Analysis
- max time kernel
1774s - max time network
1600s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system - submitted
26/03/2024, 14:35
Behavioral task
behavioral1
Sample
1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Resource
win7-20240220-en
windows7-x64
17 signatures
1800 seconds
Behavioral task
behavioral2
Sample
1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Resource
win10-20240221-en
windows10-1703-x64
20 signatures
1800 seconds
Behavioral task
behavioral3
Sample
1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral4
Sample
1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Resource
win11-20240221-en
windows11-21h2-x64
22 signatures
1800 seconds
General
- Target 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
- Size 2.2MB
- Sample240326-ryecksfd5y
- SHA256 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4
- MD5 f5f2f6c370db4b38bdf8032ea3ef2a64
- SHA1 b5e188540539bc2b1d128f408160fa91e724c84b
- SHA512 f2216faac5d07fb2d6f3faf6cf1e18e94c0ada8aba35a8d2d8491efd1ada526d5358a592b6877a9783cc9b5e81dd54fec8b9969ffd650c0f8aff2e3243dbe18c
- SSDEEP 49152:UtAZanCoV4BdnctNbS/iXmYjlV8O7pzTs8OYFFxZbVybdXERd:9x6Mdn0p7pzTsQR
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 30 IoCs
description ioc Process File created \??\c:\Windows\System32\drivers\etc\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\drivers\gmreadme.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\de-DE\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\es-ES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\ja-JP\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\es-ES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\it-IT\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\ja-JP\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\fr-FR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\drivers\etc\hosts 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\drivers\etc\protocol 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\it-IT\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\drivers\etc\networks 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\fr-FR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\en-US\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\gmreadme.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\en-US\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\de-DE\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\en-US\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\de-DE\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\ja-JP\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\drivers\etc\services 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\it-IT\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\drivers\UMDF\en-US\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\es-ES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\drivers\fr-FR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Drops startup file 2 IoCs
description ioc Process File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_8f7fd8c8bebf813f\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_91108ad24fd52958\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\LogFiles\Fax\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\spool\V4Dirs\BA9EDA38-EC9C-457F-8A7A-AEA97C1FAF7E\69b8a4a.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\en\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\Speech\Engines\SR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\de-DE\Licenses\Volume\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_24354f2ba7675c87\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\MUI\040C\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\es-ES\Licenses\OEM\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kyclra3fxps.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\GroupPolicy\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_d7dfaeafc5f693d0\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_0cb53cda7110ff2f\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX71PIPELINECONFIG.XML 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_e77733cbee7e6db0\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\catroot2\edbres00001.jrs 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\0\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\en-US\Licenses\Volume\Professional\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\spp\tokens\ppdlic\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\DiagSvcs\en-US\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\de\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kyclra4xps.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\spool\tools\ja-JP\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\fr-CA\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\WCN\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\oobe\es-ES\privacy.rtf 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\es-ES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\blockSoftware.xsd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prngeclv.inf_amd64_5626f47f96e3c55b\GEclV1.GPD 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_61ee6f7340253bf2\amd64\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MP640\CNC173FD.TBL 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\SecureBoot\de-DE\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kymona3fxps.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\ras\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DiagSvcs\fr-FR\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\Tasks\Microsoft\Windows\Live\Roaming\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\wbem\en\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\integrator.exe_Rules.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF03.GPD 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prndlclw.inf_amd64_22943612af676c5d\DL-PCL-pipelineconfig.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_eec092acf44d0f6e\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\spp\tokens\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\Tasks\Microsoft\Windows\Maps\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\config\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmboca.inf_amd64_9d1fc732e40565e3\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\ja-jp\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\spool\drivers\W32X86\PCC\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\WindowsPowerShell\v1.0\Schemas\PSMaml\developerManagedEvent.xsd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\wbem\de\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxpclbw.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prngeclv.inf_amd64_5626f47f96e3c55b\GEclV0.GPD 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnhpcl1.inf_amd64_c6040b9adc0369af\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\System32\DriverStore\FileRepository\prnhpcl3.inf_amd64_0e666fb8f1b0545e\amd64\hpc6mw81.gpd 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.scale-100.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\Pin\270x270.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-200.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-125.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\7px.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\images\OfficeIcon.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\oliver.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gq_60x42.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\as_16x11.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-150.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close2x.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.ps1 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-white.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1938_32x32x32.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Goal_6.jpg 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-125.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\smirk.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\es-ES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\Scale.scale-140.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_48x48x32.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Eyebrow.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\malthe.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-140.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-100.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Square44x44Logo.targetsize-16.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\star.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-200.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\edit_12x12.scale-200.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsLargeTile.scale-125.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\surfaceHub\en-GB\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-125.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\UX\Controls\Xbox360PurchaseControl\Xbox360PurchaseHostPage.html 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-unplated_contrast-white.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-100.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail2x.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxManifest.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.targetsize-64_altform-unplated.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\AppxManifest.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\BuildInfo.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\jumbo_cardback.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\Data\3DBrush\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-100.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\si\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\lv_60x42.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-24_altform-unplated.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\gameEnd_strip.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..adam-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_9298296bb92485c1\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\x86_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.15063.0_it-it_02554160a463586b\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\msil_xamlbuildtask_31bf3856ad364e35_4.0.14917.0_none_feafa18e2eab6806\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Frameworks\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\AppxBlockMap.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\commoneffectsassets.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_73744ad59cf0f4f0\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..smsrouter.resources_31bf3856ad364e35_10.0.15063.0_es-es_6e1e767f6a1a61f7\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_10.0.15063.0_en-us_b1be0393dcb525bf\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..ctivescan.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_c969e533c7811306\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\wow64_windows-defender-ui_31bf3856ad364e35_10.0.15063.0_none_3171a1ad4d2cf35c\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\x86_netfx4-mscorsecimpl_dll_b03f5f7f11d50a3a_4.0.14917.0_none_940dc9eb761a7ab8\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\assembly\GAC_MSIL\PresentationFramework.Royale\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.15063.0_es-es_241d9dc7d8998e2b\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.15063.0_none_aa0c0d3e7ee02877\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.15063.0_de-de_1ed6a9e128bc40a9\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-wdi-adm.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_475daf1739dd350e\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.15063.0_none_01e0e8792e07e99a\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_10.0.15063.0_none_b5e633933a90d26d\Amd64\CNB_0357.GPD 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.15063.0_none_7282599ccd3acadd\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-o..framework.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_55cddd6d2bb91136\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-125.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-setup-adm.resources_31bf3856ad364e35_10.0.15063.0_de-de_d456c0ec5387aae4\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-w..geacquisition-winrt_31bf3856ad364e35_10.0.15063.0_none_1d9f2cf1ac5dcad6\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\x86_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_es-es_f42b8f285136905f\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-photoviewer.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_d2f5701a62123446\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-api.resources_31bf3856ad364e35_10.0.15063.0_it-it_028915ee2399e773\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_prnms002.inf_31bf3856ad364e35_10.0.15063.0_none_635a3fa2f390829b\Amd64\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_hdaudbus.inf.resources_31bf3856ad364e35_10.0.15063.0_es-es_f003b590ca4d7d2c\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_f883ebc20cc094ca\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-snmp-adm.resources_31bf3856ad364e35_10.0.15063.0_en-us_b54aa7facc9174d0\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\x86_netfx4-system.xml.linq_b03f5f7f11d50a3a_4.0.15552.17062_none_0a51186ee27eca62\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..cementmanifests-com_31bf3856ad364e35_10.0.15063.0_none_c9050d505bcf787f\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nlahelperclass_31bf3856ad364e35_10.0.15063.0_none_af2efd2600b835db\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_10.0.15063.0_es-es_83dd277eeef3e90e\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..panel-adm.resources_31bf3856ad364e35_10.0.15063.0_de-de_c56a62106c537540\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..rammar.0809.cortana_31bf3856ad364e35_10.0.15063.0_none_edd19eb85dbe3e64\VoiceAgentsCommon.0809.cfg.gz 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ction-adm.resources_31bf3856ad364e35_10.0.15063.0_es-es_29e3515eeabbf5cd\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-eappcfgui_31bf3856ad364e35_10.0.15063.0_none_9f708a85d49b48ae\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..lers-maps.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_91b2de3c63a2fe18\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-pshed.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_517f9b0ad94ce3fb\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-desktopview.appxsetup_31bf3856ad364e35_10.0.15063.0_none_9990abebb85f13a5\appxmanifest.xml 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..atahelper.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c326941a91d32e58\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_10.0.15063.0_none_2f3f1dfd8cb03410\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-mail-app.resources_31bf3856ad364e35_10.0.15063.0_en-us_f3800d7d44b23000\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..rammar.040c.cortana_31bf3856ad364e35_10.0.15063.0_none_d05dfbeba9bfdf8e\PhonePCVoiceAgents.040c.cfg.gz 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoftwindowssys..ore-tasks.resources_31bf3856ad364e35_10.0.15063.0_de-de_6aa9de9ce23f3952\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s...appxmain.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_0cf1ae4317c73a4f\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\assembly\GAC_MSIL\System.Web.Entity.Design\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.15063.0_none_7a7f08f436397aad\PPIRemovableStorageDevicesSquareTile150x150.scale-400.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.15063.0_none_2bd1e3a1cfd67be0\logo.contrast-black_scale-400.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..main.assets.cortana_31bf3856ad364e35_10.0.15063.0_none_e7716ec01fa1cfed\SmallIcon.targetsize-32.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..cognition.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_1dc2eb141c4db35d\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-100.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_10.0.15063.0_en-us_8d885d994802dff9\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\osf\moe_status_icons.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ck_60x42.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.15063.0_none_5a69877f495f87b2\RatingStars44.contrast-white_scale-200.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2ded559f#\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File opened for modification \??\c:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6449_48x48x32.png 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_18ffd0cbffca71db\Dont_Worry.txt 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80703004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000ca1370088c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80703004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000095dd55088c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80702004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc76000000000000000000000000cbe20170a164da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80703004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000658a501e8c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80703004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000278fd41d8c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80703004c0062006800200075006e006900720020007300760079007200660020006a006e007600670076006100740020006700620020006f00720020006f006800650061007200710020006700620020007100760066007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000000000000000000000000000000000000000000000000000000000000278fd41d8c7fda0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80702004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc76000000000000000000000000cbe20170a164da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133529782391385200" explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133529782391385200" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80703004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000cc3c5b128c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80703004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000b27937128c7fda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80703004c0062006800200075006e006900720020007300760079007200660020006a006e007600670076006100740020006700620020006f00720020006f006800650061007200710020006700620020007100760066007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000aeef4c128c7fda0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80702004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc76000000000000000000000000cbe20170a164da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1788 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4612 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe 4612 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3336 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 3384 explorer.exe Token: SeCreatePagefilePrivilege 3384 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 4588 explorer.exe Token: SeCreatePagefilePrivilege 4588 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe Token: SeShutdownPrivilege 3336 explorer.exe Token: SeCreatePagefilePrivilege 3336 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 4588 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe 3336 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2648 SearchUI.exe 5004 SearchUI.exe 2792 SearchUI.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1788 3336 explorer.exe 99 PID 3336 wrote to memory of 1788 3336 explorer.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe"C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3384
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2648
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4588
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5004
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Dont_Worry.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1788
-
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\Dont_Worry.txt
- Size 738B
- SHA256 d00e18a6aabc9c410cf6ed54974e57d13a29d30cf561e21f3f2d6155fbc2a07d
- MD5 7854423ffc1ddebaf6d2aa0319df9da6
- SHA1 102f885e12ab54c45788d080dfbfc259719c8897
- SHA512 0d7b9473e003df7184d88c57c1f2a82c7afce00c560c8b8bf3d111551e89a0b651ec1fbccad8d6aa7042bcf23ba96a804cbc3b5b73466ea8b74bc18f2cc8345d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
- Size 52KB
- SHA256 7f1ae986dd082bffe615736e234c619c512757a8c288045ba38c9cf706bb148f
- MD5 ec47c0abe805c8d05fe3cbb638cba707
- SHA1 40fb51fc276bfa351967c095b2bd97486a64c224
- SHA512 3f46024bfb86075e807ce275998d31d3ef6ba19a63b884e6adc40c860fc69534ccf4301c58475f1ad20e6d0bafc7d516ceda4101715e4f72c15c7ed702c2a396
- SSDEEP 768:gZWyMVXYk36xiCQcVy5quCxyE5vi8Zar/WsiHaIcVk8GHGa/v768PGL876qr6X6U:XdVXYkVfcVUqujivi8Z/sM8G77qL8IX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
- Size 5KB
- SHA256 8f3fa83f44b69bf87dea62934c7fea19599a95ec49c92b3e8d2b4857d0ad5547
- MD5 0d4eef7c72305f2584e9ad0e3e0e98d3
- SHA1 a2a1e15fa90c876e2c8c6aeae12da86cb6d576e4
- SHA512 7e5dedc38fdcd3b85ed4a23c35cd3719e2ff0ca74db35d0f8c1d377aec607c17177b2d30b5d26504aab3ade1f0944897eed3b1517a8bc60734675986561e9c2e
- SSDEEP 96:kNFG63aSu7TpnfaAik9wGWJCLu/+RgLwz0wt:0G8aSuZnf2Gy2G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png
- Size 9KB
- SHA256 4cf96b1f83cc6ba7741b11ef0563c9bb2150352854cb030cb5326e6cdf7063af
- MD5 a834feea5430d32bf91ef47623792b24
- SHA1 c19598f65243fd5154eeea8adf6122e235b5e1d0
- SHA512 9b52127f90ca166afa4e455804c2a00fb5f4a6d7fe90fe44a9a0a7bab27c73c340b31dca050c5156d67eea8085f8f41ed7c9adfaee96db4cbdb4a6492370ed54
- SSDEEP 192:Vq4OEtWhQ+QfaNLEpocVakd72KeVh1MLgDly4FPI7/h7v:M4Xsz4a/haclVFgxv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif
- Size 9KB
- SHA256 db4c00cfdd7757fec7a7912b9b499854fcc39d773a0530a01fecaa538b7e9315
- MD5 6c076b182e4a1bedece71c9fb5c83754
- SHA1 648e4b8716c201683b41c21dd12ac34531155701
- SHA512 e1cb22ef8342b03dab0f9de556cce00f954971008b2a805573f5f9316e10c8fea3e211bdad613c4e4d6df3b0bec813a135d437eb2f19534a4ef528d7ec6ed8fd
- SSDEEP 192:MXUfCs4uIwDRgjSM9XGtlbD3ag16wOfAJfm1qYFsaRPoTwtM:Ss4uVRgGMOD3+wOfAJfeEaRPoTwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png
- Size 16KB
- SHA256 e3bc9f29a4aa3e5e0a4ef037119a80a5fcc582d87e59c41bae4a4eb826a7413a
- MD5 388142008f1b0080ad527b27f6c22d15
- SHA1 572a67dcdb0292ef7482d61e1946a7e9d131474b
- SHA512 d9ab18d74afb18113528c4ccd3aaae2402275827bc24f21a36a11e3ea111ae869695ed97e6b18466478c6ccafcf582f6f969876d756225955f6d9929ab9cedd2
- SSDEEP 384:8xIUCXxXJgTIsa1rwnVMLY9UfvbxZ57Xztr/znP:8GUyx5gTIsa1rk2Y94VZJZ/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png
- Size 10KB
- SHA256 6ef8b87b8d33f37d560060d347d7dbc08be6f2456e0e6bbf4a1e5278e0570969
- MD5 1eb7e3789798ad74ba3230bb2e041458
- SHA1 8cb52a8e7bd741dc46ddac76aba54d580adc2651
- SHA512 8f3330916826b2fef87f924e88ddf4b5ca2645ffad2c07610a14ae1860c0d2277a5aed84802d5f6ef1bb2238231d473bd6f92734b0ba8d2135e3720a7293a5f2
- SSDEEP 192:yBgXQTGIzh8wP5d7DmXysx3H46P5YVlmZt/m70I329eAjWB:K4cGtwRFD0XtVZ1m70k2i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png
- Size 20KB
- SHA256 71fca7eaecd6b224b59930195a5d0f3cf94b229721f92c9342a313e0042bcb36
- MD5 3e28ce00d6123d3f9cda183809a06bd5
- SHA1 89ac55ac5dcb024c8a13e7a24a48230769241472
- SHA512 8dfeb7349ae954789695169f01eee65ad688b740fd4907021ed0cf812a2b17219cb6a072545644df52cc1a764987766e3e71941a068eebfe646631c9333648aa
- SSDEEP 384:dy2rStHXW3Hw9rO+lnN+MfAGkV41Or7LzscUWclAB:heGH4rnlnNnlkO188mB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png
- Size 9KB
- SHA256 369a54fb42ada1c0007e1ff0d9910f3ba754996096031a0bdcc70c759362de17
- MD5 a2a8b2a18b033f241a7b4bdde6fd601c
- SHA1 2b66bc38adba8f424afb7ffa06cd3783de930fe6
- SHA512 7e1ceca068eb87274505f73b80704afa03c4da356f1d5c16b9ad5dd1fe142eb2a0edd597a4ef786868ee9492271453203883e65bd6b3faf693da0b809c3412d0
- SSDEEP 192:i0zJdIOTJpA70BZF/Y9My6NiqBaXRipf+U4Lu7gTn0:i0zJSOLA7CM6MXRMfOCZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png
- Size 18KB
- SHA256 976ecdc91d86c6cb90a307dc215d085e92ee111cd4e82590a7a87e220761ea46
- MD5 013e4e97a01a18c163f339f6514a0261
- SHA1 57214be55856f541e2cac6511302741d84af76a3
- SHA512 fca1c4d1b9fff0183e65a07de6f9d411e09d21a2760cf1527065fe95e260265d063f953d4aaa8670edb248d3dbb34962922149a6c9b120f0dddbf0ab96a0cb0d
- SSDEEP 384:eoeF6B2x4bNc5ZuoToFOl0/0n9mNwL5i4igz9:cF6EkNc5Zuo0FQ0AnL5t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
- Size 34KB
- SHA256 b29fc5af02065642031b11c38762090871fd431fe22a717cc6c99aef63e51d5d
- MD5 fac877352e0ec60c5685b050cd24e7a1
- SHA1 fc1404c0b92f224c50bfa34a233b9dd693d25957
- SHA512 023d61d9f9119a520a61c57161567f81773cfa6b415e77ea1e52c1ec505ac155804cc3b3774984f166cfaef3f3bb8054c6cbdad87523f3a141fcb2a9c0c9b512
- SSDEEP 384:E/E2vjCM1ciiGjCgpCrriWxFh9wkyM9A/HmmG6E5FFMyMVs1sZVU:Ep1ciZuPrjFhqrveo6F+yL1sZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbres00001.jrs
- Size 1.0MB
- SHA256 e263d5e0d05c7bf9dd3033707c2f0e92e4d637f08051abf81a42a3d3f63f725c
- MD5 c32823df77f2e83058c56054d89989a0
- SHA1 f23d2a1a1e7ec2ec90e568b09729419d23dd0ce5
- SHA512 abf131c1e643e6a82f7a5ebd50a0800e9f64b0c1c29ea448e2b8ce62f81c76ab35140053536990483fe696da375a422149476aad512044a5898847e1992e67fd
- SSDEEP 24:R666666666666666666666666666666666666666666666666666666666666662:tff7eCMdwuJKCfz
- MD5 SHA1 SHA512 SSDEEP
{3287238D-0307-4D4B-83C4-154B458A0EB2}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{3287238D-0307-4D4B-83C4-154B458A0EB2}[email protected]
- Size 2KB
- SHA256 e3b7454a9861745e3cb9134836e6fb4b3a1a558bddd14870590a7c266e05a19c
- MD5 147a00aa50507ac9c88eb22e974aa4ab
- SHA1 6dd9b28ba1141bab1861d20e5fc25e291bd14176
- SHA512 40832224be640d28c11184d249dff28ba19c7f972af13e982a96ba6d2dc5e927213dbcbccfad01c75bc3b99a9b9e1b73378d51ea3f0061e6310d3d6fa74106a3
- MD5 SHA1 SHA512
{3287238D-0307-4D4B-83C4-154B458A0EB2}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{3287238D-0307-4D4B-83C4-154B458A0EB2}[email protected]
- Size 2KB
- SHA256 ad2ee5621d0a7a6414d8507fe1cb7926d945344e7fd90b3b6215901a0d5de9eb
- MD5 e5b47e708694c50250a9098fb08bd942
- SHA1 c6b3af48dca3c43484cbed8ca28471277b04d3cc
- SHA512 3f910985ff7fc25e223536f26159a96a7a365c724232e9ccfbde023b7387e419de2b5fb812cc297c87241ba520da1cbb7416f6e1e9de2543626cc6003de91bb8
- MD5 SHA1 SHA512
{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Size 281KB
- SHA256 c11fa6ea7520c60488917cfed4f66800745c1ba5a7a1e75539cd1b405faa675b
- MD5 9bc0577d3af9ebc2491a0cba9fd605ca
- SHA1 7035c442f0d95341887907c6aed442e76a4a978f
- SHA512 183c45e9726031955b1dae60ada147f294b2c972e1b438455575e4b3588cbaf19865058614b81bcfceea1a7efcaad11d5ddc0b585edd09a682669dc8a1ed0128
- SSDEEP 6144:XLVksFdHnSmcYfJSMsbe88ZhUQConPJ+I4LjvZ3O4GPasL816KGR+YpAJ:XWKVuM1PZfPJ+p7ACsL39S
- MD5 SHA1 SHA512 SSDEEP
{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Size 281KB
- SHA256 a383bab82ebc45b3ba00d0bd2511ef393a5a12e68d38936652bf9c5e9cbab8b2
- MD5 8d03591be361b8f32b9c5e1e276103fb
- SHA1 4fbc279c4fb62fce5b31fb8dd2c75dc35e7b26c0
- SHA512 dd86d8b0bb3f1a425f153886092ab7064f82b8d232e71877501ad4e93b3a3891c9ce7a1d69d141dd494e9afccb5f339a2b086bff856f530de018b374134c0485
- SSDEEP 6144:zQd4n2rZweLFymDApfAVOuev0zdsEHWui5Xs+imdfv/iPx:zclRoI225Hm5XsT
- MD5 SHA1 SHA512 SSDEEP
{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
- Size 281KB
- SHA256 09a3a84b6772f1ff40b4a1a7bfd92f9b174999da90fc7457ef6ff63b7cd34ebe
- MD5 c2594534f4aec01998724e2cffeed86f
- SHA1 ea1ed54d2c223e877ca8aaaeead7cdaac0fa0e92
- SHA512 aa0627b1b9eaf0914bed06bfcd2b4392cd3e2086322ac1b251cd5ce343a9a9e44e79d396c8a9668ea2d4edb45594999a64fb7a0871fbbeff87ae9add97fccced
- SSDEEP 3072:OQCYcv7E9Fh9FYvITzfTzBHibkMwczYoe6+IW3DSra8f:gu1ibkbczQVTSa8f
- MD5 SHA1 SHA512 SSDEEP
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
- Size 582KB
- SHA256 1b60a5c537ab0c4d956a085b24e05d538f85007773ddf4a0fd431d46950143ff
- MD5 b6cd5cebda337fd38d6663cfbe10823a
- SHA1 1f64d504f1bf3a87316c51d9e1209ed90bedbb59
- SHA512 4d4e4a337b782b4500cc4b15d3f97918c865e087c71a9b7b557c1c11184e28bb34ed4cc0f476e19939488d88a25ff9b70c77adbad0b586d0b09ae508d16713bc
- SSDEEP 12288:5tKDbOFFomtAIefs4hTvIi3k2fy6dKgk3PuH7Qf3O9Fayydk8xO1:vEOFCmtAIefhT40Kgk3bO90yy
- MD5 SHA1 SHA512 SSDEEP
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
- Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
- Size 582KB
- SHA256 9a147fe0fedbf4515fb8a302f4ff65bc754b815684ef4ec8fcbda4f0c356f115
- MD5 6332f343f81909ab6ff4d1dbef476628
- SHA1 bc38b5f3b0acf50d706eb5ef586be0787057f893
- SHA512 aaf9e6cedcd1501b098bbf33407e8117cf385cbeb3e1e37c598004d150b47836de09c39fb9bbcea32edf14b90e005bcb8aee009bae8ed0c285dc25bc0948efbd
- SSDEEP 12288:xk0cj8e4g+B6jnQZPWmpjJG0uIDVafEqrsfub:xk0cRd+cj/mpjXuIJaOQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
- Size 9KB
- SHA256 02526e120425eae2e68aa4384f5a10f625d6ae977df1de154d0701d21404eacc
- MD5 5967f706ed3a92c469f05edb51e2f371
- SHA1 706040d7380a79506ac842953785e51e0f2d4e24
- SHA512 9861ad0e45f22cfb4eb49f9ebd6b9a14c6d302f7cdcf2f245e4c2d555ad692b16fd34dbc982e0078452e55e93dc5f3818fb1d4bc9ee682fb48271456c6a67f79
- SSDEEP 24:I66666666666666666666666666666666666666666666666666666666666666T:tVf7eCNiD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0
- Size 9KB
- SHA256 92493c5377ddf0b2abccd2e5a3f4d373ea496170d17e419f845fb3fa0d5d9152
- MD5 2acfb02054a0a05abf66127b9bfaa032
- SHA1 be8eff8dc3a2c20f97647114c02a167a5e1d8bc8
- SHA512 8d15f3d15b73be9edd952b9b5e90b16afefbe644fb4eeb8aaf1de087a0845d1edd0501d6437f57e2c498d1265ecdcafc8bf870f6f1fad2dddb69608e7f81df6a
- SSDEEP 24:w66666666666666666666666666666666666666666666666666666666666666M:l3f7eCYfQk0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1
- Size 265KB
- SHA256 487a630f220e470b98cdd865dd98586de74ab225038bf8aa24d37a6906314a52
- MD5 4350cf8340f96820051eb9296663ff2f
- SHA1 5e3c4c79a86802dcb99593603cbd0b18ca056d2f
- SHA512 aba5eb7c1c61daf9f00d0983e01cb6f9f86fe3d82f6e834bec666d7e9dbc84f3b09df8a025c6fdded5489cb4e3411bf157f046b969cb147733e13cb211011fd5
- SSDEEP 24:k6fT2z666666666666666666666666666666666666666666666666666666666N:h2kQf7eCOMbsdhDkk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3
- Size 9KB
- SHA256 4d7626f69fa883d9cba97e3c8c290ffb2cf1a059a53b867118569114f349c7c2
- MD5 003879df0aaf25d76c1ed996acea07dc
- SHA1 ff007e10a588793c6f3f955b9fd82604c76ad9b1
- SHA512 ebd327cf5beb58d768c4c073e035d31d27876682dc1c8150761d6f713521d65c2dbd46cc775fd651f62b2b3759439a23cfe3168a9e0fd90cc2625c7205312dbc
- SSDEEP 24:gS6666666666666666666666666666666666666666666666666666666666666L:g3vuf7eCbXq3
- MD5 SHA1 SHA512 SSDEEP
{3DA71D5A-20CC-432F-A115-DFE92379E91F}[email protected]
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}[email protected]
- Size 98KB
- SHA256 a166d4372dfc8ecb21db8a4d8f44dc73c325c75159311c4e10c07efa9e5ebcdc
- MD5 0530c14c57d7303d824d59988da63397
- SHA1 c4dbc2a57eeee918d49d07bc38ecf3736924d7a6
- SHA512 210466d1e5a3b2f83fa08bbf102056063677edd9b125a502734424d6db203b06b2b242326b328c0e034c5ef99da264983ad8718d2fc10b44bc19a3927786c3b8
- SSDEEP 3072:M03bEPHh13gnloizWbMAnHxLWwAmEN11Osq:M03bEPB5gnfinRL3EB
- MD5 SHA1 SHA512 SSDEEP
{3DA71D5A-20CC-432F-A115-DFE92379E91F}[email protected]
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}[email protected]
- Size 47KB
- SHA256 350fb730928b82202d677a6347ab9158b7851e035029b2281ef65516f203bdc2
- MD5 8d49c8fd282d33badaf6bc64425eaf25
- SHA1 453ec991f44602d1d4921158833118ce147abb85
- SHA512 76eba24c9a8ffb57b456444c06d51d6497dbd986e5ffffe1210930160cf13db64f3f6db1fde72351f330eae885d8d934986a002a0d72efcf717baf2427d12124
- SSDEEP 768:DwWVRz3AFiY4MZC0trNJ+tQIKlwPW5gaNz3JOOb6ByDNtex:DNFC4+CW8KwPWWaNz3JOOb60DNta
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
- Size 1024KB
- SHA256 e3a28286539c52c6033903756db5966c9abe5cfaa5409639fcf5a62a49f145d5
- MD5 97f8ab834536d35ca93a638ca3f1e469
- SHA1 425275e0dbca3107462574ac2804545bd1bc46d6
- SHA512 9df38d9e1b57e7e85ca2d9f5e989ad37fee60da740c199119273a6f8b0629b94216fc3c3cc39870c972f196f8fe34577584fef0a178562d9e45d36ac72d8f7b9
- SSDEEP 24:0P/X20UqwA5qKM0epSf0A+BqbsYlR4ugs+YQl0UqwA5qaj+BFKKdE47iOxTl:0PnM0gSf0AP4YwBs+YQsjJKdE47iO/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 33730fc5d7d988030fce5a73a02f06e39d2189727e08ca2b9bd027331bfa315a
- MD5 cd4b5e67492d94a79d2012fc1bcb7101
- SHA1 e3358b7e315a93a5f19fa68dc5df23b0179e8705
- SHA512 73c1b53a1022bde35d52ede32cc766ec2799c5885254e7ce26c29132db0a7e8cfb82d658b29cc0247abb25cb45be25193ccd38fa12fc1e7ab3c4b13aa5e878f3
- SSDEEP 3:8m/llAl9/l9Flo2D1ls//JR1//ljsXWS+//:8rm2D1q/D1XGXWS+X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\V33FP3AE\microsoft.windows[1].xml
- Size 96B
- SHA256 5ac3b7a4930cdf44e52f4a3299275ce5bf6ddaa116b279e2d9fab346bded7775
- MD5 ccbb0fdf00314a68967d15cc27bcad7f
- SHA1 c08fb7b8acd3ae46a1d837e7f6daf6f26e590913
- SHA512 d78cc3683136f55b0cfc2d79d8a5ede40d72c8da4a07339c9d0653793a6dc2be7474b9725cd15d0a5b104927ea5c8d17d9455e93580eee72a0ecec5c22689fc6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\j1lgjc9k.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
- Size 49KB
- SHA256 73b76dad52921209d3e1aee9859c9f2e3cd2c8ed31455fa85bcc22dd3dd4d3b2
- MD5 c3e64646d74a94d031074b33fdf1698b
- SHA1 e24356a0560d5690b46640c6f6d6cdcb87431b89
- SHA512 8894e3b1d28da14db3803995cbad1117ca27ba6ce35f0960d22d0fa70abd4d4ce61328d60e0021aa8576af4181a56f2a4a42ba1feac827be6fe30e5503b5cd28
- SSDEEP 96:b8DVV6JTev1FmIXaEOVbuP2pzsMzSe4+ZMfMhr:o/6q1Fm4nLP2pxz2Qeg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
- Size 21KB
- SHA256 13963bef6b6f75e22bbcc69c628af7d81daae900af12b95018cec5a6618ef3d7
- MD5 88cecf2e2b98b4aed44e91683337178c
- SHA1 c5125a43285eb17e497d3d764c94c67514080a7a
- SHA512 5d6ab1294b6191190c3dee0c27ab5a48e314d17b8938ed45e97c1afad7a8ec6c2e24f22175de38c0f9143234d7e8408d32db9b90b45a48414a41a421f10c4000
- SSDEEP 96:777777777777777777777777777777777777777777777777777777777777777N:1lssrZ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
- Size 14KB
- SHA256 b6f17963efbc4b8f15cd391d2c734dd248523449124b4f5970c57ce5c74ef616
- MD5 7b9d4f32e7118917d3a2e1f312999517
- SHA1 1aa2eda46c7d5b6f9b3389f4dc052e5472fe2380
- SHA512 bbbbbdc7752c3871ce88e680a301e77e2a219314a163ee936797a3d2738c6a9dbd3b514a318c998972fa4234bad75288133ad7a58ddd9b8b7e0a0ac72aabec60
- SSDEEP 384:p/G/GKhwLRSt9i6TxNaXTlek8mmU5hN4fxle0skn/3tQx:pe/jERSPi6Tx0XTlec/4zBskPt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
- Size 14KB
- SHA256 92060a81436b0e49950b56c778a778b887a0a506fa1accfbd5366f60113d3e2a
- MD5 f785f3f37a0bc6efd074eee30931adbe
- SHA1 f21e666b3b0ba7cf91a482dbb3b4cc4be2c46b91
- SHA512 d002f66b1df2defc7e9cf116a18453aa836b60e961dd2634300ed949651428d2c766cd3ee84605265a51b0c80610ac872032624ee8762c5a5db736c165172a24
- SSDEEP 384:eOh2a1O01wwIFx1FT5kHpCG5LFzG1TH69aDp:eOB1O0eX7mHTHzG1THTl
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\V33FP3AE\microsoft.windows[1].xml
- Size 1KB
- SHA256 04d307f8daa932c365a598f721855c0fb34cec9d8873250808ec940a7565e145
- MD5 9401cb48bdaf5e973e1597595ffaf865
- SHA1 eeb1114469c3b297ae968ec3a902b5a669a68f8d
- SHA512 a1f3aa0a286a837ef67489b9306dbe5707af9c91fbc132d8f400b442dc80e144350dc45d0444b80f5582db8d0dd9931e0247ab8adb0e9e48df861a60acc561d9
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\{9B8A714A-2DAA-491D-A802-58C5186EE582}.png
- Size 7KB
- SHA256 b51bdd7fd7dcf0c6c052bc3f7cbd4b60460ca996f7b06cd7c5178551a51a769b
- MD5 7513763a284dbc180c1ea1e684add1f8
- SHA1 4506ed31299708d8dc3de19254dc2efc23d29c6c
- SHA512 4d1481d78a14388f4241c4e1c630a742769884495e0c1296fe4e5f110b34aa4e4ffd46ee81ace7a6e17d8ed893190a9d0693341865a93ec8d8a442585eee86ff
- SSDEEP 96:JGwYrrepGm0XJYUGNdKy3TUy4lsyJ5z0iYslSUv+P9Ok0As6sq/kEqBw8zt48vU8:4wsDzJYU4+lJ0TU2FCEIzx48cmd
- MD5 SHA1 SHA512 SSDEEP
