0000000004861000-memory.dmp

Filesize
4KB

Download