Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe
-
Size
255KB
-
MD5
2d2685f10076126d0c398998111902d0
-
SHA1
3d49798143638a11746a4242544cf051527d9f60
-
SHA256
40d1b1db66914ea21760f3cbdded1705cb5281c244caee6288fc046c8896e627
-
SHA512
7dcd82054c897a302c841c2ac0f1ff3a200ba8d044cbbdccdc2be81a5379b66a378faec5e19097a21d6b7f8ec28eee14226a16bacfc1d1910724533626269d29
-
SSDEEP
6144:o64tXafE0Mqpm+SKAqpByuqPoEbLvRdvf0:o68r0Mqpm+SCB3KbLzM
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components Process not Found Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe -
Loads dropped DLL 8 IoCs
pid Process 3120 regsvr32.exe 5104 regsvr32.exe 1340 explorer.exe 4484 explorer.exe 740 explorer.exe 2220 explorer.exe 2720 explorer.exe 2208 Process not Found -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32 regsvr32.exe -
resource yara_rule behavioral2/files/0x00080000000231e5-3.dat upx behavioral2/files/0x00080000000231e5-4.dat upx behavioral2/files/0x00080000000231e5-6.dat upx behavioral2/memory/5104-7-0x00007FFA73E70000-0x00007FFA73EDD000-memory.dmp upx behavioral2/files/0x00080000000231e5-10.dat upx behavioral2/memory/1340-11-0x00007FFA84AB0000-0x00007FFA84B1D000-memory.dmp upx behavioral2/memory/1340-19-0x00007FFA84AB0000-0x00007FFA84B1D000-memory.dmp upx behavioral2/files/0x00080000000231e5-20.dat upx behavioral2/memory/4484-21-0x00007FFA84AF0000-0x00007FFA84B5D000-memory.dmp upx behavioral2/memory/4484-26-0x00007FFA84AF0000-0x00007FFA84B5D000-memory.dmp upx behavioral2/files/0x00080000000231e5-27.dat upx behavioral2/memory/740-28-0x00007FFA855F0000-0x00007FFA8565D000-memory.dmp upx behavioral2/memory/740-67-0x00007FFA855F0000-0x00007FFA8565D000-memory.dmp upx behavioral2/files/0x00080000000231e5-68.dat upx behavioral2/memory/2220-69-0x00007FFA84B80000-0x00007FFA84BED000-memory.dmp upx behavioral2/memory/2220-72-0x00007FFA84B80000-0x00007FFA84BED000-memory.dmp upx behavioral2/files/0x00080000000231e5-73.dat upx behavioral2/memory/2720-74-0x00007FFA85830000-0x00007FFA8589D000-memory.dmp upx behavioral2/memory/2720-97-0x00007FFA85830000-0x00007FFA8589D000-memory.dmp upx behavioral2/files/0x00080000000231e5-98.dat upx behavioral2/memory/2208-99-0x00007FFA85730000-0x00007FFA8579D000-memory.dmp upx behavioral2/memory/2208-123-0x00007FFA85730000-0x00007FFA8579D000-memory.dmp upx behavioral2/memory/2568-125-0x00007FFA85730000-0x00007FFA8579D000-memory.dmp upx behavioral2/files/0x00080000000231e5-124.dat upx behavioral2/memory/2568-128-0x00007FFA85730000-0x00007FFA8579D000-memory.dmp upx behavioral2/files/0x00080000000231e5-129.dat upx behavioral2/memory/736-130-0x00007FFA86840000-0x00007FFA868AD000-memory.dmp upx behavioral2/memory/736-156-0x00007FFA86840000-0x00007FFA868AD000-memory.dmp upx behavioral2/files/0x00080000000231e5-162.dat upx behavioral2/memory/3896-163-0x00007FFA85B40000-0x00007FFA85BAD000-memory.dmp upx behavioral2/memory/3896-188-0x00007FFA85B40000-0x00007FFA85BAD000-memory.dmp upx behavioral2/files/0x00080000000231e5-189.dat upx behavioral2/memory/1200-190-0x00007FFA85B60000-0x00007FFA85BCD000-memory.dmp upx behavioral2/memory/1200-215-0x00007FFA85B60000-0x00007FFA85BCD000-memory.dmp upx behavioral2/files/0x00080000000231e5-216.dat upx behavioral2/memory/1608-217-0x00007FFA85AF0000-0x00007FFA85B5D000-memory.dmp upx behavioral2/memory/1608-242-0x00007FFA85AF0000-0x00007FFA85B5D000-memory.dmp upx behavioral2/files/0x00080000000231e5-243.dat upx behavioral2/memory/3180-244-0x00007FFA85AF0000-0x00007FFA85B5D000-memory.dmp upx behavioral2/memory/3180-247-0x00007FFA85AF0000-0x00007FFA85B5D000-memory.dmp upx behavioral2/memory/3180-270-0x00007FFA85AF0000-0x00007FFA85B5D000-memory.dmp upx behavioral2/memory/3020-272-0x00007FFA86AA0000-0x00007FFA86B0D000-memory.dmp upx behavioral2/files/0x00080000000231e5-271.dat upx behavioral2/memory/3020-298-0x00007FFA86AA0000-0x00007FFA86B0D000-memory.dmp upx behavioral2/memory/2984-300-0x00007FFA86AC0000-0x00007FFA86B2D000-memory.dmp upx behavioral2/files/0x00080000000231e5-299.dat upx behavioral2/memory/2984-304-0x00007FFA86AC0000-0x00007FFA86B2D000-memory.dmp upx behavioral2/files/0x00080000000231e5-305.dat upx behavioral2/memory/3584-306-0x00007FFA86850000-0x00007FFA868BD000-memory.dmp upx behavioral2/memory/3584-310-0x00007FFA86850000-0x00007FFA868BD000-memory.dmp upx behavioral2/files/0x00080000000231e5-311.dat upx behavioral2/memory/764-312-0x00007FFA86840000-0x00007FFA868AD000-memory.dmp upx behavioral2/memory/764-338-0x00007FFA86840000-0x00007FFA868AD000-memory.dmp upx behavioral2/files/0x00080000000231e5-340.dat upx behavioral2/memory/4752-341-0x00007FFA868F0000-0x00007FFA8695D000-memory.dmp upx behavioral2/memory/4752-345-0x00007FFA868F0000-0x00007FFA8695D000-memory.dmp upx behavioral2/files/0x00080000000231e5-346.dat upx behavioral2/memory/448-347-0x00007FFA85C40000-0x00007FFA85CAD000-memory.dmp upx -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: Process not Found File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 Process not Found -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{02CF4317-3B7F-4951-B183-B06E75220AB0} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{C7181B35-D746-4E79-8881-542674296980} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\HELPDIR regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{3151E006-C865-405E-8227-9A56E42ACFC8} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ = "IMediaViewerIdentifier" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{60A60A8D-4017-4383-8D3F-2085E7AA275D} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\ = "MediaViewer605C Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{8F342F64-2AB4-4949-9ACD-696B34613878} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-605CFFB6387E} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2720 explorer.exe 2720 explorer.exe 2720 explorer.exe 2720 explorer.exe 2208 Process not Found 2208 Process not Found 2208 Process not Found 2208 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 1340 explorer.exe Token: SeCreatePagefilePrivilege 1340 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 4484 explorer.exe Token: SeCreatePagefilePrivilege 4484 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe Token: SeShutdownPrivilege 740 explorer.exe Token: SeCreatePagefilePrivilege 740 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 4484 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 740 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2220 explorer.exe 2720 explorer.exe 2720 explorer.exe 2720 explorer.exe 2720 explorer.exe 2720 explorer.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2844 StartMenuExperienceHost.exe 1136 Process not Found 3108 StartMenuExperienceHost.exe 3592 SearchApp.exe 2604 StartMenuExperienceHost.exe 4620 StartMenuExperienceHost.exe 1492 SearchApp.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3928 wrote to memory of 3120 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 86 PID 3928 wrote to memory of 3120 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 86 PID 3928 wrote to memory of 3120 3928 2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe 86 PID 3120 wrote to memory of 5104 3120 regsvr32.exe 87 PID 3120 wrote to memory of 5104 3120 regsvr32.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_2d2685f10076126d0c398998111902d0_mafia_JC.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5104
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1340
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2844
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4484
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1136
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3108
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2220
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2604
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4620
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1492
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2208
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3272
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3624
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2568
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2144
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:764
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4888
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3896
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:832
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4132
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1200
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4744
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4428
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1608
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3272
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3788
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3180
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\f9fd2b9784a741b5b827cd375223926e /t 1916 /p 50761⤵PID:4808
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3188
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3020
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3272
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2220
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2984
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4180
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3584
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4484
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3652
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3308
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2908
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize471B
MD5976ce2c91cbe61b98378e8e5c5ba4d53
SHA145b3e1eabb4e759bf46ffeb8f9722077a0d62c72
SHA256255f312d16d7d080cf1a97d4eb255c236c7eee6c059d732d970e3c05c07c158e
SHA5120065b7984960354aea85cd0c6792e019f40a2b359fabf7dcee438193c1bab47d74d59602627c8399df741864dffb0469d9cf8bc48907c1c67015c51d01a7b28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize412B
MD57db7e9375573b07171dbfbc513598392
SHA119e65102bb4b88d0a03495c170442d99806ed4aa
SHA256c36815844fd0d6babe24fd9f88c1ca3c2f0e36e091a72719e83a356550b665e6
SHA5125f112f96a46c6df9b5719a62ccfa556b73a1e96a016585d2c2bb16b4bf12bbc6bb6354a3304d56c081032e1427e2e6cab9cb83bd2b3a8df4e895f243a13a3066
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133416359805666099.txt
Filesize75KB
MD562d81c2e1e8b21733f95af2a596e4b18
SHA191c005ecc5ae4171f450c43c02d1ba532b4474c6
SHA256a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6
SHA512c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133416359805666099.txt
Filesize75KB
MD562d81c2e1e8b21733f95af2a596e4b18
SHA191c005ecc5ae4171f450c43c02d1ba532b4474c6
SHA256a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6
SHA512c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
Filesize97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
95KB
MD506728a89dbd648bcfc5d32ffb8dc9c67
SHA18a98486a5117293841269169e1ba71fcb648a092
SHA256826bd74dc9991b0a29b86ff9f161909ec7b0c9bc6a50c85c7f3c9572a4e7895b
SHA512045ea3f290030a77ed5cf103278bff675410db0439cc9ed79e5ca74a8c8548a502d328a45a0591dd0e59bd07f60ca98b0eaa27bf0dacda9681faa98a1b7f72ce
-
Filesize
77B
MD506213e10f044ae3d211fa7a03a34d9fb
SHA11daff1ebb3db176989790e56cdec399488ea56f1
SHA25631a658bddebe3ed803a19b15e1f4798cc9b10028074c9b73a079949bf0d710f6
SHA512722630310360b33b5a25331c5fe661153eb7bf959a60fd4f13ec7d7923df9942c910aeb26362217cfd4dd00558f7954fa1a1e28b1fdc91ca7e37fa98dabcf3ca