Analysis
-
max time kernel
53s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 02:52
Behavioral task
behavioral1
Sample
246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe
-
Size
771KB
-
MD5
246217ade9b88eb3cc1e3fd5ad3a1eec
-
SHA1
ca5d68a67eb0eaa719fd9d151fa7e386641a59c5
-
SHA256
4b7f316f2cfb86274ae9977e481a95c66877728773369105ea2a8e2b3f387c57
-
SHA512
3b31f45704aab02deeb10bfaadffb304b77ab2cad364c75035d3032068f88c76dafddd8ec037ec55874f52182f9c2d605e6e7fd69f2025cac8b277faf9b38f4e
-
SSDEEP
12288:l6HDFQPji50QKpVBeN33YuR8xMJHiM5M3vtESOkF59PjIkVyGNiwuAvzON:ojCPjHVB5u+xBM5259PlVyGNNvzO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" afhost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" khqKc8.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leqik.exe -
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2676-6-0x0000000000400000-0x0000000000418000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation khqKc8.exe -
Executes dropped EXE 9 IoCs
pid Process 2680 khqKc8.exe 3576 leqik.exe 2736 afhost.exe 4852 bfhost.exe 5028 X 4016 afhost.exe 4472 afhost.exe 3708 cfhost.exe 4300 54A.tmp -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1576-0-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/1576-5-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/1576-7-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/1576-9-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/1576-1-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/1576-54-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/2736-64-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4016-66-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2736-133-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4472-135-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2736-559-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1576-983-0x0000000000400000-0x00000000004DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 37 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /o" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /a" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /P" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /F" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /I" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /u" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /v" khqKc8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /W" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /N" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /X" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /k" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /H" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /x" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /L" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /v" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /Z" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /c" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /p" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /O" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /n" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /D" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /g" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /A" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /S" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /t" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /h" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /G" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /V" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /s" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /R" leqik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F9E.exe = "C:\\Program Files (x86)\\LP\\79D0\\F9E.exe" afhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /T" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /C" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /m" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /z" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /f" leqik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leqik = "C:\\Users\\Admin\\leqik.exe /y" leqik.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2676 set thread context of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 4852 set thread context of 3364 4852 bfhost.exe 116 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\79D0\F9E.exe afhost.exe File opened for modification C:\Program Files (x86)\LP\79D0\F9E.exe afhost.exe File opened for modification C:\Program Files (x86)\LP\79D0\54A.tmp afhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3800 tasklist.exe 4664 tasklist.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{E100A3B1-28C1-4DD0-83DD-3A16441BF105} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{8A2721B0-560E-4EB8-970B-513602878C46} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{51F64455-0988-4F04-96D3-BF6137FA44E1} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{9F5B2210-E7DD-463A-8201-741111780731} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 khqKc8.exe 2680 khqKc8.exe 2680 khqKc8.exe 2680 khqKc8.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 2736 afhost.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 5028 X 5028 X 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe 3576 leqik.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3800 tasklist.exe Token: SeSecurityPrivilege 4996 msiexec.exe Token: SeDebugPrivilege 4852 bfhost.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeCreatePagefilePrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1572 explorer.exe Token: SeCreatePagefilePrivilege 1572 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe Token: SeCreatePagefilePrivilege 1104 explorer.exe Token: SeShutdownPrivilege 1104 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1572 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 2680 khqKc8.exe 3576 leqik.exe 3236 StartMenuExperienceHost.exe 3708 cfhost.exe 4768 StartMenuExperienceHost.exe 4520 StartMenuExperienceHost.exe 4016 SearchApp.exe 1436 StartMenuExperienceHost.exe 2948 SearchApp.exe 2536 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 2676 wrote to memory of 1576 2676 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 89 PID 1576 wrote to memory of 2680 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 92 PID 1576 wrote to memory of 2680 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 92 PID 1576 wrote to memory of 2680 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 92 PID 2680 wrote to memory of 3576 2680 khqKc8.exe 94 PID 2680 wrote to memory of 3576 2680 khqKc8.exe 94 PID 2680 wrote to memory of 3576 2680 khqKc8.exe 94 PID 2680 wrote to memory of 2152 2680 khqKc8.exe 95 PID 2680 wrote to memory of 2152 2680 khqKc8.exe 95 PID 2680 wrote to memory of 2152 2680 khqKc8.exe 95 PID 2152 wrote to memory of 3800 2152 cmd.exe 97 PID 2152 wrote to memory of 3800 2152 cmd.exe 97 PID 2152 wrote to memory of 3800 2152 cmd.exe 97 PID 1576 wrote to memory of 2736 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 98 PID 1576 wrote to memory of 2736 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 98 PID 1576 wrote to memory of 2736 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 98 PID 1576 wrote to memory of 4852 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 104 PID 1576 wrote to memory of 4852 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 104 PID 1576 wrote to memory of 4852 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 104 PID 4852 wrote to memory of 5028 4852 bfhost.exe 105 PID 4852 wrote to memory of 5028 4852 bfhost.exe 105 PID 5028 wrote to memory of 3444 5028 X 56 PID 2736 wrote to memory of 4016 2736 afhost.exe 106 PID 2736 wrote to memory of 4016 2736 afhost.exe 106 PID 2736 wrote to memory of 4016 2736 afhost.exe 106 PID 2736 wrote to memory of 4472 2736 afhost.exe 107 PID 2736 wrote to memory of 4472 2736 afhost.exe 107 PID 2736 wrote to memory of 4472 2736 afhost.exe 107 PID 4852 wrote to memory of 3364 4852 bfhost.exe 116 PID 4852 wrote to memory of 3364 4852 bfhost.exe 116 PID 4852 wrote to memory of 3364 4852 bfhost.exe 116 PID 4852 wrote to memory of 3364 4852 bfhost.exe 116 PID 1576 wrote to memory of 3708 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 120 PID 1576 wrote to memory of 3708 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 120 PID 1576 wrote to memory of 3708 1576 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe 120 PID 2736 wrote to memory of 4300 2736 afhost.exe 132 PID 2736 wrote to memory of 4300 2736 afhost.exe 132 PID 2736 wrote to memory of 4300 2736 afhost.exe 132 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer afhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" afhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\khqKc8.exeC:\Users\Admin\khqKc8.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\leqik.exe"C:\Users\Admin\leqik.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3576
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del khqKc8.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
-
-
C:\Users\Admin\afhost.exeC:\Users\Admin\afhost.exe4⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736 -
C:\Users\Admin\afhost.exeC:\Users\Admin\afhost.exe startC:\Users\Admin\AppData\Roaming\0EA96\8C279.exe%C:\Users\Admin\AppData\Roaming\0EA965⤵
- Executes dropped EXE
PID:4016
-
-
C:\Users\Admin\afhost.exeC:\Users\Admin\afhost.exe startC:\Program Files (x86)\96019\lvvm.exe%C:\Program Files (x86)\960195⤵
- Executes dropped EXE
PID:4472
-
-
C:\Program Files (x86)\LP\79D0\54A.tmp"C:\Program Files (x86)\LP\79D0\54A.tmp"5⤵
- Executes dropped EXE
PID:4300
-
-
-
C:\Users\Admin\bfhost.exeC:\Users\Admin\bfhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\51367675\X176.53.17.23:805⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵PID:3364
-
-
-
C:\Users\Admin\cfhost.exeC:\Users\Admin\cfhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 246217ade9b88eb3cc1e3fd5ad3a1eec_JaffaCakes118.exe4⤵PID:4208
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:4664
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3236
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1572
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4768
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4520
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4016
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4192
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1436
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2948
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4316
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4532
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2692
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2948
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2160
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:496
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4180
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1044
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1872
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3344
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2160
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3472
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2744
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2960
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3328
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3956
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4768
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2032
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:216
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4352
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4944
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1472
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1100
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5048
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3584
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3472
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3796
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1472
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1172
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4504
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:896
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4228
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3880
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4332
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1116
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:492
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2720
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3468
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4308
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4276
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2544
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3636
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4992
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3468
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3396
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3480
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4412
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD508a5937a576b475126ca81d436937a26
SHA10511a1e2596ab2ab23d032c2883c3380fdcc9878
SHA256e74db8ec9e61cb575458a11f2c8e750347a3f50f2e3a0153a7e191ef64923519
SHA512e1da5dbf78aef5ff60d6d6b3961cce297bb0bf96aa51d1f115be1c31110684ecac8585f69c4f1124d712b65b718da0374dc859884fb595d3a9835617bbde8a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize471B
MD50ec8b3bf05b8b9b5840fcb91bd68dfa4
SHA170ea552c865a283ce68c8442fd4e5004a876c22b
SHA2565619d4ad38425cbfe75ca55c4ec5a6174f26ce64fcf59cafc0f0f6863ed47877
SHA512fe994b5ec43eeb6356febe25356485a3fbb0d91e04d9ce4354228afdb9e7511427eebe79fcb8503956aa6f436bcd14319aa40e8ef8ae4caccb6ef7db87fed436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize420B
MD5b380adc60693818f33999172f0199ed9
SHA16f87bcf5e8921f8e9ad98422e7e401f13116f97b
SHA256116cccade97bba979157da63e55f675ad466d2e6bf871745ba80d8502338066b
SHA5120a14ef312b07a038fafc130e4c47a94286aac6934a67dab06e5bc7c907579ee793d758414d2705ffa4b50b516c832447ab3ee7dfbd709772f779c06cdb88546b
-
Filesize
41KB
MD5686b479b0ee164cf1744a8be359ebb7d
SHA18615e8f967276a85110b198d575982a958581a07
SHA256fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
SHA5127ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5636ba51f433fc995b3d851c1dda36194
SHA15b02f5e93d0b231aad5864ee1d7082f442d15ad4
SHA25689e58eb634f158847311038b64dc0a98dddbaef0190cfe929505c7f3f282958b
SHA5121ccec54c45c4ee5f5f91ff60bdf59f79718e6cdbc838cfb78d826c25b7c9558ca3001b531fc9f39fdec35b587fd9efee01dce7c894f779676e6d995b08e18da1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133645351808416346.txt
Filesize75KB
MD50f5e6c082bd8f60409d8670ebe7191a4
SHA1fca2669f81acdd9883df0d85c531fd22c7e3a281
SHA256e59485ff3e0744735d163e19d99f6c35733735c62f12f2673c28336db616e8e9
SHA5125433c400d5b5e4041bba894b7123ed47f38e364796cf9e96964262b829d10a3a2f0b5e4eca3784e0ff22d31e1c07bda2a1194115078766fc6dd6520fefa14e1d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WSEA9K3C\microsoft.windows[1].xml
Filesize97B
MD5a10a5315af9b5ec3f167c7c4344ab6c6
SHA14e80fd779c1f21ecc2803b08447b0aafbf7eb04e
SHA256378ae674b3bd38b758bfc3e454467425f2481eef9c527a912088e3b541e31bb0
SHA512db214e86079aa7ce528a4846654428a2214f005859c0c5624417574cf299d6262c7046f0d2047484ac168ae155f6743679caf7556adbf96a83b554b7b26f2fed
-
Filesize
996B
MD53fdbfbdb2c076f3d335e92f616a66f67
SHA1995c0ae015a43d2687ce017fea56931567e36b60
SHA25611c08d592ea313ba82fa61f6f1f6cd33dd691f997312a6db58cafdbf17ee6721
SHA5125831da88592790797dec22fdf77bb18b0fdbc24d59c10a281a4bf0dc06e7347804d64a98811934d38afbb5f87aac2023d511f3d0fe49bafe3abb7d967a19a442
-
Filesize
1KB
MD5bc7512f357a2e79ad04c4f301a431ece
SHA159d18ff2bf3ff52ce997da9914f9d90b066dd79f
SHA2568610f9fdbc20478560884da22975cc2fead1a96b5f97cff77670affa0c4fff6e
SHA512347079a629d769b5252d595251a98d6c94423bd0d86ca3c6e9d9db8ddf0c704d860c27d007724687e82e60f2ff3acbc59987542ffd949aa848c36c02eb8c0355
-
Filesize
600B
MD59baa2d0fd5f9408b04d9f2f827dbe94d
SHA127bced51fdc8d1dbe8d27dc7329350c5c1ceab61
SHA2565e714726773de120c3cbf061169fc05963d3ebc83f44ee29e4d027c2e2d5b8a4
SHA512ec8955d4cd37de24da1c3b5c36c0f4baadeb0f42a2c959bfa6c5405774d610eb30d3c994b454d4d20b8ccc997c7dfdfe93b4c3797f1de7e7ab0dd03f777f4752
-
Filesize
278KB
MD5d9661054ea9d4d7f7169a5e32ba68822
SHA192c469afbc37b46afb9da836cf56fb22e641f8c5
SHA256d806df6405ee274aca0b653a3e55e605fc39cff0dabc4bc3f2241217065b2cef
SHA512b3c0da7738b0a9fb4be3a6537c9c13486dc251a8c65d1e79ac316a7b5d674843ff9501afd9f3ca2fd1edb4f2f17fab18e4e5a3eb93b313d2d70b7c2b47fafade
-
Filesize
349KB
MD565034c476392a35733b9c417d7ff6d5a
SHA19349234986401ead048087f96d9e105343772016
SHA256e1225f280526a772313cebf1047ec836241fd5f70ac9e67dafc1bd1ed6d46479
SHA51235d78126c48aaa0accbedaa332b191b2513cc7a89258c02b58ff3d08e197ee2441641ca4c457dbafd7170cd14ec37bb44243077a316375f42f3d763fd2933ced
-
Filesize
28KB
MD50170e4e883e8d259735e9359081e54df
SHA1e7bd746d436935a8b554ca366dedbc2f3b7b4d71
SHA25622552c2519683ef68f48a46622820aa8b5b0db6d97b75b8cbc0922420a9ff197
SHA5124094d11abcc3d634bb5629e2611b23aab6d2844dd9a0db75ce7a2b586477f853855bc3be3c2c111ccb80b982c0db6ebafe4fa993f923d2e7548200d7abaf3218
-
Filesize
212KB
MD5931b74dd032f5f54b645a0df13795a5a
SHA1ff7bc9e617eda75278ee82ec2b513c5042c646ba
SHA25695584b9c9baec5ceefe9fa7afb24cb187a2523f39bcd95d079b38ea54363b24c
SHA5125ae37ad365653a8654dc01525cf034bde59c6e319a06fc469a0167b4e060ced075e65a0d6ae747df71c4e200f06ebd12c0849a0b2feca50482240528484b75e4
-
Filesize
212KB
MD5644a1dec0f51a482d228625ab51ef5d3
SHA15bfc5bbab833ba0999d7cd5b036981d80c8a2e8a
SHA256bfc662f17f92e170f1b18d2b5aeff63be45128c447829e5e99bc235ba533d8de
SHA512ced3a024ea00c2d080dfab0528a9467a75f160a23fedcb176a719771547a26b2fcf23ffa9f1ae37e34978827d029c2f03599e749769f46ee9b3cb1bd060f280d