1cdf0dcd13a46906d73588a4f2ef20637d25706ce90b53a7b6f1701c28cb3596

Resubmissions

26-03-2024 14:35

240326-ryecksfd5y 10

26-03-2024 14:27

240326-rse2xsfb8y 10

Analysis

max time kernel
1799s
max time network
1563s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Size

2.2MB
MD5

f5f2f6c370db4b38bdf8032ea3ef2a64
SHA1

b5e188540539bc2b1d128f408160fa91e724c84b
SHA256

1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4
SHA512

f2216faac5d07fb2d6f3faf6cf1e18e94c0ada8aba35a8d2d8491efd1ada526d5358a592b6877a9783cc9b5e81dd54fec8b9969ffd650c0f8aff2e3243dbe18c
SSDEEP

49152:UtAZanCoV4BdnctNbS/iXmYjlV8O7pzTs8OYFFxZbVybdXERd:9x6Mdn0p7pzTsQR

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 35 IoCs

description	ioc	Process
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\protocol	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\services	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\etc\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\hosts	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\gmreadme.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\networks	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\drivers\gmreadme.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Drops startup file 1 IoCs

description	ioc	Process
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\System32\de-DE\Licenses\eval\Starter\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnrc005.inf_amd64_neutral_31e08a1c2f933124\Amd64\RIC410D.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\windowssideshowenhanceddriver.inf_amd64_neutral_184a2ef2a8f57c33\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.dll-Help.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\Amd64\SHK1N002.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\es-ES\Licenses\_Default\HomePremiumN\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\it-IT\Licenses\eval\HomeBasicE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_remote_jobs.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\winrm\0410\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comparison_Operators.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9b214cd9b78760aa\mxdwdui.gpd	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\fr-FR\Licenses\eval\ProfessionalN\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\oobe\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\IME\imekr8\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Path_Syntax.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\KYFS2000.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\en-US\Licenses\eval\HomePremiumE\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumE\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\Amd64\NR1302E3.PPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\en-US\Licenses\_Default\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_requires.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_neutral_024281c0e4e954e2\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnin002.inf_amd64_neutral_977d40799168c216\Amd64\IF2320.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\NRC420D6.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\en-US\Licenses\eval\HomePremiumN\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_execution_policies.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_hash_tables.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\BRD131C.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\kop5650X.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\Amd64\SODPFP70.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\de-DE\Licenses\OEM\UltimateN\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\Amd64\BRD7040U.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\en-US\Licenses\OEM\ProfessionalE\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\LogFiles\SQM\SQMLogger.etl.002	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-iis-rm\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_script_blocks.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_neutral_fe42c0ff14d5562b\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\Amd64\CNN0BSB2.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\fr-FR\Licenses\OEM\Professional\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-NDIS\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3050F.XML	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_try_catch_finally.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\BRMW260.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\Amd64\GS1350.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\spool\drivers\W32X86\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\EP0NGWAA.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\GS25006.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\Amd64\SHJ11N03.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_If.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_cmdletbindingattribute.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\BRM685CW.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Games\Chess\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\tzmappings	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\America\Yellowknife	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\THANKS.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Windows NT\TableTextService\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\DVD Maker\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\README.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\lib\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\Asia\Bishkek	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR23F.GIF	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\Etc\GMT-12	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\Asia\Thimphu	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\wa\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\SETUP.XML	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\DVD Maker\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_es-es_57eaa148e65e946b\HELP_What_is_Activation.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-s..ndthemes-characters_31bf3856ad364e35_6.1.7600.16385_none_08da32b0fdad9220\Windows Logoff Sound.wav	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-w..client-ui.resources_31bf3856ad364e35_7.5.7601.17514_fr-fr_28835b247b8dc014\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-opengl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9f1dd730362d85af\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_es-es_bdb4963adcf6cd71\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_right_rest.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-irprops.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1aa649193cd3e61f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\msil_mmcfxcommon.resources_31bf3856ad364e35_6.1.7601.17514_es-es_54e81c58c964bc09\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-e..ardplugin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_45b6f2ba3491ca5a\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-tpm-tbs-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3853f305e58e8fb0\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-h..eraccount.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b946edf70d82d1d5\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.7600.16385_es-es_b40708d8e59f572d\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-ocsetup.resources_31bf3856ad364e35_6.1.7600.16385_es-es_01c05cf213a96376\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\msil_system.web.extensions.design.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_44a49c7ff838bf6a\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_prnca00d.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_62efd6227ab667ed\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_execution_policies.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\Media\Landscape\Windows Pop-up Blocked.wav	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-n..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7c298b7501cfc015\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_prnkm005.inf_31bf3856ad364e35_6.1.7600.16385_none_5188943674b5f36d\Amd64\KOM8460K.PPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_prnsv002.inf_31bf3856ad364e35_6.1.7600.16385_none_6119bb87c03fede1\Amd64\SVC27D.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4080c452718ce6e7\Rules.System.Configuration.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Assignment_Operators.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-security-pku2u_31bf3856ad364e35_6.1.7600.16385_none_da64c5edb828c76f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\darkBlue_GRAD.jpg	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-bits-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_25a039f02b6b9e84\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-chkwudrv.resources_31bf3856ad364e35_6.1.7600.16385_en-us_281b3e7d53de40c6\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-ehome-cbva.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_39119d74f96b5d30\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-help-restore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_706db3f8d7bceae4\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_prnky004.inf_31bf3856ad364e35_6.1.7600.16385_none_3dd58b93065f62f8\Amd64\KYW7QUR4.XML	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\wow64_microsoft-windows-e..rformancemonitoring_31bf3856ad364e35_6.1.7600.16385_none_17d2ef5202301871\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-870_31bf3856ad364e35_6.1.7600.16385_none_cec09376fc836892\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-dot3gpui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_77e2e9495a65faed\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fca38a2d57506000\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPC3050F.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO2700T.GPD	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_server-help-chm.netcfg.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f4ee609ad8b50093\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_vsmraid.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_95722291ffcfc8f5\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-com-oleui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f6b6084bfe971dd0\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-932_31bf3856ad364e35_6.1.7600.16385_none_ceb194d2fc8f5269\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\diagnostics\index\MaintenanceDiagnostic.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_6.1.7600.16385_none_6193778dc77677cc\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e7a0dd8e60884540\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-t..inkwatson.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2604f382102fd5a2\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0a63b1ebc6aa1bcd\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-timedate-mui-callback_31bf3856ad364e35_6.1.7600.16385_none_f444b96c966a0a28\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-help-tablet.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f762dc5d4adc292d\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-printing-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7d222fb40c66703b\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\reveal_down.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio080b339b#\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-help-sharing.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ef6c9d490b38c2ac\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-mp43decd_31bf3856ad364e35_6.1.7600.16385_none_10281d340ae2249d\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\msil_windowsbase.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ed9bac8806f1bb69\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_job_details.help.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-whhelper.resources_31bf3856ad364e35_6.1.7600.16385_es-es_41e3badae70f0646\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-o..yle-specialoccasion_31bf3856ad364e35_6.1.7600.16385_none_01242a21ddccaf3b\mainscroll.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-wpd-status_31bf3856ad364e35_6.1.7601.17514_none_6a89387bf013b2bb\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_wiaky002.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a818ce0cb8f4c178\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_6.1.7601.17514_none_cc50331bf521b518\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\msil_microsoft.managementconsole.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0270ffd6aef43480\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\winsxs\wow64_security-malware-wi..er-events.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3c16e463677a0a71\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies registry class 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f443a5c000000000000000000000000000000000000000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2236	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2968	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE
Token: SeShutdownPrivilege	2324	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE
2324	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2236	2324	Explorer.EXE	34
PID 2324 wrote to memory of 2236	2324	Explorer.EXE	34
PID 2324 wrote to memory of 2236	2324	Explorer.EXE	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
"C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2968

C:\Windows\Explorer.EXE
"C:\Windows\Explorer.EXE"
1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Dont_Worry.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\Dont_Worry.txt

Filesize
738B

MD5
7854423ffc1ddebaf6d2aa0319df9da6

SHA1
102f885e12ab54c45788d080dfbfc259719c8897

SHA256
d00e18a6aabc9c410cf6ed54974e57d13a29d30cf561e21f3f2d6155fbc2a07d

SHA512
0d7b9473e003df7184d88c57c1f2a82c7afce00c560c8b8bf3d111551e89a0b651ec1fbccad8d6aa7042bcf23ba96a804cbc3b5b73466ea8b74bc18f2cc8345d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
8KB

MD5
8c45746958cdab1983fa661d5c4b9735

SHA1
7b40fdf85b957039030432fae9d56ddd7753a125

SHA256
5a5689624c2b494d2dd110c7aee5652bed64574b75b4c6074f5fd436e7a1ab9a

SHA512
4c00ca52e2f5e9d8cf838eeac9e8f39fafa9bd16ef6ca2d43f8c2579b5bff578f92f24cbfd2ad453ef66f8f5d4e9483bfffc77eede53d5cdfc6aa179539b7f74

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
4KB

MD5
9ad7f53d2aac8df995d60c70fae17ef8

SHA1
e7a19359d703c2af6571f8d6940288eee47abaea

SHA256
736d175aced106724275204c30cd4c7f5198782262a2e2e54a2dc703a81c13e9

SHA512
aa44213ff726e075b36ed9784f21d4bb8864bb6fb99f860ae08df3838f22338b8e83cab8f58e7d393482d61fda15e899cbfa6716cb393d8eb6f37c14393e408a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
6KB

MD5
1131dc766229c3a6a7f9f12dce1f9ce2

SHA1
66fcac71b7eed9293b884a93cdf9d979ea99e0af

SHA256
331caf22c558184bff9254fd4b084509fa1cb3a659472f04a9b07728ff53d956

SHA512
4a0a92b7e2bc2e55a76c32be63ebbf05f6ffaa12e274060aca938ebdbffff2b665219883b9d7d457590b952b52a04560d0a42c6858939f5f02ea514dd6bd468b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

Filesize
248KB

MD5
6179c9ea7924ab316536ecc06b687aa4

SHA1
80627b1ff031f08acc21b675d264c73247b61cc8

SHA256
be80e6775d9709d227c11aad167371fa30da6796e1f8588e092d113500c20c8d

SHA512
e7de71d41666c97c5841c6fd1d2246498aa2e3889da9982307c47f360b224b8a01904a6ae51642cf062a370817a4a873a3a115efcf7d3659cbdebdcbd14b653d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
13KB

MD5
5c489c5c0fbc5b1cccb9a58924036060

SHA1
796ac06797057a5d6f1f42c40db0158e95278ad2

SHA256
b99b8d2fc5466ed9a7864e29a43c4ba2c18335126fa10765758fff8069873100

SHA512
bb6fda7c94401a26b12540427960359b104b61d7b073889b25adf760fca48df37a1a88e83cb29758e4fde3cbc8200681a144faf9d8963651ccac3b8a0a6c0750

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
10KB

MD5
479de479cd6e8934d92fe53af5e2a85a

SHA1
f865f3996a5eae92f796d33c8075511f06c31fc1

SHA256
c6437804ea4b38fb25ce21785621da866202063f33e007b8ac7e6f6708988d24

SHA512
44f55d79ee866e3e8cdecd9730d5f6f7fedd2c9d74647943fb8ff7443627a0d86a25ebc9f2d8ae5e48029e933dbb89d099fcdb6ba7828747e307aab61c355262

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
12KB

MD5
d4e0b42d876d681f4c3eff798fb26569

SHA1
b02c33b89f42caf351bdedfe0ef0df566384eb37

SHA256
753675fc8f6554ddb9802fb4311287d95464b33642096070c8ce3db2057585a8

SHA512
177f14ee94e7cb353fbbef3298350bde6be3f8fe3dd5f6b4d258f3dab851488440baf11c4d90743fa56933f64f88166c710fba573a389d04f5d2bda375bbff48

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{5104CC3B-7FAE-455A-B937-96CF29EE6732}[email protected]

Filesize
3KB

MD5
ccd4c7d8459daa4e981b4dabb45019f9

SHA1
af0f0bd789358907e5758205eefe3725940f0eba

SHA256
7cfbdb75eada029c384a971b541fe3c52ad42629c63cc2ddaf9f3016f5a57aa6

SHA512
4ecf344b1d52ec12544376167af8d50782beba2f9a2548a899ccd863b92a5cc7163b0b3efacca7179e58a12dbf07f55460a3e4b9e73ad2ded27a10367080bf9b

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]

Filesize
191KB

MD5
e729d5c885f91208522d60226c4f26e1

SHA1
4ada45f0199c888128088df962b2692b3cac7e58

SHA256
90e99233894e36eace482dc64707780fda7b2e4cd3795f749dd945fcfc0da754

SHA512
53eabc438662046f919676dfe02e80676df5659ec1f6848303a70379155ad1a05c692cf1b8571ca68d46bf7b4d986cebbc0d04dfc276fad27a672e4c0ef4c6aa

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{8F7DDD68-8841-4710-B59A-3757534D6319}[email protected]

Filesize
2KB

MD5
54c33d5d3024be6900b67860b597d72f

SHA1
8ab98fa3910ac5338256b0f2bfec7c6e74f9bf6a

SHA256
e1e0384117d469abd9f1fca3685b903900ddc642606b56c10b00290d370903b7

SHA512
5d55f54c049a6249b7d86552694088f242c056db780f5d4acb5fbdbfe3678f11bb9c264cef89b1c9f0caa2257c7b805d6830d649ee7dd833310308261a0d7cec

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]

Filesize
2KB

MD5
9c63e52f292a0e646e7529f88d2d134a

SHA1
7676b317c189ed762b93395113437d0f4890788c

SHA256
39e90984b2c1abfe8cce477ab01379dae734ba058e72a6358e51d9f4392c556c

SHA512
b2749e9703c61358301d1d5bbebe77651f538ace06ead4ef8bec28b8e8be65bbba3cc24a13d9207df98248c38488827b3f0a18fcd905e7db9ebfcdf976001444

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]

Filesize
2KB

MD5
a6249d3bcd0cc07f868182357d7d848c

SHA1
904c52774334a1ec24e3525e94953c3ebf7dea77

SHA256
d70c1d16afdea59689c69899ce1fcfb7ba5975c26a1d7ad55a1fbc3571480f3b

SHA512
a42b1630b5cfccf1257d9b0abb48a4f74de7f255e98a3d9ec52baa9106827f1fcd4de7b606ebcbe7fe9cb6a517361c800787c7864d9eddb490cc3f11462e43d0

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]

Filesize
406KB

MD5
6cd25075f878c2e7a3a7dd6acbecb1bd

SHA1
f2fa78136c94120b4d548458c9d156e6569cecc7

SHA256
b00f7a0d1c99ff89594ae6ec939df6bdd8a02ce6c4f57d264e1785127a9f4a8a

SHA512
542d2031c170d72906493185e1b555bd4b7a4769cab589fb4d69c3eb26e92f95bb01bc710b4a305b4b64065f3e8711048ae7c011e414fa0a8b8570cf4d6d23d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
9KB

MD5
7ee750614ee9d3179ee046819e09afdc

SHA1
e4e2ce801f7b76d6be7ce0f16122eb06a302c80d

SHA256
4ed570761eec89144507bf6e75bd6c599966d205593a9347584854a00c66da07

SHA512
1836b4c09d79c4ad13d1a383f09dc1e5e3d7e6beef40827a6429f6fbb6d4b6d3bf729252ded8e76929dc54152b1915397f1e6cec3a67a7c18c1887b27633edf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
9KB

MD5
99f9813b47dcaf3d7e1ae4180c335c06

SHA1
b0f6548e7e1c5b6d66e05fd34280e71a7f8c0844

SHA256
2f401deb4ebda4adc9a970986e90d8a8db653a7119f276be98ef7a1c128aa775

SHA512
bd7559f93e0db5a55817c320e7bca53082fc2d52ceed21de4f85678e0ab2ed4d877db56d4e013b1d83ce20f66bfbf775d235d6950dadf09dc86fab0cc494b1f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
265KB

MD5
07b5c7c1362100700179d35ed34be6c2

SHA1
7253be166b0f48d36d19f4f6b8596ebdd347b8c0

SHA256
33a8e85289aea5669fbf57b75b45dcabce80133beed5bae812336b92974fcd4d

SHA512
6b659864fb96f549ecd9f43c0a9081ee52ea475bdfd29c267e8f88ea4577e7deecb2161827ee9c63dbbba299099b117b8de684a7e92c8787a09b369893cf3488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs

Filesize
2.0MB

MD5
15e2847b8c9d1d41c25c649e80a30e65

SHA1
ea8048ec7d631654a06ed42d99f30c9991dbd38b

SHA256
537ca02192af9d9351ad785690fb23d6ec026516d1d195e0ec60b7f94791e992

SHA512
0ceaa5c5ec9dc4f39cf7999a3b58ad4ece484db80bd55bd20a0ed7733399be12d3159b0efe6ecc90b1ed87f0df41ba30608ef8364d6a24e4e7bb525855c1df73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Filesize
49KB

MD5
bfc9a17a92ceaf36fe0937a9e54bccd3

SHA1
f07ffb5d82815cd51dd3139a28e5d3af035b0d05

SHA256
861db44e05f4d12dd740229100e72cf4dc0248db32bea9d0bb2b94851be2e5c3

SHA512
53fd27c1462c47c4f2bad8ac705df157c33b0169615b36ca4bec10a2b8c1bebaf0219450ccfc1b262d58ecf945c1407aa79d7e2cbc102049e0df86f908daadbc

Download Submit
C:\Users\Admin\Desktop\[email protected]

Filesize
288KB

MD5
adacccbfb5aa39a6b735b6d64332f536

SHA1
7990d57600f86985fc0e364aabc938ad76b8ce0f

SHA256
bcbe9a16c09df615f25f0806c13df4ddc5d75987bdcd13165d76a6301bb47668

SHA512
04554f19b1ac1d2f427eb5863e418ad424b4c27ed5bce46d1171f35224d10043872509f271c4abb569bb951ef7e949cd8a29ce675aa89ed98d72b0803076c9ef

Download Submit
C:\Users\Admin\Desktop\[email protected]

Filesize
800KB

MD5
26411bb436211fbb3300b58f0ed45d62

SHA1
38b675360a9c6e7dc55ca69a9a890ef141e5e396

SHA256
06af8baf31fd0b3ceeec7af64b3423f006976349860a28b02ccb7c7ea94ec490

SHA512
b5d8b6a91e7d99dd3106dd51d96d4eb7afb27141df6383e472f7e7d0ee87f8eec452c3b351f5775154e6efd013f5106a66070c4dabd19374fc4c23f9e7cb7193

Download Submit
C:\Users\Admin\Desktop\[email protected]

Filesize
493KB

MD5
17a72cd26607bf9f20525143088fdec8

SHA1
a3831249135e2c642a91985e6c75269ee239d564

SHA256
34ddddd43d3e35edbef4d1357a80760ac17f3e98a6915f1c62606035458f8f64

SHA512
f8263f6b0a51f871a1ca24b0a9efa24abc246a8e7550ea1d62d230766b55029813d7e8fceca3230b254722171c7071a63824646103a1f0d325897d908e7879a2

Download Submit
C:\Users\Admin\Desktop\[email protected]

Filesize
513KB

MD5
623e33b8be8a4d2febb833e782d3a0a9

SHA1
6089fe6d68ec2c71f75fe2cbf63dcf0e3c9f1188

SHA256
6b3a7f3e54d3e157a106de55b37bdc62732f578e4ee7720b9ea22ecfd8db5036

SHA512
55ddcbd545c345566ae2edd37e6c965fcb6d4a4e3ca8b6d9748fc1d92d1d4c9ff40b371e8e66564c7cc8350abee3fed18180b2ac6f95b2599df6f136663ed35a

Download Submit
C:\Users\Public\Desktop\Adobe Reader [email protected]

Filesize
3KB

MD5
3c84c47a81f35cf80bf7c9f09462b69b

SHA1
d69627751c6cb4016e92ef929a5a0ca71dbe8478

SHA256
8de038392505153f04c0c6d5ef90c59ab2d76e98f5c6ca8953e8f0b65bb4a53b

SHA512
2d68e72f11483f9f911bcaddaed5d2d9acb4ddda7f4f21d1255f3d00870cb75c5683b633cb967e614f9e06891d9a206ec097d547824fe30f1ac5e8e4621d238f

Download Submit
C:\Users\Public\Desktop\[email protected]

Filesize
2KB

MD5
e379fa8bb3f2eda5148a0ac4a976ccb2

SHA1
7f352b3c60ce629dde10348ee5cd6af50af77a62

SHA256
1d6bcd03ee22d1d8f03621df98c5688a6beacf9302e6aa9a13d829a3e7531331

SHA512
bb3e07c0b51c34a230bcb6ba07dee6af97d84f3f361edcbd402c71332079342443b728e1829636cddce11a48b4c08ef08779b83ed21b004067600040696bed5a

Download Submit
C:\Users\Public\Desktop\Google [email protected]

Filesize
3KB

MD5
962287ab2e122d9492d2b8b93744e69e

SHA1
01513cb7f395429b2993549d3b29437a6b9b3a3e

SHA256
e09f3193a1efe30d45f8abe8abc5061eb4f5e91cdad8e7b0b1a6a4d11f4d0917

SHA512
f135d1184d14f8aa7cee6fa2366f75c4101bdd41d56aaaf8e3e1778a67a2cd3935bd093e3f4bb14a49849c043e269225c8f2adca357c42d4c5c56679fb660476

Download Submit
C:\Users\Public\Desktop\VLC media [email protected]

Filesize
2KB

MD5
631146e7fd416c134b52ff5dbffadd44

SHA1
19aecce1367bdeb728b1f4ad4b4423b93fecc8c8

SHA256
4acce54eb4af5bd26feefd7a12326671caf2d460c794c0db284115aafbf527ce

SHA512
54b9f68943035fce09aea6f0aed3cbb21d666d085f242547ed86a9de94d98fb0b510f900815d476a61ca85cf8848157fbc8def697830a08cc7e8fed7768c4ce4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
14KB

MD5
31b226046df5ca291655ecfccd4afa58

SHA1
655f69eff049034ac9ce7f2c2a7a4ca6beb36ef9

SHA256
d64320fda2cd2f18fd45d708135d44f24aff3b22f9455d1b756460a939bfeb9d

SHA512
263f4f76b4eb83fbb57d08dc49f36076bc2bf4fa447fd7b90eca4c9ba8d1c4cd6bc713edc08aa6e0fa0c8a5f8796b5a00fc663bb3b3dfbc16de5b83745756088

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
14KB

MD5
81b691faa1c6cdea6c173d9e46b827e3

SHA1
24217bc6aeaed61c6beae62a8f5d049714edc834

SHA256
9adbd2fffc5e7bf27fd7cdff33daee1b353b9f2484e45e0ef86ba63035dccd2f

SHA512
d82ee6f732aa66edeb6c80a720c2cecb5603bb381cb167e5d54e86d18fe2060818170ea0840956e0d983f11d8d4dbfcc0678ee32b761aa54a8fceceef6bd3ec8

Download Submit
memory/2324-16556-0x0000000003C50000-0x0000000003C60000-memory.dmp

Filesize
64KB

Download
memory/2324-16554-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/2324-16561-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/2968-15592-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-15749-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-14385-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-9767-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-16399-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-5285-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-16506-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-16559-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-16560-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2968-16562-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download