Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 10:11
Behavioral task
behavioral1
Sample
fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe
-
Size
660KB
-
MD5
fc857f195405b95292cba87d4d409fc3
-
SHA1
fdfe0f27a558d2f92c3f83e58417bcde1f7e2d5b
-
SHA256
25af346b7e1978d9946b65a5fe77308791bdf91a1c83582a6b748775f6f51034
-
SHA512
62b9f6eca7b82e2194f16d5060515297c80c925cf83da94e3f51df504d0a693b00213fe419cf14187214470f7178007430722bf20fa2d021cfa9e4e4e2a74b00
-
SSDEEP
12288:lTqLtDbIOKkatQoKXpa00bDqlQbnRiTJwYf1cN2nN2JyO6:lwpNawXI00bDqlkA1gyP
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" bjhost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" T05nYYsR.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuaaxi.exe -
ModiLoader Second Stage 8 IoCs
resource yara_rule behavioral2/memory/1624-0-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1624-5-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/928-10-0x0000000000400000-0x00000000004CC000-memory.dmp modiloader_stage2 behavioral2/memory/928-8-0x0000000000400000-0x00000000004CC000-memory.dmp modiloader_stage2 behavioral2/files/0x0007000000023441-42.dat modiloader_stage2 behavioral2/memory/468-52-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/928-90-0x0000000000400000-0x00000000004CC000-memory.dmp modiloader_stage2 behavioral2/memory/928-291-0x0000000000400000-0x00000000004CC000-memory.dmp modiloader_stage2 -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation T05nYYsR.exe -
Executes dropped EXE 10 IoCs
pid Process 4652 T05nYYsR.exe 892 kuaaxi.exe 468 ajhost.exe 4776 ajhost.exe 864 bjhost.exe 2768 cjhost.exe 4032 djhost.exe 2716 bjhost.exe 4696 bjhost.exe 4816 3534.tmp -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/928-2-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/928-3-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/928-7-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/928-9-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/928-10-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/928-8-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/864-59-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/928-90-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral2/memory/2716-92-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/864-128-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4696-192-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/864-197-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/864-279-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/928-291-0x0000000000400000-0x00000000004CC000-memory.dmp upx -
Adds Run key to start application 2 TTPs 46 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /y" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /R" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /o" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /L" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /V" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /b" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /K" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /A" T05nYYsR.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /Q" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /F" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /v" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /D" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /e" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /W" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /l" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /h" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /z" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /S" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /N" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /A" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /P" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /r" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /G" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /Y" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /C" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /i" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /p" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /Z" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /X" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /M" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /w" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /n" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /u" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /c" kuaaxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8D8.exe = "C:\\Program Files (x86)\\LP\\8DE5\\8D8.exe" bjhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /U" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /q" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /k" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /E" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /f" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /j" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /t" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /B" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /d" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /T" kuaaxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaaxi = "C:\\Users\\Admin\\kuaaxi.exe /a" kuaaxi.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1624 set thread context of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 468 set thread context of 4776 468 ajhost.exe 104 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\8DE5\8D8.exe bjhost.exe File opened for modification C:\Program Files (x86)\LP\8DE5\3534.tmp bjhost.exe File opened for modification C:\Program Files (x86)\LP\8DE5\8D8.exe bjhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4628 tasklist.exe 4312 tasklist.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-259785868-298165991-4178590326-1000\{30F9D4E5-6AEA-4353-B80E-06CF6DDF7C2F} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4652 T05nYYsR.exe 4652 T05nYYsR.exe 4652 T05nYYsR.exe 4652 T05nYYsR.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 864 bjhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe 4776 ajhost.exe 4776 ajhost.exe 892 kuaaxi.exe 892 kuaaxi.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4312 tasklist.exe Token: SeSecurityPrivilege 4020 msiexec.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 212 explorer.exe Token: SeCreatePagefilePrivilege 212 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeCreatePagefilePrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeDebugPrivilege 4628 tasklist.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe Token: SeCreatePagefilePrivilege 2924 explorer.exe Token: SeShutdownPrivilege 2924 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 212 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2924 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe 2668 explorer.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 4652 T05nYYsR.exe 892 kuaaxi.exe 4032 djhost.exe 4952 StartMenuExperienceHost.exe 4304 StartMenuExperienceHost.exe 2576 StartMenuExperienceHost.exe 980 SearchApp.exe 2004 StartMenuExperienceHost.exe 3652 SearchApp.exe 5660 StartMenuExperienceHost.exe 5792 SearchApp.exe 4140 StartMenuExperienceHost.exe 2012 SearchApp.exe 1644 StartMenuExperienceHost.exe 5484 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 1624 wrote to memory of 928 1624 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 95 PID 928 wrote to memory of 4652 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 96 PID 928 wrote to memory of 4652 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 96 PID 928 wrote to memory of 4652 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 96 PID 4652 wrote to memory of 892 4652 T05nYYsR.exe 99 PID 4652 wrote to memory of 892 4652 T05nYYsR.exe 99 PID 4652 wrote to memory of 892 4652 T05nYYsR.exe 99 PID 4652 wrote to memory of 3664 4652 T05nYYsR.exe 100 PID 4652 wrote to memory of 3664 4652 T05nYYsR.exe 100 PID 4652 wrote to memory of 3664 4652 T05nYYsR.exe 100 PID 3664 wrote to memory of 4312 3664 cmd.exe 102 PID 3664 wrote to memory of 4312 3664 cmd.exe 102 PID 3664 wrote to memory of 4312 3664 cmd.exe 102 PID 928 wrote to memory of 468 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 103 PID 928 wrote to memory of 468 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 103 PID 928 wrote to memory of 468 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 103 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 468 wrote to memory of 4776 468 ajhost.exe 104 PID 928 wrote to memory of 864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 105 PID 928 wrote to memory of 864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 105 PID 928 wrote to memory of 864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 105 PID 928 wrote to memory of 2768 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 109 PID 928 wrote to memory of 2768 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 109 PID 928 wrote to memory of 2768 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 109 PID 2768 wrote to memory of 4928 2768 cjhost.exe 110 PID 2768 wrote to memory of 4928 2768 cjhost.exe 110 PID 2768 wrote to memory of 4928 2768 cjhost.exe 110 PID 2768 wrote to memory of 4928 2768 cjhost.exe 110 PID 928 wrote to memory of 4032 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 111 PID 928 wrote to memory of 4032 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 111 PID 928 wrote to memory of 4032 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 111 PID 864 wrote to memory of 2716 864 bjhost.exe 112 PID 864 wrote to memory of 2716 864 bjhost.exe 112 PID 864 wrote to memory of 2716 864 bjhost.exe 112 PID 864 wrote to memory of 4696 864 bjhost.exe 114 PID 864 wrote to memory of 4696 864 bjhost.exe 114 PID 864 wrote to memory of 4696 864 bjhost.exe 114 PID 864 wrote to memory of 4816 864 bjhost.exe 115 PID 864 wrote to memory of 4816 864 bjhost.exe 115 PID 864 wrote to memory of 4816 864 bjhost.exe 115 PID 928 wrote to memory of 3864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 130 PID 928 wrote to memory of 3864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 130 PID 928 wrote to memory of 3864 928 fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe 130 PID 3864 wrote to memory of 4628 3864 cmd.exe 132 PID 3864 wrote to memory of 4628 3864 cmd.exe 132 PID 3864 wrote to memory of 4628 3864 cmd.exe 132 PID 892 wrote to memory of 4628 892 kuaaxi.exe 132 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" bjhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bjhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exefc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\T05nYYsR.exeC:\Users\Admin\T05nYYsR.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\kuaaxi.exe"C:\Users\Admin\kuaaxi.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del T05nYYsR.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
-
-
C:\Users\Admin\ajhost.exeC:\Users\Admin\ajhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\ajhost.exeajhost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
-
C:\Users\Admin\bjhost.exeC:\Users\Admin\bjhost.exe3⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:864 -
C:\Users\Admin\bjhost.exeC:\Users\Admin\bjhost.exe startC:\Users\Admin\AppData\Roaming\5ED02\E1C8D.exe%C:\Users\Admin\AppData\Roaming\5ED024⤵
- Executes dropped EXE
PID:2716
-
-
C:\Users\Admin\bjhost.exeC:\Users\Admin\bjhost.exe startC:\Program Files (x86)\02CFD\lvvm.exe%C:\Program Files (x86)\02CFD4⤵
- Executes dropped EXE
PID:4696
-
-
C:\Program Files (x86)\LP\8DE5\3534.tmp"C:\Program Files (x86)\LP\8DE5\3534.tmp"4⤵
- Executes dropped EXE
PID:4816
-
-
-
C:\Users\Admin\cjhost.exeC:\Users\Admin\cjhost.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\explorer.exe000001E0*4⤵PID:4928
-
-
-
C:\Users\Admin\djhost.exeC:\Users\Admin\djhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4032
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del fc857f195405b95292cba87d4d409fc3_JaffaCakes118.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:212
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4952
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2036
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2576
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:980
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2004
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3652
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5660
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5792
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1464
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4140
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2012
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1644
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5484
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6132
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5172
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5180
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5788
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4440
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:388
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5008
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5848
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4632
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5452
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5196
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5244
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:744
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5552
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4268
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5640
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2288
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5572
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1376
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5596
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4884
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4432
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5980
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4260
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1836
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5908
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5444
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4112
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5936
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD57af38992a27888b3f24b3d67e0cd15f7
SHA1ba6c20941f33522c90a8fbf2518706ae4889b2e4
SHA2568d7f9ac62c3a46ba220f1b68b8ff95e960e5385e6a63855ff61acdc1e1efa756
SHA512c89e27cc8c5e8a611342616b799f3b458fa793f9689e379f59fdb0ad042efcfbb2ddded40e580fccff52177eefc933337c8903f886a2b4100884c506e59f6c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize471B
MD5f3945b57f0f3c105bd40af2901e4822a
SHA193dabbe9a560f3d59ad8ce8d5dc941909fe21ec1
SHA25660ede5fc5d4e90f27afe2e8c8a14ebb0cf75df70ad29f8524f4b748a04203d39
SHA512212a88efd8a79e9b20aa86c83cb3f05e093a9233e4eb7e2d1064c599c8bbb5085b8ef45433d4d6266f80604af3d1e0a29dbbfbe124c5e18710ddb76b1ad2de0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize412B
MD5e3d21e3e965b765fb01cd9ce85777a0d
SHA1b61c09ed23616324ceb322b0163f863cb13da0fd
SHA256b1cec959bba3b9af65d24e947c0f4e11571565dd245fb8dc7f2a43baf25a083f
SHA512a491bdb8361f4d6de80823424c32c07b897f7a09c0dc3891505488dfa4855f3a85128bc1eb896c5434d652c0e54ef06ba6b97f5b014b68b97b52bdc952c849b2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6HXMW4P4\microsoft.windows[1].xml
Filesize97B
MD5feffd338250393eea6b6aa63cb0d77b7
SHA1883005ab3903a0996824a9c39a312fd931ed30a7
SHA256d7e0954477a02822a900acbdc90af0a32e2a00bc059356bb661d0aa6bbd78057
SHA512170215ca9f94134c9d3ac4438d65c8e49ef85f160b5d3c3327f3fbd1fb7abb0ad950e838dd2e8220fd1d198f4d50546693d0f5317328fca1f7f8e81c3dbd43d2
-
Filesize
996B
MD5cec336902ca0d9f653e2b27356fd6790
SHA19138245ff376f7b5e7541b634fbbe4aed9cab71b
SHA2569f9b19713fd1fead6aedbe8c481d330b30377f58e72209f25c23a19979a4fd9b
SHA512b17c76214a4425405ed9ea17cd08307fa09c5bc39772eab9bda341ec664957e1f4772fcd3117741f851be64ec9b99dae98ed5f869f80513e63cf945c0007086c
-
Filesize
600B
MD53d632600e16785d127574a7a44f8e638
SHA15bfc151f08c11d6f481c77fced9bc22befd4c388
SHA256589a0310810fde43eed3a78f5716fac95e3761835c29f39d64af3814544163df
SHA5120a8668daa7324bb5a5590da38109f7b84a1cc7f97fa522e3a917a769aded6ae36b5df1188355d6a32e811cd2fc67ea42dde9705890f7f39acc0391c90bfa2972
-
Filesize
208KB
MD5c03b162a3ce0d85d72a5e2d34bc95e33
SHA1e533fa6a044da55a516946fbcc41bd0746c26ccc
SHA25603aaf6e9947fa215f52555af92dbb87ec30c2bf34fefe889f62e2a0f93d5e13a
SHA512fc3f26b7bfb882522ae30d099fcce99b65a26a99fe2e97931e3e60470bc03f0d95af0871cf691d1e0fef82035461b64df0322ebb335b2abc5450617430034361
-
Filesize
125KB
MD5e077db6a52170b764f13396e01355eea
SHA1767f6f2166e784896769c2d5d4deb8275d432258
SHA25663056125548f6ed378fd5ec7af0200dac3afc66502e9afb85b745082ab801cd3
SHA5121fc1277a1e926f181c4c4a3dbbf5f04a721a820bd4ccb4d659f5176d4c5b62c35fd8a208960b474c25f81752888f72e8828ce0ace84edf3e5df8f940f50b070b
-
Filesize
280KB
MD5267a9925702b5076f2864a874bae587c
SHA103b91ee62b5e8a2b4ab5c2afba43094254f78fd0
SHA2564c5be16808f37c8436bd79db03cc560be7fa7e53459c47205d65feae308e929d
SHA5124381f0c55c8eda382399896b7d03082fa638cbd3364ecbfb79bde81c4b641df1844dc09e1753bcf6dd276346d1c2be6e1064ea9d49e05dad789f5951b1ccd3b0
-
Filesize
147KB
MD56b16e35bc9dcf8bce05757c2f79f8550
SHA18c94dc1a677ff7bbc220c09e7aa110dcef944060
SHA256da83de93f56331abf1f0183d668a895dd0545089870c422d6c016eb53fb5c2cf
SHA512dad0c75a36f792909b0724764cf310f387423af1945f8e992fd63983914daadd85609d8bd8a6913d48b4e4e216d4f835fa990cb7a038692d6ae4cdfa02f1f9c5
-
Filesize
24KB
MD5fd403fa137d95e25e21935df4e1073dc
SHA172ed5890f5d41d0b22ee7b7c511244b8217112bf
SHA2569e19bcb28eb1db1a7b52a5ebee9e8e4b1bacfd1e3ff34e42dea56d61a5a7a738
SHA512133dd44d2363591a0d5c17f291062c820fb960cbca54205077d862e3c6035fe0e833a4be57021d3e480bff19e908c9d3328b84dd2a3c4bb5e0a129316a853f44
-
Filesize
208KB
MD550b82ac0c4b152cea946988341eeff37
SHA1a4e5de12819e2138416f163b4b9eab701271d50d
SHA25656e1fcdab9a46330ddd78677ce9478b65f5108dd308a2bed9f7f134df1d51ff9
SHA512be8f3c6845a474ccbd71d60e6db00da435e4859944187360bb96642fef87e3efe1d779b59dc7400bdd840ae273cb116a14923ba804c38bfe50e0478ed61d3723