Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
Resource
win10v2004-20231215-en
General
-
Target
48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
-
Size
1.9MB
-
MD5
40ec0e62856036983be04f31ce670fb9
-
SHA1
0d04b8139fe71a1736a8168fbf072df61d7d7bd6
-
SHA256
48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521
-
SHA512
1094d49d3fcb757fe2d1c49d1e441ab086f4cff80ffd8572b0017546350838dcba83f102796009d811a360f6825928c13e3697b7dd462627bb83fb92534fc806
-
SSDEEP
192:z/TeYoeb67sc8+otH8SESePujd2kTCMZehZtzMuuQzBLerxA/GWeGMEd022XbTFi:z/yYoebe5JotHESxjuM63KI
Malware Config
Extracted
C:\Program Files\7-Zip\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe = "0" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
resource yara_rule behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD -
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
resource yara_rule behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender -
Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs
resource yara_rule behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Detects executables potentially checking for WinJail sandbox window 2 IoCs
resource yara_rule behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Anti_WinJail behavioral2/memory/4632-3-0x00000000048D0000-0x000000000492E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste -
Nirsoft 1 IoCs
resource yara_rule behavioral2/files/0x000600000002324c-10.dat Nirsoft -
Renames multiple (8024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1524 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation AdvancedRun.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Executes dropped EXE 3 IoCs
pid Process 2256 AdvancedRun.exe 972 AdvancedRun.exe 1224 AdvancedRun.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe = "0" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 37 iplogger.org 38 iplogger.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4632 set thread context of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4352 set thread context of 3576 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 137 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_40x40x32.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-150.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\he.pak 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\OnlineMediaComponent.winmd 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-96_altform-unplated.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-96_altform-unplated_contrast-white.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\uncommon.lua 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\LICENSE.DATA 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_40x40x32.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\readme-warning.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\readme-warning.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK.winmd 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-200.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-200.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg7.jpg 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-100.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\readme-warning.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sand.jpg 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dc.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PAPYRUS.TTF 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\192.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\Url.model 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-white.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-200_contrast-white.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-100.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\offlineStrings.js 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-400.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-2.jpg 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\View3d\3DViewerProductDescription-universal.xml 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-lightunplated.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\readme-warning.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\readme-warning.txt 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\MilitaryLeft.png 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\et-EE\View3d\3DViewerProductDescription-universal.xml 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Launches sc.exe 22 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4176 sc.exe 1852 sc.exe 4144 sc.exe 2936 sc.exe 1844 sc.exe 4476 sc.exe 2092 sc.exe 2008 sc.exe 4364 sc.exe 2288 sc.exe 5040 sc.exe 1028 sc.exe 4776 sc.exe 5020 sc.exe 4944 sc.exe 1848 sc.exe 3304 sc.exe 3308 sc.exe 3372 sc.exe 2404 sc.exe 544 sc.exe 4828 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2980 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{B11E921A-5CE0-424A-B468-7D2EA1504297} explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{95A2EB4B-6488-48DB-A553-E89CC70ACAF4} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{96B6FE2C-F00B-4766-B51A-E7AD9C85F9BD} explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{A1BEA95D-7F6C-46BD-9282-8DFABB419DC4} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2256 AdvancedRun.exe 2256 AdvancedRun.exe 2256 AdvancedRun.exe 2256 AdvancedRun.exe 972 AdvancedRun.exe 972 AdvancedRun.exe 972 AdvancedRun.exe 972 AdvancedRun.exe 1360 powershell.exe 1360 powershell.exe 1224 AdvancedRun.exe 1224 AdvancedRun.exe 1224 AdvancedRun.exe 1224 AdvancedRun.exe 1072 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 1072 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 1156 powershell.exe 1156 powershell.exe 1156 powershell.exe 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2256 AdvancedRun.exe Token: SeImpersonatePrivilege 2256 AdvancedRun.exe Token: SeDebugPrivilege 972 AdvancedRun.exe Token: SeImpersonatePrivilege 972 AdvancedRun.exe Token: SeDebugPrivilege 1360 powershell.exe Token: SeBackupPrivilege 3648 vssvc.exe Token: SeRestorePrivilege 3648 vssvc.exe Token: SeAuditPrivilege 3648 vssvc.exe Token: SeDebugPrivilege 1224 AdvancedRun.exe Token: SeImpersonatePrivilege 1224 AdvancedRun.exe Token: SeBackupPrivilege 4284 wbengine.exe Token: SeRestorePrivilege 4284 wbengine.exe Token: SeSecurityPrivilege 4284 wbengine.exe Token: SeIncreaseQuotaPrivilege 2904 WMIC.exe Token: SeSecurityPrivilege 2904 WMIC.exe Token: SeTakeOwnershipPrivilege 2904 WMIC.exe Token: SeLoadDriverPrivilege 2904 WMIC.exe Token: SeSystemProfilePrivilege 2904 WMIC.exe Token: SeSystemtimePrivilege 2904 WMIC.exe Token: SeProfSingleProcessPrivilege 2904 WMIC.exe Token: SeIncBasePriorityPrivilege 2904 WMIC.exe Token: SeCreatePagefilePrivilege 2904 WMIC.exe Token: SeBackupPrivilege 2904 WMIC.exe Token: SeRestorePrivilege 2904 WMIC.exe Token: SeShutdownPrivilege 2904 WMIC.exe Token: SeDebugPrivilege 2904 WMIC.exe Token: SeSystemEnvironmentPrivilege 2904 WMIC.exe Token: SeRemoteShutdownPrivilege 2904 WMIC.exe Token: SeUndockPrivilege 2904 WMIC.exe Token: SeManageVolumePrivilege 2904 WMIC.exe Token: 33 2904 WMIC.exe Token: 34 2904 WMIC.exe Token: 35 2904 WMIC.exe Token: 36 2904 WMIC.exe Token: SeIncreaseQuotaPrivilege 2904 WMIC.exe Token: SeSecurityPrivilege 2904 WMIC.exe Token: SeTakeOwnershipPrivilege 2904 WMIC.exe Token: SeLoadDriverPrivilege 2904 WMIC.exe Token: SeSystemProfilePrivilege 2904 WMIC.exe Token: SeSystemtimePrivilege 2904 WMIC.exe Token: SeProfSingleProcessPrivilege 2904 WMIC.exe Token: SeIncBasePriorityPrivilege 2904 WMIC.exe Token: SeCreatePagefilePrivilege 2904 WMIC.exe Token: SeBackupPrivilege 2904 WMIC.exe Token: SeRestorePrivilege 2904 WMIC.exe Token: SeShutdownPrivilege 2904 WMIC.exe Token: SeDebugPrivilege 2904 WMIC.exe Token: SeSystemEnvironmentPrivilege 2904 WMIC.exe Token: SeRemoteShutdownPrivilege 2904 WMIC.exe Token: SeUndockPrivilege 2904 WMIC.exe Token: SeManageVolumePrivilege 2904 WMIC.exe Token: 33 2904 WMIC.exe Token: 34 2904 WMIC.exe Token: 35 2904 WMIC.exe Token: 36 2904 WMIC.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe Token: SeShutdownPrivilege 2140 explorer.exe Token: SeCreatePagefilePrivilege 2140 explorer.exe Token: SeShutdownPrivilege 2140 explorer.exe Token: SeCreatePagefilePrivilege 2140 explorer.exe Token: SeShutdownPrivilege 2140 explorer.exe Token: SeCreatePagefilePrivilege 2140 explorer.exe Token: SeShutdownPrivilege 2140 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 explorer.exe 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 3592 Process not Found 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 StartMenuExperienceHost.exe 2488 StartMenuExperienceHost.exe 4012 StartMenuExperienceHost.exe 2316 SearchApp.exe 3688 Process not Found 1564 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2256 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 83 PID 4632 wrote to memory of 2256 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 83 PID 4632 wrote to memory of 2256 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 83 PID 2256 wrote to memory of 972 2256 AdvancedRun.exe 84 PID 2256 wrote to memory of 972 2256 AdvancedRun.exe 84 PID 2256 wrote to memory of 972 2256 AdvancedRun.exe 84 PID 4632 wrote to memory of 1360 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 90 PID 4632 wrote to memory of 1360 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 90 PID 4632 wrote to memory of 1360 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 90 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 4632 wrote to memory of 1072 4632 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 93 PID 1072 wrote to memory of 2944 1072 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 98 PID 1072 wrote to memory of 2944 1072 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 98 PID 2944 wrote to memory of 2980 2944 cmd.exe 100 PID 2944 wrote to memory of 2980 2944 cmd.exe 100 PID 4352 wrote to memory of 1224 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 102 PID 4352 wrote to memory of 1224 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 102 PID 4352 wrote to memory of 1224 4352 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe 102 PID 4604 wrote to memory of 2936 4604 cmd.exe 106 PID 4604 wrote to memory of 2936 4604 cmd.exe 106 PID 4604 wrote to memory of 1844 4604 cmd.exe 107 PID 4604 wrote to memory of 1844 4604 cmd.exe 107 PID 4604 wrote to memory of 4476 4604 cmd.exe 108 PID 4604 wrote to memory of 4476 4604 cmd.exe 108 PID 4604 wrote to memory of 3308 4604 cmd.exe 109 PID 4604 wrote to memory of 3308 4604 cmd.exe 109 PID 4604 wrote to memory of 5040 4604 cmd.exe 110 PID 4604 wrote to memory of 5040 4604 cmd.exe 110 PID 4604 wrote to memory of 1028 4604 cmd.exe 111 PID 4604 wrote to memory of 1028 4604 cmd.exe 111 PID 4604 wrote to memory of 4776 4604 cmd.exe 112 PID 4604 wrote to memory of 4776 4604 cmd.exe 112 PID 4604 wrote to memory of 5020 4604 cmd.exe 120 PID 4604 wrote to memory of 5020 4604 cmd.exe 120 PID 4604 wrote to memory of 3372 4604 cmd.exe 113 PID 4604 wrote to memory of 3372 4604 cmd.exe 113 PID 2944 wrote to memory of 1524 2944 cmd.exe 114 PID 2944 wrote to memory of 1524 2944 cmd.exe 114 PID 4604 wrote to memory of 2092 4604 cmd.exe 115 PID 4604 wrote to memory of 2092 4604 cmd.exe 115 PID 4604 wrote to memory of 1848 4604 cmd.exe 119 PID 4604 wrote to memory of 1848 4604 cmd.exe 119 PID 4604 wrote to memory of 2008 4604 cmd.exe 117 PID 4604 wrote to memory of 2008 4604 cmd.exe 117 PID 4604 wrote to memory of 4176 4604 cmd.exe 118 PID 4604 wrote to memory of 4176 4604 cmd.exe 118 PID 4604 wrote to memory of 4828 4604 cmd.exe 132 PID 4604 wrote to memory of 4828 4604 cmd.exe 132 PID 4604 wrote to memory of 4944 4604 cmd.exe 121 PID 4604 wrote to memory of 4944 4604 cmd.exe 121 PID 4604 wrote to memory of 544 4604 cmd.exe 131 PID 4604 wrote to memory of 544 4604 cmd.exe 131 PID 4604 wrote to memory of 4364 4604 cmd.exe 128 PID 4604 wrote to memory of 4364 4604 cmd.exe 128 PID 4604 wrote to memory of 2288 4604 cmd.exe 122 PID 4604 wrote to memory of 2288 4604 cmd.exe 122 PID 4604 wrote to memory of 4144 4604 cmd.exe 127 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\76541d97-945f-4d78-b491-730d1899467b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\76541d97-945f-4d78-b491-730d1899467b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\76541d97-945f-4d78-b491-730d1899467b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\76541d97-945f-4d78-b491-730d1899467b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\76541d97-945f-4d78-b491-730d1899467b\AdvancedRun.exe" /SpecialRun 4101d8 22563⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" n10723⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\0adc2e09-eb6e-4d47-b4eb-a0b67373577c\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\0adc2e09-eb6e-4d47-b4eb-a0b67373577c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\0adc2e09-eb6e-4d47-b4eb-a0b67373577c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\0adc2e09-eb6e-4d47-b4eb-a0b67373577c\test.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\sc.exesc stop windefend6⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\system32\sc.exesc config windefend start= disabled6⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\system32\sc.exesc stop Sense6⤵
- Launches sc.exe
PID:4476
-
-
C:\Windows\system32\sc.exesc config Sense start= disabled6⤵
- Launches sc.exe
PID:3308
-
-
C:\Windows\system32\sc.exesc stop wuauserv6⤵
- Launches sc.exe
PID:5040
-
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled6⤵
- Launches sc.exe
PID:1028
-
-
C:\Windows\system32\sc.exesc stop usosvc6⤵
- Launches sc.exe
PID:4776
-
-
C:\Windows\system32\sc.exesc stop WaasMedicSvc6⤵
- Launches sc.exe
PID:3372
-
-
C:\Windows\system32\sc.exesc config WaasMedicSvc start= disabled6⤵
- Launches sc.exe
PID:2092
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start= disabled6⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exesc stop SDRSVC6⤵
- Launches sc.exe
PID:4176
-
-
C:\Windows\system32\sc.exesc stop SecurityHealthService6⤵
- Launches sc.exe
PID:1848
-
-
C:\Windows\system32\sc.exesc config usosvc start= disabled6⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\system32\sc.exesc stop wscsvc6⤵
- Launches sc.exe
PID:4944
-
-
C:\Windows\system32\sc.exesc config WdiServiceHost start= disabled6⤵
- Launches sc.exe
PID:2288
-
-
C:\Windows\system32\sc.exesc config InstallService Start= disabled6⤵
- Launches sc.exe
PID:2404
-
-
C:\Windows\system32\sc.exesc stop InstallService6⤵
- Launches sc.exe
PID:3304
-
-
C:\Windows\system32\sc.exesc config WdiSystemHost start= disabled6⤵
- Launches sc.exe
PID:1852
-
-
C:\Windows\system32\sc.exesc stop WdiSystemHost6⤵
- Launches sc.exe
PID:4144
-
-
C:\Windows\system32\sc.exesc stop WdiServiceHost6⤵
- Launches sc.exe
PID:4364
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled6⤵
- Launches sc.exe
PID:544
-
-
C:\Windows\system32\sc.exesc config SDRSVC start= disabled6⤵
- Launches sc.exe
PID:4828
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"4⤵PID:4288
-
-
C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"4⤵PID:3576
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2980
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1524
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1708
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:232
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2140
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2052
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2244
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2488
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4012
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2952
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3688
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1564
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1276
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2344
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1196
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3424
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3504
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4352
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4076
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3892
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4160
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4028
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5056
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3160
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5088
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3644
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:232
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3116
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2604
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4244
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3516
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1196
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3820
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2852
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4052
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2880
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3320
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1016
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4684
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3856
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4344
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4600
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1116
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3440
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
5Disable or Modify Tools
4Indicator Removal
3File Deletion
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e217e139ef30c6b01a891a46abdfdfdb
SHA1b7fcffce07cbdc0408c8156f22ac6ab0a8c742c9
SHA256cb631d734d62dce1742744b81cccd7418c27fa6da089d366378b43c00186598e
SHA512a22208a2537138f0b70087b1f0f10972e2ed2feb3ea8ea2f7bc0f7668a4fc1b807aaa7173d04ff04d415c043e1278357d39c7f539b4037ebbc6926e21863d117
-
C:\USERS\ADMIN\DESKTOP\ADDGRANT.RTF.[62687D04].[[email protected]].MAKOP
Filesize684KB
MD52246ecf88a70679ff6c5f1215e1ff9f8
SHA1ea3148c849c141aac9d6a877d01e125d737a0140
SHA256261098d64620dc98423c433fdcb88322291be375c483bbfade6a9a57d9a17132
SHA5127c2558c663b467146e849a1c85d5ac12f91e4bd90124674fb59914821beca9b2d0ef10d3d0758b05f3ee3bdc9df8b3d981d4baf43238138f7e5e58f4c7cfb86e
-
C:\USERS\ADMIN\DESKTOP\COMPAREMOUNT.WAV.[62687D04].[[email protected]].MAKOP
Filesize1.1MB
MD55f6d0dbc5aeeb91b8ee2068156fef027
SHA1bedd96b46e05b5b196eaad2687ac37c3154f5086
SHA256900a808634ef279604226d71b89f6155ae54789ffc12fa7a5e9200367d89e9cf
SHA512a6c0dacf7bcfb0d5cfd9f524f38151183d94972ec97125f006cad2918f2ccf11032adbc046aecc4cbaa0271db93b0b9cc9176bc6c36c2f50e719db7bea2142f0
-
C:\USERS\ADMIN\DESKTOP\COMPLETEFORMAT.AIF.[62687D04].[[email protected]].MAKOP
Filesize1.0MB
MD51af4e40e22d8e8f70bccddfa7d607630
SHA1231fd14c8318d08144348c7f34103558dedbd065
SHA256e804d889e16c83c2e7eea1833f94e0501031e4cab8933b47ffde340bceed48b3
SHA5126d0a9d9a3b21beed387ba99cb8d368ca0f798fe7e62d4fdb4504f6138247ae245c11dbe5ad1a07993b4db56ecd1e014e41f6072bab44b16fe1f992d5be1eef8d
-
C:\USERS\ADMIN\DESKTOP\CONNECTBACKUP.MP2V.[62687D04].[[email protected]].MAKOP
Filesize772KB
MD5c6c56533fdb77e4dfb5f5eca40a3c1ed
SHA15d3f26964d30adb1b6c42635c8562d06193d60b3
SHA2561d25ebf0eae5078e8795757851b8ca7e2a307221bf2a34db7df6a5a379b39683
SHA512b75b8d3407ed9341ee0f21e2aa17e20f38b08d6f20a89bbfcfc46434ab62e6c50574d7a161932b6307c90b4dd68a85173cecbc9e86e38feaa833412293adff1b
-
C:\USERS\ADMIN\DESKTOP\CONVERTTORESIZE.RAW.[62687D04].[[email protected]].MAKOP
Filesize816KB
MD57c3bb8f30ef5c17731d8eaef4db34263
SHA1137ed10ca873cc2c304478598f4393ba9fc2873e
SHA256f17b0c613b6a8604a53986dae81dc400f2425f8e084a94b6f8563365e6d322d4
SHA512b64bf8efba5e88d60a31af7a9816149379521c3424feab6193610e96eee50bb8b2141f5bd8d8655598e1df17f9bc01064d12fa53b89d99c9a87d2685294a06cd
-
C:\USERS\ADMIN\DESKTOP\DEBUGCONNECT.DOT.[62687D04].[[email protected]].MAKOP
Filesize860KB
MD588e8364bfee5da80fef8e36cab3ed174
SHA14a98bfc5750f79e155576d34c17be66f11ef9e75
SHA25663c9f93b4bb575ee958729f2cc253168b254627e78d585baaa3e613c1abd181c
SHA51227f8494b6a7f225c486c763edaf8fa167c03319b514b72aae63cd80e71b41436cb7fc376f999bee2d475b81540e6dad80a2966a8eebe7f80f03869a9d3e57bc1
-
C:\USERS\ADMIN\DESKTOP\DISABLEINITIALIZE.EPRTX.[62687D04].[[email protected]].MAKOP
Filesize1.1MB
MD5d4ba9f5f719eda79b64fc0dbb5424841
SHA13365474dcfc1aae896b25281c9462bb8fcd9c6c1
SHA2566976be73b769fc056906253b16a8643b80c94b4d83abe9132e974bab1f37ffe5
SHA512e368a706e66f904d0ca09eceb62855543768bdf4c576a0b26e5d98ca71b043e33085f872f237d23f797daca0c630e5a79e9ea96ae41e527ab7e358a4cb39a3be
-
C:\USERS\ADMIN\DESKTOP\DISMOUNTCLOSE.WAV.[62687D04].[[email protected]].MAKOP
Filesize904KB
MD544a92cb32b85d4e205fca4715e487da6
SHA1d86c52dd53f241d391b3373a6b17e4a7479fa4ba
SHA25687860245b84b0c8f9b7b2d29b5304d4aa6df36c4c17274fed87a5779b7d9cb8b
SHA512aee7a3e7de147c3644c6c0750e6101ee28a2a1ad468377ba49d5fba4053ec2c3e08d185956bbf4c226d95f4d4cb40989c323f94e728b54f41a99862da7a66801
-
C:\USERS\ADMIN\DESKTOP\DISMOUNTSAVE.VSW.[62687D04].[[email protected]].MAKOP
Filesize948KB
MD5b77b37c9a1a6d15a68d578da75ea0241
SHA1a3e52305523f1ea642acc600307434c2ecb44e55
SHA256d24c3985ce19d0b7c5ae91bfb4bd0186ccfd14f4e83dc234872d1b1de2ac6d32
SHA512d858bb418280587481988360c958fd8f6c84c297fb5fb6e49fd91cddc446fbcf6a8a5589bce01032abf93a12078a33e78b371c77b31ab13f405bf5de6203689e
-
C:\USERS\ADMIN\DESKTOP\ENTERINSTALL.VSDX.[62687D04].[[email protected]].MAKOP
Filesize1.3MB
MD51f3e2d4264d3e2acf5f1040146c9cd4c
SHA18c1511b9cfdf07cfeae6a66d2b9ddb3e84575ab1
SHA256bbda1a317d6800f2bff515ef780ec9c1f2f5fb5f3babb2942d92d6d4e3ab7f63
SHA512761cc2d31552d1727736881de7ff9d4ea747250dcc9203d3c4bc210a3211018f55a3b4c8a19aba0186f0afc638739052397bf9e9f360bf9d1678f248fc4f56eb
-
C:\USERS\ADMIN\DESKTOP\IMPORTOUT.EPS.[62687D04].[[email protected]].MAKOP
Filesize728KB
MD5e9b1c89adc1135152c7146ab9d1a438f
SHA1a42c8f11ebc1a3c01aecd5f60cea61ea30e4a90d
SHA256a77df4ed8f9675615e40a67d03a474fe40da992bd74a2cb24e7fa24c26424752
SHA512103a367bbf5f84cabaf6a1612edb2ab9aeb4d0fb98f017eb645b03ff5b0ad90b69f396ddd2545b828c43b826ae579039e519c9c2263e33bb9d60b5de00014f3e
-
C:\USERS\ADMIN\DESKTOP\INITIALIZEUNPUBLISH.EPS.[62687D04].[[email protected]].MAKOP
Filesize551KB
MD522e2b2bb5e18bc08f4e4d3d8735fc418
SHA1184a58695857185d2b79350d44f1cee8cf17e608
SHA25671b0e964f63c04e9caf9dd302c72ed98cb810a7ec997b2e64375aef1b1f2c526
SHA5122e1ceac36bda3abb438bf86a1c28fd1ca2a6c803077eb42852821a301934a286ec243247ce80a1b902daf6517b11b82042c7aaedd91ce69bd94cc156531afde9
-
C:\USERS\ADMIN\DESKTOP\MICROSOFT EDGE.LNK.[62687D04].[[email protected]].MAKOP
Filesize2KB
MD51611dc95297b9f0905fc4f6a2a70afad
SHA18bba7310cb001ee6ca730d1ae2a6689b95870466
SHA256732d4bb9e83d874ad07a063156d5a7987b638fe2e6ceee635b4088af52945a62
SHA512fb2260726913222347869845a72a6f1f542ceb3aeaacc2db8b7c4304fb81de296e2263177c180a364947c8831d6346b3f7e9cdde020c2f1860dcf2677cf84266
-
C:\USERS\ADMIN\DESKTOP\MOUNTDEBUG.AIF.[62687D04].[[email protected]].MAKOP
Filesize507KB
MD5c9034733e9333fa851426b7c602b5532
SHA141eb4322e0b7b8df401c0c95367a73abaca7bf65
SHA256c0d4457dbff2e15748737a03905dc64d1a7c8652b39f01ab707152755f85005f
SHA512df2f056e8994b596a56325167757780564054ba4451040347954ffb3a5f5476f2df026d68432f3616f68c18d5181d3483f609b653fcf3a9ca0a91e6afc976985
-
C:\USERS\ADMIN\DESKTOP\OPENPING.WPL.[62687D04].[[email protected]].MAKOP
Filesize1.1MB
MD58e6794f2cdafd81e7c17abcbfb572bda
SHA1a2e22450db9eae8be53f12cae618b3b91bd70dcd
SHA2569ae1cfcd074711e203043e7fba74304323e27b107bc3aeb434c2541b854f502c
SHA5127a879c78843a78af0d5098ef4046889046f1cfe8b2b21222515ded905b1c675f60db6cc8d774921026bcc1f26dc3151dbee86d94ae81a13935b3ba8859efc040
-
C:\USERS\ADMIN\DESKTOP\SAVEAPPROVE.AIF.[62687D04].[[email protected]].MAKOP
Filesize1.8MB
MD53e2ac33010cb8803f073034fd6010751
SHA1d0eabbfa98e771fd868ca6326aebfbc224b268d7
SHA256ca12f03cb5c2632ce40ce4641326679b46293c1a3d4f2701d451451fad0eb70b
SHA51297febb2b46b660ddbc3d66103117ad1a715939ec275fc7a1bceb652d1f384d2661e704624ab0a3262e7b7b8e7d4556586cfc3308634c5aa4bda7f4855550034c
-
C:\USERS\ADMIN\DESKTOP\SUSPENDUNBLOCK.EPS.[62687D04].[[email protected]].MAKOP
Filesize639KB
MD5aad84e7c97f1893f57582839b09baf6c
SHA1f727eba7fa630112f5ef63e222cf807aa2dac378
SHA256482a392f9212397ab9141377e891afbe8b65c64fa862e5c98eee478f18bb86e1
SHA51265c259876ae0050a5f2fc7e53ffbbda7a05a8c1bf441db891fcd9923eee9eab159d50c771a6bd649ebc75cddfe4304d5775e45978cf3217f5c2e69f982205577
-
C:\USERS\ADMIN\DESKTOP\SYNCBACKUP.SQL.[62687D04].[[email protected]].MAKOP
Filesize595KB
MD58d8072a14aff41b20ab53788acfcd813
SHA17b19ddc278680570199471b0c098d897ca0b951c
SHA256cb2fbca7aac4a8bca9413a1b9a7a958da6dd9e2683566f3a86153188c16571a8
SHA5125ca29d03ff47a2e2c658a0757d95cede560ef311ed4614b61dbb034414a64948e92a1ef5f983db845dbb1c7a03530c8bb3e45a196020e657def3a19777664e0b
-
C:\USERS\ADMIN\DESKTOP\TRACEDISMOUNT.HTM.[62687D04].[[email protected]].MAKOP
Filesize960KB
MD5556e9d9720c1c73e49b8520cabd31728
SHA1a2ce2230bff1d60a2c7dacf8ead3a0601abb131c
SHA2568c2c19328d84c3b7b8450b21128d42931d33fc70ec75ae84c48d609282bf32a7
SHA512a5e0425c6ed6c95ff4600d981f108b0f4b5bb444a2b58f16246743e0bf667f355e29a517dd08520306e44c0b5f67c1099b84a7190c061c88a618944c7485e4b6
-
C:\USERS\ADMIN\DESKTOP\UNBLOCKCONNECT.KIX.[62687D04].[[email protected]].MAKOP
Filesize576KB
MD5dbfb51d79caca7c722e05c22d8e81f63
SHA1079b6bd5a2965a763a9707d7dd56742abcdfc563
SHA256f05eb0dd2035fda4d945a79e01e87725cac14436ca06c74104c56c121fd77e4d
SHA512e326973ea80d06ecfa4d667f8c346fea4be87bc4c9c43e055792a8be298ebd358c2a5b700bb3f16ff09c54b428bb41d23c5f4f706f756046821a7ff97d84f330
-
C:\USERS\ADMIN\DESKTOP\UNBLOCKRESIZE.CSV.[62687D04].[[email protected]].MAKOP
Filesize512KB
MD524a80a777f62b2b837d8b58d934ef711
SHA107a02207bb5686d63c37569c07ab314a8a80f026
SHA256e927051f48d54d384705dcc006e884e95df0f85dba058d70f013c1421ef58480
SHA512cf3c9cc8d754ff60af2758cd94ddf23ea2b3d73721d86b93eb8986eeebeefd8f8ef0ea9d970ab51fbba2165155838be1979709180ab22cee49a0cebc709cb03d
-
C:\USERS\ADMIN\DESKTOP\UPDATEDISMOUNT.MID.[62687D04].[[email protected]].MAKOP
Filesize463KB
MD57cdd56cf5213cb0ae83d2ff92006ba0f
SHA13aff90127836f421516bbe971fcb7fb6aad80d2b
SHA2567b5ca9d48483c97128e578ce3620130f31d1520fcf6c9b3825cf3dbd377acd25
SHA512d5c1595559ff98ef3757732a77b850df5ed03bd5dda3871ad96eea2e34ca8b78771d63de2de1b21db180fcddc62d20edd7e22a6ac2d8848766b62af509651d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize471B
MD5dab29f0ff85749876aaa834e6c1b5918
SHA1d514aa16346e208e62e1289a82af2ca16c5e64d9
SHA256808cb554c37d8021989c5d145588c2bec772f12b9260dddf8c4d55b3babe65b3
SHA512ffc6db04dee3b901eafb3a8f0234679694bfd66ced092917a4586f62bf8cbfdca6e6eeae3563a0f7ac7ee530d698aa9e36112cf7a0a483ccdfcafc58085056a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize412B
MD56a141ceaf201104c1e99c0812eccd123
SHA147da40dcd127b7c7ca17d80d76e6850b28573a24
SHA256b9f35034867f5c12570d406d07ccec58aac1885c6cabe03effa3517b2fd05ca1
SHA512bd62691e7e710d200a0aed631013288de6d752e02d1e2e6803290d25cd2a725ccfe8d195cc440ed9e1a4f4ed299d9af0b0bda676b912fe0c5cf9ba7cf3cf5311
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe.log
Filesize1KB
MD5c8ba28b4adef1e31506663447c4fb877
SHA1ab07929915ab927500c2fb32757f0512a0fa050e
SHA256589ddf313adbbe748a1d83d08ff4ec49b7cc6d6ca9d756ae38a779efe331add2
SHA5121778691f90f45240ba9460f0eb06c8ab72f845f2b841fdfdeb0da3e8c4e293fb11f40c858369cb7c8f5ea5fe45891b8cf1c968849fc3ce2251f517e0c519906d
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
384KB
MD5279ab88726777d53c803ff11ba926536
SHA18b9d8dab9c1dd4f2bbdc034846ccdaf3d52696a3
SHA256959c246d8717953b8336b535dabfecb223155b46c5722ad34770f3a3f79568ca
SHA5121c254db607a38cdf2524b23987dffd75fa47055419276358b427689442a7118f9a4c4a9aa2ea3b692b1f9f49873b059a0c044019f181855d0c5fa89338e29105
-
Filesize
16KB
MD5b5096b60ed8b733cb4e69d84464ba1e9
SHA1fde559e06a01d311a092e6f03306b438072cfa6e
SHA256871bf5db0a6c16b69568cdf618a799f273d4dd6cd884a4e0b477384411f6c717
SHA51270c4af06eb8e4e67187526d6b517beaac0aa44b8bc418989a9cf5c9be72d44ababdc7eeb49c31297474191fd682359556a78d2a6135775753a2ea71c7edbe762
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.[62687D04].[[email protected]].makop
Filesize414KB
MD5628021c7050222854ecdc372c8a9eae7
SHA1f924dea112317340e8c24e677a5a5f413ef7b313
SHA256ede875e5cc7695bd12324cb4cc6a6c4cf968574af7165ee143b56ec540dafd6f
SHA512bd6fcb681eea95b55fa7b8f04fc0b0237b9ad027d70812f8159a3c9d2447552d5fbeca85a3272e03db5fbbf9650996c2f5e059747b0508a54a16b294cc31dfba
-
Filesize
448KB
MD5650a10efee0ad59f7676fea76802f6c2
SHA1b986123d7b466df45800dcc39e8c48c1bdaa8a75
SHA256c1cbaa6a0d0e00efd3a0210af0e2cadec1645db7fdab81353e5db0989d059aa1
SHA512bbca0e9eaeadb5b418e527abc10313a42b83f5d40877573955ea3f6520d539bcb7f408b338d869d4ee436c4d8899c16f160488187bf91cff29c58b33a75e9efc
-
Filesize
960KB
MD5738d7d3a7d686e190c6a5948649dd2ac
SHA1a919b7e74bfb2817715503a6afdd7a6309e32a04
SHA256eaeaea68cff9a1c728b62ee90db33037221bec1f4b09c007d3fa5f5db58704eb
SHA5123400322bb0ad6f835f0713e1c1624bf0d8cca41732102c7634aaa229c5ffd809d12cfd3a12f8b3deeb16846412b8b17219e2b7d20c0a6bef2f8c3cdfac6707da
-
Filesize
1024KB
MD530ce05521c028924888c31f6722c14b9
SHA1bcae50c2ab7ccbf71c9b4e2923a6cb54b0bc1a96
SHA256da3d078ea6543bb8c36afc1abe19e902c74cb167ba77e7b04652a22edac48dfd
SHA512f8d43b49bf721658ab7549cd7cc7ce8e3ad4cba53dd963b2a55aa8c612eccc0e75bb3b15f6959f3b35890fcaf9fb2164617007d5d4d982e1833467844fe56691
-
Filesize
1024KB
MD531b9f63933adeba13a033496c6721e0d
SHA1e387757ef4dbec94755a5b27e266cb00edc2a2f5
SHA25640c2db6c9c5d62804bef06993aa2f521000c59c85fd32a395907afb8c8880cc2
SHA51244878f27e2db4744812dadd3a28d40e77eb36e16b798c081bddcf1fda7ed4e60f1bb0b50179dd078397b0ec269e282064ae89e41bfcc06730026280823b09da7
-
Filesize
7KB
MD5740ab836f98f3b212cdcff92802903ea
SHA10e6bf875be22f848a38c6d92272e99b69ae45ae1
SHA2561dcd999aa76a3a588ff89bdfa6b1e505c6d41225c5e8d1ad285c3186c098001a
SHA51261a008fc78023904664039402081f1fefb1a65f10c1f1906817b74bbffbaeccaa7a372fcfa28475c01895745b97746afd727d8c8c57e3f1a4c7b52ffed9626b8
-
Filesize
7KB
MD53dc4e92dad8cc60a9abebe802a8d4acf
SHA1c9624798cd2a879657e85956ffed47d65ad39141
SHA256cb13c07a3bf4e0f844b12817fb6f6bb5a1c77b77c1da0d8a498af170dfa1f18e
SHA51295859a84db32f78827b0d97f29e9c31d78f154bfe7634bc0c43bac8dd9589b02ddc7d79a6e3cc393c7fb4269768415695fd3961ce8b6492c49bcdd82d0251c6a
-
Filesize
1024KB
MD5bddc325dff21d9decad95a7eb8a354c1
SHA1f0582bbe97de5f7efe3897dcaa173f7ce27e5bd3
SHA256d6cab2c2e1bf2c74b07cce610f903db4ad626245030287051c37fd984f17b002
SHA512fe2d25a5cc86a6edb9c0f82d4c7cd283e914b0bc819569d7a64c39b83ad01c7bd6cfe5a37c2dd36a19c9ee04beacfa8bcbc01936a932eb72ce806fdf4c410c9a
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD5efc4b305f5cef4e37aa388439b55066f
SHA176b68a010d1bca2e3b8c58fae542515e5d96a5f4
SHA256c7890efd34711b18e4839700dd60402df3257db670df71315d393755f0131bb8
SHA5121acb5f900a6fe1905ee1a3c9a45b113e38d68cc20104b8e368551f9033fa98feddf22e1236659a81e279cb8bec0115a23417f6d9f0d9b602507edeb239f4f154
-
Filesize
7KB
MD5ffcf7d3f0ca48d0b41c76c6e417bbcbb
SHA163b42ed0d4f8d76425aa4d364841e760a35c4870
SHA25601fde96abf891f07cba37840f4bd9d1f99822bc4b58caae84c034d7dca671c57
SHA512d2fc7307b9ece013191cc9816c2abb75351239a9358c14cd0f320ff89a82def1ff8bc88462f52cb77a25bf932eaaf1cbfd2f7ff0dbf3d5d3fb101585406b879b
-
Filesize
18KB
MD5a93955ed9790bd1de1f364ea63af234a
SHA10a8a44742a6782072b400a4672deabd4f3d29f9e
SHA256f7e5031a0f3ae19741d39a176beb56ac0acad63d5e6ae52ee7d0c6a468acd32f
SHA512bf6395e24ed2308a21c38d20c002b5c76a0c28c1b8e79f2b380ccd4348ba6f2bfd4c971f9f861e8ebb14bbd21d5f9a4b204ceaf5443ae1854f55ef939332b2ca
-
Filesize
18KB
MD5f3b1497e1fd588d43ad2130a7e0b4fe8
SHA1625fefbf89917add9eb1eabc1c12246a6bc624b1
SHA256de454b0c5dcbb22a036b4bc4768ddf22ccc9c0c574472aa9ab930158a4f52e48
SHA512438b4a7754079c3e44132bcada929a0815d0d428a76d7d1a288730532afabca387e8af3438ba0b6ff6752f069392d91a67093181b15acce92f6e541136eb3d93
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize5KB
MD592304d017f8dbc4571b00b3b42cc82bc
SHA1862fa82bfefeb8a260b897435c923371e1ef5785
SHA256c759550062cfae223e9a5c3974db81af53f043034eb1da634f579e17e70dc2a2
SHA512f621ccfd7402442038644de2ba133cb1cc9d1f54e4bf4b1af450c5faca5ef8b8fcb7fef646693839569d4ed2ea0487fbdd4d89521f2e9552ee26a4f1642fddbc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVCJPK60\microsoft.windows[1].xml
Filesize97B
MD572bf25ac6d3c8077e265f7625887105b
SHA151b52bc669e01811e9261069b4e6c703160f3b90
SHA256760a918c3a9caefe1573ab926c6e3c703b0d0ce7cb3db83e018241bd5c72cad1
SHA512f4d5a1a1b044a22f85cca274419fa6b4bf6debe41689305a642696de8858c10ace5312b95795d2e4a6ae9d3df3130a203294008879fc87a4b81e3d2e99684160
-
Filesize
8KB
MD5b2a5ef7d334bdf866113c6f4f9036aae
SHA1f9027f2827b35840487efd04e818121b5a8541e0
SHA25627426aa52448e564b5b9dff2dbe62037992ada8336a8e36560cee7a94930c45e
SHA5128ed39ed39e03fa6d4e49167e8ca4823e47a221294945c141b241cfd1eb7d20314a15608da3fafc3c258ae2cfc535d3e5925b56caceee87acfb7d4831d267189e
-
C:\Users\Admin\AppData\Local\Temp\0adc2e09-eb6e-4d47-b4eb-a0b67373577c\test.bat.[62687D04].[[email protected]].makop
Filesize8KB
MD573a6a205500b702b474f0b79f602d66e
SHA11bace1f130dbba8e19dc63deb703cccbfbd78718
SHA256f7103f70d0719186b4f499ff026d5671dc6ec07be11262a4879c4ef5b34e5303
SHA51252a444d2111fd723c32573bad06236a583043981c1e6042f7bc32cd81be799124aefcb8666221f83a7f268026734058e658d8290ba65bad8ce79c9abb0643f44
-
Filesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
51KB
MD5bd74a3c50fd08981e89d96859e176d68
SHA10a98b96aefe60b96722d587b7c3aabcd15927618
SHA256ab305218ee0e95fa553885fa52f3a25dcc13b4deade8b7993ccb9f230a272837
SHA5120704243904abc3691177e34606fe2741945f69cf7ecb898655d98e81b145bf707d20cfa0af01fb3aa1cd170e2f3ce8f625b1612e0fcf5eba01f770617ffc9f1e
-
Filesize
71KB
MD56d7960a52b61551fed5ae46fc1f475aa
SHA168424a542d1d8b2ba26486753c9fa63d733172eb
SHA2569fcc5fc179dc359ce73e4ba4b7730a5ce57fb6575ad9b26171970812de25c5db
SHA51261a65528964576ea79e9f75b2e39d7562c0f4bf730b605fe6cd67fed41ffae40abe2ece54e277ed3346dff951d59902d5fe4329374e11f813dd571ffaf3c94d9