Resubmissions
29-01-2023 18:20
230129-wy2v4aab6s 10Analysis
-
max time kernel
1792s -
max time network
1587s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14-04-2024 12:11
Static task
static1
Behavioral task
behavioral1
Sample
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
1800 seconds
Behavioral task
behavioral2
Sample
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Resource
win10-20240404-en
windows10-1703-x64
24 signatures
1800 seconds
Behavioral task
behavioral3
Sample
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
19 signatures
1800 seconds
Behavioral task
behavioral4
Sample
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Resource
win11-20240412-en
windows11-21h2-x64
27 signatures
1800 seconds
General
-
Target
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
-
Size
1.2MB
-
MD5
969305f9f01a46e8eee82885d9bde2bd
-
SHA1
a5cf52711faec6b7ec152ac074496a7a6e825765
-
SHA256
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70
-
SHA512
a916a1ef2bc9c77e9cb3476def54747dcf9c6819c9dd436d8e7ec4f9c3046ce850db7727fc97f820aba070015e06975540f5cacbf6e7341a3ffb787560590ba2
-
SSDEEP
24576:U0Xy5spQBcumH3iA537SEHKa3RoMF/tM7duvJkdV4KL:U0iupecuYSAt2E53WMF/+duvJIV4S
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2840-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-7-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-12-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-15-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-17-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-18-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-22-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-24-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-25-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-26-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-27-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-29-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-30-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-31-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-32-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-33-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-34-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-35-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-36-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-39-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2840-71-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\B24AC6DEB24AC6DE.bmp" 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-150.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Hedge.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_11h.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim1.sad.scale-150.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\PREVIEW.GIF 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\Assets\delete_12x12.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-150.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\PiSh_placeholder_small.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\StarClubTile.Wide.jpg 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-high.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarLogoExtensions.scale-16.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\PiSh_placeholder.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\1d.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5941_48x48x32.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\sleepy.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleLargeTile.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-300.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-36_altform-fullcolor.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\4608_20x20x32.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-125.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Popups\Upsell\dont_ask_check.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\AppxManifest.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\_Resources\index.txt 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\badges_diamond.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5601_24x24x32.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\er_16x11.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-250.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6701_36x36x32.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Jack_Of_All_Trades_.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\NavColumn_Black\Icon_Supports.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-unplated.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\flower.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-white.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-24.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mo_16x11.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-200_contrast-black.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_11d.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Themes\aquarium.jpg 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim2.smile.scale-200.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-100.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-colorize.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.scale-125.png 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2717123927\1590785016.pri explorer.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri SearchUI.exe File created C:\Windows\rescache\_merged\4032412167\4002656488.pri explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1748 vssadmin.exe 784 vssadmin.exe 868 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe -
Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000003853646d6c8eda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000db174a6d6c8eda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000006772bf1b8a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065551368052" explorer.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 2200 vssvc.exe Token: SeRestorePrivilege 2200 vssvc.exe Token: SeAuditPrivilege 2200 vssvc.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe Token: SeShutdownPrivilege 256 explorer.exe Token: SeCreatePagefilePrivilege 256 explorer.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe 256 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4424 SearchUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2840 wrote to memory of 784 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 74 PID 2840 wrote to memory of 784 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 74 PID 2840 wrote to memory of 868 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 78 PID 2840 wrote to memory of 868 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 78 PID 2840 wrote to memory of 1748 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 80 PID 2840 wrote to memory of 1748 2840 629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe 80 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe"C:\Users\Admin\AppData\Local\Temp\629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:784
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:868
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1748
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:256
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD58769b6bcb98e3d7f72409b6759449fb2
SHA1634e431e42691d75940852b695d3b83b44e6f95a
SHA2567915742ecfbc696d56c55d3c1e479c71693edbf91765dd11dc170bfc0dc36acf
SHA512e974aef33755552ce0203031ab7b3443c2454c8246295b9c0c62fe8afac2f879a4314324459e1c1f94e30aedab8ecba68e36588cbe925df8ced68c946258acad
-
Filesize
1024KB
MD5eec3fe6baad1a086027cdd438077289c
SHA17d85f86f8447d3c16d85406bf39fb3def1a8cf82
SHA2565b4aaee1e8e08ca9dbcb68bf922d6cac5b61b0c2c7bf00a272c65dc881d50d57
SHA512f8ea256986ba1948104e2e72f03ebd699f6a6ecac9db0642a23115e9a48c984b7fb01026bf312e6bab494b4505033a684fa19d8955bc303e30f0739cbf664ef4
-
Filesize
1024KB
MD55761d5c82649efc792b8a9afd819c383
SHA1b666bf79772e857211f4bbfb5e1c36d3555a8d7f
SHA256465726b90368cd8e36bb1769145444f9b946eb7a338f24e44a92005e9f4c5e3e
SHA512b691d402fbfa0199e058a58b52380e4297721c9b0456ede1b8b3ec77121db5dc80926dbe4cfe3b4e4c18b26accdc4af2f2f05da2b6d3c3ffcea112867af2bc61
-
Filesize
7KB
MD55a9642d459cbf1be05ca5e52a4a9142d
SHA124eb0bebddff4e3e58de4583a94c7453e8f89dc6
SHA25616bafbf0aeda01f8287aae20e90f91eb85dc0f3129510d0a1da3777232a7935a
SHA512a24fbc22be9bb5b137266d5928ac48e0e3627d88e4608351d06a8cae732ad673d529be451d19281079617669eaa8cacc3e023e3361db3a3533728fb670b03ff0
-
Filesize
7KB
MD58b580a54ba8510d8ea41ed3873556428
SHA10ef24e68c3063d5e58829a33fd15bd7ee60bf60d
SHA256e5aab11ccc673bd490ecd29a1d86f9afce7e98db9c0d9a03158c18e217306913
SHA51285165894b0aecca419a50f6b3f84992304590a05d66ccbd3da8d4bcc66a04d383274d67fe21a145592b2d903e0588938fecaca38da610ba8311aa07eab115dcb
-
Filesize
1024KB
MD53aabc4bf6bdd14699294220f6a1f4729
SHA19a47a69b8371dc499aaf36df4949e4fd7c9c68d3
SHA256da398c29b43f27b898b0ab0b389c98d95eb0cc95232b7bd2a320c9817708be62
SHA512913f5746cc417e6010661a1d03ea59605e438c440b6db9c9775cc92bbf78ca61f5ab39f5cbcee2c0fcc684b941bacab8ea99ed24293212ff0065b8a69d63ffc2
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD588514bed1dbd866dc5026c141d99206b
SHA12598fc94ee02895852843673d910c961e8dba09e
SHA256f8bafb7d3c3608af6131c0a0c312c996b4621c7f5140686bc5a0c2b056c64666
SHA5120e3bcb186223e0a2993d23c2a55b7c85e9e59a97f2333128ba2ada79f436eaf1f94c626ce196b4331a758620c0d1b83061077cc63b5e1d3377e28058a7d52193
-
Filesize
7KB
MD57987596ea194a1254fab7fba595996bc
SHA1743de41c9c94e4f0cfaf676fa8d0f6168dd9d4ef
SHA256f023811b848ad0280abeeecd8d2805721ff7e985213189c7a83128f197644b0c
SHA512b9ee09887d142ef0938218269a7b7c42321ad52cd869c9319e1a753a0b53dd993ccab13036dfc50ac39aa39e5458948e6ae8650b43762485dd765009115bba2e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GO5H5QJ1\microsoft.windows[1].xml
Filesize97B
MD59a9d57ce5ae07c9a465ffe30cbf86ae4
SHA1bddc659daeda718ad86dff1c9704c82b175c497a
SHA2569c367bd2b12a2a3d767133956fac9619215c636639ff04eaf222f221a426b5da
SHA512d7c81b18c7b66b8a12e0af3b47b1dbbb91a81cb1d85c70e73d2b3fd62ce8fdd4f752350c5ae4785a909d3931f59e65741cafa3bc743d58f5f2e1021611e5e033
-
Filesize
2.6MB
MD5993cc909a89f0fb7fe90acc3703c2105
SHA1f422cdcb426718b235a19080b0daf71c9b448768
SHA2564aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA5125ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
