Analysis
-
max time kernel
206s -
max time network
196s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-07-2024 14:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Endermanch/MalwareDatabase
Resource
win10-20240404-en
General
-
Target
https://github.com/Endermanch/MalwareDatabase
Malware Config
Signatures
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Program Files (x86)\\Def Group\\PC Defender\\pcdef.exe\"" MsiExec.exe -
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Executes dropped EXE 2 IoCs
pid Process 5708 rundelay.exe 5852 rundelay.exe -
Loads dropped DLL 16 IoCs
pid Process 3504 [email protected] 3504 [email protected] 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 4644 MsiExec.exe 2264 MsiExec.exe 4644 MsiExec.exe 3504 [email protected] 4644 MsiExec.exe -
resource yara_rule behavioral1/memory/3088-2613-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-2679-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-2664-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-2666-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3354-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3625-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3637-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3656-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3685-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3711-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3712-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3088-3791-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" [email protected] -
Blocklisted process makes network request 1 IoCs
flow pid Process 39 4644 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: [email protected] File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: [email protected] File opened (read-only) \??\L: [email protected] File opened (read-only) \??\P: [email protected] File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: [email protected] File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: [email protected] File opened (read-only) \??\O: [email protected] File opened (read-only) \??\V: [email protected] File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: [email protected] File opened (read-only) \??\J: [email protected] File opened (read-only) \??\S: [email protected] File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: [email protected] File opened (read-only) \??\N: [email protected] File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: [email protected] File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: [email protected] File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 17 camo.githubusercontent.com 36 raw.githubusercontent.com 37 raw.githubusercontent.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-up.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de_2x.gif.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugin.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-default_32.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview-hover.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyFolder_160.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyFolder_160.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\plugin-selectors.css.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\id_get.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_en.dll.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File created C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-disabled_32.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluCCFilesEmpty_180x180.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.jpg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044 [email protected] -
Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI25C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2603.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2710.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2BDD.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Tasks\sys.job MsiExec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_FC03FB89D84E75F2C05EA5.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI276F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A44.tmp msiexec.exe File created C:\Windows\Installer\e5823a4.msi msiexec.exe File created C:\Windows\Installer\SourceHash{456A3B12-8FE6-41AE-9E5C-5E55F0712C09} msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\Installer\e5823a0.msi msiexec.exe File opened for modification C:\Windows\Installer\e5823a0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2672.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI26B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5823a4.msi msiexec.exe File created C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_368235FAFDAA3CD0178CB7.exe msiexec.exe File created C:\Windows\Installer\e5823a8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2517.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI287A.tmp msiexec.exe File created C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_FC03FB89D84E75F2C05EA5.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606} msiexec.exe File opened for modification C:\Windows\Installer\MSI286A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B00.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2976.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_368235FAFDAA3CD0178CB7.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundelay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 [email protected] Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString [email protected] -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 27 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133664764678006207" chrome.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" rundelay.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rundelay.exe Key created \REGISTRY\USER\.DEFAULT\Software MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rundelay.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\delrstrui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BVFBWDIZZTMALRY.bat" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rundelay.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rundelay.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\InstanceType = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\AuthorizedLUAApp = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_PC Defender v2.zip\\" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\PackageName = "[email protected]" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\ProductName = "PC Defender" reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\NumberOfSubd = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_PC Defender v2.zip\\" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d4a6ac9265dfda01 MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\Media\1 = ";" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "124" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\DeploymentFlags = "3" reg.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\AdvertiseFlags = "388" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\support.microsoft.com\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\AdvertiseFlags = "388" reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\SourceList\PackageName = "[email protected]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\AuthorizedLUAApp = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\Assignment = "1" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\Version = "33554432" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_PC Defender v2.zip\\" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\Net reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\PackageCode = "793E8A3EDC915D546911442ABED08716" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\SourceList\PackageName = "[email protected]" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\Clients = 3a0000000000 reg.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\Language = "1033" reg.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 796 msiexec.exe 796 msiexec.exe 3088 [email protected] 3088 [email protected] 3088 [email protected] 3088 [email protected] 4480 chrome.exe 4480 chrome.exe 796 msiexec.exe 796 msiexec.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1396 MicrosoftEdgeCP.exe 1396 MicrosoftEdgeCP.exe 1396 MicrosoftEdgeCP.exe 1396 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe Token: SeShutdownPrivilege 4932 chrome.exe Token: SeCreatePagefilePrivilege 4932 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4652 msiexec.exe 4652 msiexec.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 4932 chrome.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe 6528 taskmgr.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4440 helppane.exe 4440 helppane.exe 4824 MicrosoftEdge.exe 1396 MicrosoftEdgeCP.exe 1112 MicrosoftEdgeCP.exe 1396 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 2580 4932 chrome.exe 73 PID 4932 wrote to memory of 2580 4932 chrome.exe 73 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 2816 4932 chrome.exe 75 PID 4932 wrote to memory of 1616 4932 chrome.exe 76 PID 4932 wrote to memory of 1616 4932 chrome.exe 76 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 PID 4932 wrote to memory of 4688 4932 chrome.exe 77 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa741c9758,0x7ffa741c9768,0x7ffa741c97782⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:22⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:12⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5784 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 --field-trial-handle=1696,i,16983201323015092577,12590998495490723359,131072 /prefetch:82⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3076
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3504 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4652
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:796 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E4C5A7F19E1663B5C4404A452B0FD4542⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:4644
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DEFBC740CB9D898CE2F1AC6716C49A9E E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:412
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F39D87973BE5CA0CC9F5D87045467AC E Global\MSI00002⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2552 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5376
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5456
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 /f3⤵
- System Location Discovery: System Language Discovery
PID:5524
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "DEL /F /Q C:\Windows\Prefetch\pcdef*"3⤵
- System Location Discovery: System Language Discovery
PID:5648
-
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5708 -
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0" 14⤵
- Executes dropped EXE
PID:5852
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_InfinityCrypt.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_InfinityCrypt.zip\[email protected]"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4572
-
C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_PC Defender v2.zip\[email protected]"1⤵
- Enumerates connected drives
PID:3128
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4488
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4440
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4824
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5092
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1396
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1112
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5180
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:6528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5d824da81ff9e31cb55e651cd4048d5b7
SHA102cf62a351171295f20d679d49ef5f4f27544597
SHA2563d45491d1d91615235bc179df48c55bac12b5e1d6611bed66e0678bb6400ce77
SHA512d7e109c085060b3340291518da5759c555218cced3634288bc02995441d28bc34bcc7e80f3ca7cfedafd471730a464e361190ad82b5446273eecf5ce1a87fe30
-
Filesize
14KB
MD5c652a14b4d7168a30496c00f0d4f657d
SHA169927276efa6f6e7b4b138acc59e8f344635dd13
SHA25613b66d2c3b5b3dab79a68b250b1c4fcb6fdedb3d90d09ddeaa2547391421b62a
SHA512a44eb36676179a3a454f8959fd73ba5ea89a9d7e5eb59bcac56f160cc8b7a1e2bc622f50518920e372341d439348fb7c798115f0c7640978d3be6d203b5c2035
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize16B
MD5bd63dca98c05b2ed17cfe250116db10b
SHA1604a8953c9a91b92f86d2cbafaece9c9e8f818b4
SHA256b34fad843d4b3f35f87a7e8cd3484ba109a08ab787892a652a19fd7e91ff8b32
SHA512d6388ea17f380b7ba2e6503d8149fcce5a2d73d6f320abe9b0c582714c92eab6f4e734b242414d47c8ac1ba716dfdb43f8ecae36ac5e8bad1738ca65d700f913
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize720B
MD589b9e11aad14765b601d6f2e9bd89ce5
SHA116c20858a19769b2a063b6015eea3e1ed42274d3
SHA2567223706de6da4de9ad64bd92eb8aa2fb2a55abb750d24ad6af89107a15eea8ad
SHA512cb29bde447b5c39ebce4ca7fc15ec066dbed60a0be08a3fdff892565d194e79d1dd5dd5b8423d88a2abb2679c234947fd52c4c88170bdb37af4cf26a46691649
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize688B
MD551fc6777ac9f1cc99f885d5589aefec1
SHA1553d292268eeb5409786bad1c1c28e0cb476fec7
SHA256eb16ab82bd82899bc02dbb97e48fcbd990efe06265fb5482cc235049729e5e9e
SHA512bc0e08cd424eb07b1f538d8524af60d08f8f0dc008d34ebbfe3a07c8c665b75dc65d47628a5dd4dc2094475deb1471791560f20606c1b558c079856300f503e9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize1KB
MD5b69128a8899a799422466f59e966a14a
SHA1d284167c183020b928d99987b0a996167a6f3ee2
SHA2565066b01f4e5a071d41fe61b81728782f3039fe241a544a64070c8da42c5f427e
SHA51235028e301c18441f8dd3682ce428de7cf37f023feb5c02bc548c788108fc740a07090bc165888c50e80096436b4c3f7f097bd7a933e293f504dfe989a62b92ab
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize448B
MD58bede028b6f1507da7ff4024076b9856
SHA170222ede04f4c1edb403dfdb77674913d96b50b8
SHA256227c6a6804df1e47302b049656d59c33e63f1a080d2a967f818601ebf22de20b
SHA512cd9c4b44f93a83720ec31c95a35c3372ca77776fcd988a7983de047953c8c64ace9e89ae33047b903d33e7cac51895719e99e86064cb893282b36b984378d69e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize624B
MD58cf70f489993eeaeb044e9a828dc7b17
SHA1e95e669549c0e33353dfe50a7897a89c9b676702
SHA256614f691252c471e9f4ed0041b477b90dc3db5d143d51f557d756f9f2ee749f07
SHA512dc889be9546e0266c442710f405ddeefb5d7cd0f0024911e51c933fb44547edf7a5d6f783a5862193f69d137891b82b49af354e09dbf37f3643d05573087cc02
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize400B
MD577d18d2e0010fea41cd4576354454d64
SHA18d0ad5a33df1986f3b7556ddbc78c085a777ea46
SHA2567c0a4c391fc844f8ef7edbe5887033efe794a665e1d0cc56acd7d6fcbcc5b113
SHA512d4e42f7058dccdac23cc44bf56583f0aaff98f051e4a1f194fa86a2d0c2b5bb39afca0dfb6db95a01d8fb778749608c3910e8c82413c4646e52940d692bd5953
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize560B
MD517af56073b6199adfaf219506f790279
SHA1d748489439bb7e909977557291015dfc2bd28c77
SHA2562a5d3e6351740e563db6e6c0fe3932f2dbf50b18611cdf958efe74e07a80cd49
SHA51298e68f077e09d294c1079cd818255a56b8523fb6e062230dcb3c0544819d82c2c34043333ff0fda49f9057d1d5528741997ed624b542be157124dad81d356798
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize400B
MD5c61734d1b49febaf5464f69285939c95
SHA1825a778107285d16606dfd51f8bd97f3cc1b93d3
SHA256b42b733a084088b1dd4ca03ce9fd250aebe18328dd30d0c5fd68e349b19bea63
SHA512a7adba6959f893c19eaef29e71dd75818d67ff90c43d0eb1efee9585a9cc9b311aa4c0b3f0506e0a490a52267b4ca0c78f4facfe767ede381e693f7700dad8ad
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize560B
MD5a7f674843829137e89389f9f0f8a1e5b
SHA1218c7056b118a6b5000d5d833527bb039cc3ae8a
SHA2563714f597e984f695966c9387f0bf8cf5444b9c880b018d241199427e28726db4
SHA512c486f1d7d066b4fd13fe185f7d5d7efee30746eb503a64228fdd2e0d0ea0a29138ae27ff5dc28e54a1eb2d70f7d7ffc8bd6dca60e3ba50cc25b4ed22d6ffa244
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize400B
MD53df020479464ca5ddc582581e4a37eac
SHA13190d645fca991c62d02e80aa9b5d8e42ebb72ff
SHA25653ed27637b2bced4f755e091f072f86578aa1c09ae78f47ccc4719502f52646b
SHA51236e468eee98612c846d37f4c7485c6ae9887bb00f0affab9934a528562044283fe86a3355ba02cc39880fe3170f2c2b85b1ac581d9de95dad6ef5f34912c2d7a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize560B
MD52c140dbd935477f1cd7596f54ccfe9e8
SHA1f461f46da113a94c3b47cf0dc65db624977334c5
SHA256d22d0967043f1b3560b31aed8049957debeb5ff29b4aa29e7c9f41ea7b6be54b
SHA5129208849a2a7803f0139041a68e99a015cfba46bb23f3fff973e6e08199365524ca7e93e8c8b43a33c4e7ac55767c72caa25504e37ab85f4466a88e2398502265
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize7KB
MD544710d472c7ce57e8c23acf18ffe02dd
SHA1b41f70baf1b35e6f0cc31cd1d4ce2cf4dc79a908
SHA256cd936548d1ec2ba022a4498cb89043dbca5a3dff86faa8a3b33b294b3121c38b
SHA512812d689408bd7886deebf7c8532f276b1337528b100f0bac041bc43b7d6a0ae9d544d42c9d6d8d497df51112a5cb549afbf32bd7cd3e74a1c97b2e2bdab315bf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize7KB
MD51cce4cfc45091b4bbc8efe202be8f56d
SHA1f5f8b84975d3e85a67504b1bf24915d91f523784
SHA25699cab3b442a7078c9f965a631f392fe28c61ee4ae2806af043541c06b97ec3f2
SHA512da431dc21cc8cbbfe8ba52f06df00ca775b4b66dbce79d3b09a03d72674e3ac2ed608db9d87609843faefbf899b8769bafa229d0fe895dd2cbd47c5a241b1b50
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize15KB
MD59a09ea37e5381a81f1bd066464d78d9e
SHA11c6a75e48f508dfc5b910dd855abd0af2bfdac59
SHA256debfacb907ab14a1aae71ac22315607bbf76dba93191039b901fa451b67c4ffb
SHA512dc7beb20eeb7c8d85031b9c28693428c24e4c7adaee22068db40cb453ea08e8fc78ed0c2be9ae3d4f507c504bca77dab6f1960020669e8772b26b9b6e9f70998
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize8KB
MD560fc87dbb23910b37a8b3d3796ac0489
SHA14bf10ffc825dceaa52194fedbb5bb99d3f301562
SHA2561bcee0d7581192ba0f8d987ecf06a1a4f5945b1efeaa7d8f08860cf76c43a1a2
SHA512e74816180724b3cc1e38595c4b00ed4593318bc96daffe9617303c548dca9f07ba7ad8277419374a582e4b3e9ae5c7e2137aaf637be663053846451b009b0c6e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize17KB
MD55cac4ad782f72f0cfe7110dfd93114f3
SHA1b4cfe3c374da4b62f3f87ac4eaa790b2f1c0d74a
SHA25691ebe47408adb0e9cea018cdaa86e167fc0d8810cc26777ef92a24bd8cdf22f0
SHA5122e47b4fa214c92c4cbcac6d99f5b9c0fad9710048bbf9507a6adb788c2cd742a864ba2241dcebf0a40ffdb64a8b515fc027f9bccbf78571260e809509e242ef2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize192B
MD5428623dc7ec2dcb83b1caf5e082bffbc
SHA16b329155900474980f49f3b045d95900b9ff76fd
SHA2567f2085170c0581e0e7cf8cd0502d9dd5732ea09d9543a846df19fec5134826c0
SHA5124a2ee83743e628bba88246e0b915b172a265a6794a643a39c6c26ee1d19ce2831299df869a1854592766b36359c3e7307eec40b91cec90396debfe49a32d5133
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize704B
MD5bbfcc2d6165460364cd2e361e366149b
SHA1e2f63171203fb340992beafa85bda3b64688aa40
SHA256ecacecddb31f6df13561bc139c2cd4a771bf4e4672b19ab97984af47cfbaa3fc
SHA5120985869daa0154283cf23d91ff67f4a623b4633a35e5e7670bd3f3c48929cc857d321780bec9ff6ed9f38e061746a1e2c7d261263bf97cf466cb6452506183f2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize8KB
MD50c667069fb6aa553fcdf40a048157a93
SHA1b8e06ed863ed66db8432469b7b018ac8f381c24b
SHA2564b7a8e4f30f2f726dfc5f295156e2abf95a983d492a38b58f717eab8f405eb24
SHA512584a2eea4683b8c58283a46f7d5e0f65143957fb9c850646945c9ee779a5d970a9e3264e9acc2aaaaeb52d14983d7d8743ed61b370493d1b71e926a8201e4cb4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize19KB
MD527bf5b200c36e6e3be78295a49684283
SHA10ba55d99a86ac1b2fcdb72d92cba225f7867c0d5
SHA256cc1479e05444839842cd807aabe7d97aa815be8e8443e6ba503b32474943b20a
SHA5121c3afc321340a813f1d7f8292e34c188ba1ebfc19f80ca18066939b586f16a6230bbc718895839b8668f46359ceedc3cd8d2bc50f0cbfa3d6a0905c23e0c04e1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize832B
MD5607245f1e4dad98ab8b007c68bcad660
SHA154369186082a7b63919fef48287e28ddba70a5cc
SHA256a7eea114d908ac437e318457c8cd6372596ee84eeb6de93481c5d8f032f6bc1d
SHA51246bc8d2b405a4fc20e1ced66007706a4c1fac5bf4eab067b8d85572ba43d8bbae4d2576af6e5ca5239e3334f6bbd6bfdffa6912db3b672b181b0b96bbccee72d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize1KB
MD5bb0e085bd30fa114a1e468310ada5d7f
SHA1e4fa72d10f7bb236ba84cd8745a7c6cc61ae91f3
SHA256828c3cf06cc0be049a4025423a6fe473b21f21b2a7bec6627f899f787051bd0d
SHA512d98085edbf723097e1aae685c5fbc31ac83df37eea8bfb190881a3889918fff78f52214ee66a4566f66a6f97b8aaad1acbd1b69bb9bf4576b7ced115ff9cdc05
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize1KB
MD5d6e35a786506425449ed458e018ef4b5
SHA182a12cb4cbc9f5977c3fb99a10e7201c6995af70
SHA256392a62c24f192fac6fa458475ed4469cb345fed5072b5ec8b6437ab13c25de83
SHA5127aac962b79a7c6879a13b928e57d41434e21fcc3589ba66a75b98f8bc87a484933368301265804aa16c1e0b1e443c0dd4979a822b4893afdbccdd46ef15a387d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize816B
MD5017940261bd28a542e0eb93a585a13bd
SHA155b8b687e2599a2f391f53cde1cb19a46d4835a0
SHA25641203d14806e659c34e4514065f9893e72a334c770d6ddef2c50119b8ac7880b
SHA512143ffc0c13445c6b40cf92c123ed4d4efd5dc55cbf2573924db6a83d3823de3a7de267b4461b1e6d75463d310748007be15702186662689db27a3e87974fc890
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize2KB
MD5e5e9df9879a0c31de49bb4204ba8f3ed
SHA1f12d90f043d6b308cbeeed73550d78a9f3337db2
SHA256dfec12667b11934131196cb60146f8a33c7a67b042fd1e5d5fcf7d56fe6b1648
SHA512d45eb6c342f08e5d66325bc2027b612776904b358e59640b7be27c23569318dfef0da3c91ab4fa27637f9cf667a8d45f2f893a95ffa3cf762f50d87dcd45ea20
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize2KB
MD56cc7efb054cb4f6bafb97755336fbf16
SHA169cd3d3695cf02ea0c36ac666b7318fe200c601d
SHA256feee4b2ae6e3515737924e09674709edd0b5225062531dcb5099367ef61ff956
SHA512d8c8adc28a2d1171a69094a364b79d05a3771d251594b005a9175c07b3f2285e6aca9a8b0654a5efc76901567234bcead3242309e688338df98a73d93108bdfe
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize4KB
MD51cc594a6d79a31784e795e269c5f8cb1
SHA132700769ef654794e2f1264c3ee8611b413b79a5
SHA256b43e945c985723c16268bb3bba9611fefc64e65daa24b6b0d8f5dc1a432ecb2f
SHA51279d370f8d48f22077b7e5c6dec0606664e688aee85add98ebb3b5d5b51ed6bca681de89ba5d5dea5d16f2ec3b728c50eab29997282291f5b94dce3c94e7856f0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize304B
MD5e14c5f12efe775654afe80fef29047dd
SHA1936bd9445299d4b2aaca435e9483c0f1aae104be
SHA256fd6896b743d609bc7d02bd3a24ade512ad21e0fefd743e01e80ac0585fd247e7
SHA512d1162a1aada84f3a7a0c5a260d707395a15d731e1cca24f1d73d870d03b4c9ad02661f1fd73a7962a2995b5eac8d8d9c0b119b15fbe8c7fba457102634d27350
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize400B
MD593d80fda864e694f114a35690100d3bc
SHA127512262b75230e15bf3dc5e0099d3035737cc4b
SHA256f4ae10e4ad24a12f29e27bc58aaf0080bda1619ccaeb476565e80968c2f47cf0
SHA5124449d0d7df0ffd7c6166e2d978967c9133e0f8d2e37ee1c0586114f83cd0100f53d1bc24b7dc23745cd5e3672d526b6286e96ffb4d378897bfe4abbf7da375eb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize1008B
MD5b1085131465fc550cb1fffeb7832b69f
SHA1d03c982b818cf6a58f3eb4f74e280d197d37941e
SHA256e975d982a80656862019d83d041d1b71cdd42ad5a24bfd5c310cf2b28b24a397
SHA51278fb193b9b48fbfe6b5b0006cb98f602c85caccaed15900829a1ee00b4c4910c5b97c75b3b4506afbd3d121746de8d558aa1100b645b3563f71de8d70e1beeee
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize1KB
MD56dabef43b210c7ca65d37d2905b247e4
SHA10e01ae98e2f95fc9dc4b0141865683a861733662
SHA2566cb46781e90fffa966877d0d93b71915f937194f76c8d61f926c0764e08f4c61
SHA512080872a53ce9a311282ec9119a55a1ef505e5dcfd3ccd3810d4afde9886a9aee4e9cedfb80cd31fb13afc5fb562a20d5b944d6d8f1f3fe2fd8a8d4062bfeb01d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize2KB
MD503c8cbbd585c8e37b637589e817bf74e
SHA13c26571fb005e8c99e8b4523514170677163271f
SHA2561176ca5375a2926c383e62daa7e24309d18b413a8503a077b7d4cefd359c92ec
SHA51250eb5118a5639429b8631191c72f6d94ec4c4e4e5f9f6bcc2473950f335aa8f8ef03f077b65969bc9960d4a9c9464d3893fb94d53a455bb57628d7254f6f9beb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize848B
MD5bc70da262fa2ff216b69f346fc848fd3
SHA1cae6e5a157108bc87d03c6c0d16912b52b64830f
SHA256f7bfc865b2560e43404411b9d0c4da0d113947004fa815109c8aa4ef87ecc23e
SHA5128af0cbed3647c8b78be6be7df8b32e6199ead6474ae094b74a82dcbb046241a4d9822121e25a8ee9d5a872b9ed28eb032669c59cc03740dc469cdafe66c54303
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.421D5330D13E302BFEA42E4B8F0C1235B75599C7262C31AC42AAB1CFC7F31044
Filesize32KB
MD54a7df577d074d190a8f0663d6e173ce6
SHA12d4c03b36a25007fa7e6d168c6132f149d0f5f18
SHA2566b59d035f2d1bb67b4eee37c63729474ae8ef68f5af1232b390ec78c3df1ea7f
SHA51215149a8e55786de0e0724af5f460101be4a56c9aec30ead558f1fe5fc0f009dcec10b01df08de49348c07e6fe2d2b83d9985a17b7bb60522fa87e97d0e4a1235
-
Filesize
43KB
MD5c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
Filesize
1.4MB
MD563210f8f1dde6c40a7f3643ccf0ff313
SHA157edd72391d710d71bead504d44389d0462ccec9
SHA2562aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
SHA51287a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
-
Filesize
2KB
MD50a30a2d41c814ded224d49724367f20a
SHA18d520dd62cf485d2db695bdf85c2d2da090ab741
SHA25681c7b8aa4d8b705f9ce837266dca6c0d2e02220b7c9f0d173789becc3e1808ca
SHA5123bfcdd242dc74648eca46bc910eb5fd1e4dfddb92b65eb2a245f25d6024d9fe1460cf0e092a39ac80529d8ba36a1fb460b0a3c6d9fde7e9198c872e7d3b46044
-
Filesize
1018B
MD5f071f8c80baea36eeb409cac5b7d8334
SHA13933c94c7668456a7011a04df5dbe96f3d68a1a9
SHA25633e14632e4267d2346812482a164eb13350a95f7ae47cbaec5b9b30291c5aa7e
SHA5122e0b88811d4b23c27e13a0595ac93462aed651cfc3fef924a7e69734782a91bdfc42a9c9cb3b04ef973730c28bca24870bacf46ad9339c1499c4cc84f6bb2399
-
Filesize
1KB
MD5cc689ed0a10e6d2b005cdafb6bbb601b
SHA1f911026ea8307b6d28301acab6a6c6b6b46773ea
SHA256d142b152126d96e7958a9bbde104745dd5d96f95bfef8d8de2d7f83ba29184c3
SHA5124d6a5a922ca49f4b9890135783eed9a3cb0fc5020f27aee3ded48f9c0288d1b3a6ad9aea3c75a965a675104d930120c11c43f536debd85dc42b513222c7046b3
-
Filesize
1KB
MD5225deecd49e07fe84fd8932a2b601991
SHA1458e76a3ffbb5468bd18cdb78b528fc4790bb512
SHA256c4370ac7f192bb0fb0d67b7072822d77ca95dcb96baca3130dce67b3f63cea69
SHA5120ffddf530e8c8126292ff812a1031cd636f281c849a280e88c18dd44abe4c7116fa01a7ea03b3a4d687a740350b2c85672d0409b8290eb98a40723c76151689f
-
Filesize
1KB
MD564f02f5fa464b75927bbbebd8fb77ba2
SHA1002f1ddb1c5e2c893ea3cc817d9a3e58b92f5e6a
SHA256173d329b5b27659f63ded1f0ce92fd3f2465b13ab6c742087a96a00a735c6222
SHA512dfde259f8b32fca8703ad50ac40cef209bb311ac1b23473ad63a9e46562bef4144021498976f38009b46cc7250ecb23c65d185acce33738326fb23b641abda74
-
Filesize
1KB
MD5c7fbeb43e964e4c21146a96cf51726f8
SHA153df958a1006eb55d7b38f84ffa3c1b25f9aa556
SHA256060a1ad4b69e571a258fe5f4f1a02d199550ec1eb0c8c9e3ec0ecf584a7872ab
SHA51278ec5e1e32318a7c1585d098c0b41dc2833b1ce39b2609a2296e943b1f3b2ea115520f68bb6d257c72704df8743d3c72d1d56a85add0a651e0aa6991035c58fa
-
Filesize
1KB
MD5b9ec5beb9929f3a9ae07bf8ba61e4998
SHA12b223be0917d2d8e05246af22a2a6f3771a8ecd7
SHA256e91bb113be5ca5a60ae14f997aecaed4b5975eb7056786d2ecae94fcc3e7ae1c
SHA51234c7c85668a71aa15d9f0bc3169e111e9ea66c4047e64a3f04002461553dbad8ab42396a621b325df5ecaeb95fc29c8a6de88ab2930d4f67242b1fddb31f7b30
-
Filesize
1KB
MD5255b77f9bc9fc8b090908ca301142702
SHA113c233f0212c6cd485313278e8849f5c0933193a
SHA256003bd7ae66df9d26e6f0efb4da1b3531508e2fa38abab5453f9022b042643e3f
SHA5128f74d0b9d2b66483e88448e2346b6ac48bead243e7e5a0b3f35265752109e4d37e73f259974c1274fa72bc3c47d4374d369a6451ad7d94466d42250bad9d4862
-
Filesize
1KB
MD533724e51a306b4ee807e53145ca9d003
SHA12f76d85ac69739b67e3cc58d5879a9a406afaebf
SHA2563d28ede5ae0cefd0351444c06d82dc55cf1b03252adcf14d937c76d6db8b5658
SHA512afae9bc94cc0b237f562a0873fe67e4279012ddd1c62cf681343af15d79ec8b309c04169e52319c19632ad4ff6a7b7142bbf567582e42b89eff51196da12bd98
-
Filesize
1KB
MD543cebe306c14c012385fa6b088069992
SHA1c4dc95e0b4c546a11fd68deb5273d07a1babfdfb
SHA25663eebd81febd8b160d1dd0e9db284656269d3db166934ef14001c259a905b625
SHA512d7e9d86aa58370ff78e2d87248eba6303be10f6b2ffb319c492a76c05ba66e4d167df94e17d4d84140d75dfdef0b7c9dd79a45a4d66bcf5c971fa49f7a868da7
-
Filesize
1KB
MD5d02eeaadfadf4ea377f280aa00682be7
SHA1e14210293562425c87e78e7095f4ef930f835a1b
SHA256062f72b51066e6d01cfcf2f94737a59b4c321353ea1846705a42ca4791053e14
SHA51221c518d1ab6771ab99f9ebeb7277ee12f73b11ee13008cbcdc919b4dcce38bfe5918e532c00a0cf450ef35c3d5ae48324da756e5f98061287d2067224dc99162
-
Filesize
1KB
MD5dbca337324747681c469efc788cddb13
SHA1f78f2b9b8306a330d87bafd9c65e6614ce7ca40e
SHA256d304fafa964090f53af231400d7928870a4461c769bcbd2e0ee5bbe2f29747a6
SHA5126f497077300d683c7155b7636bb6a55f9c259b3d67a6d38e69678b7714e08d63041803ac2eb3699b7775063c9616d21cd675331a68b749468eecaa9fde7e1ba9
-
Filesize
1KB
MD505498aa595fc19178f33b4eadacfac60
SHA1a218f72b78ae2d507b2e9a5ce4e3457f23c0fe15
SHA2562ed25b51c9e2bc84d25a3b34a026c27dfa1e5280524ef36589324adf688a3a0f
SHA51249c0a5b0133dc87ae1b2cb9d8bc7590d6a0bd8939a35d6306164e5bfe01a602c45fb965fad4f39a74c3e3fb3aba822b882370e414b0a19ce3a764311bc83e547
-
Filesize
1KB
MD560a865a9c74370caf184283833a827c0
SHA1a695b5c23cd5647443d63262f88963f92a562250
SHA2569775d234abcae41f515867f0b01c09ab4c7fea006bd3e130477eaac4cd4ac52e
SHA512a3ef218b59d184b0df44baec9042a9cbf430c6d86d7f784290831705ca6f44a1f27d84e14fbbcd463456edbb2feef212a43d7f415ba64fb3b46a966cfb6f88cf
-
Filesize
6KB
MD5e349991a226f4724e2027cf2c64adadd
SHA1b8b6ace31227f256e435ff6de6da74f273dac616
SHA256cddd806163804472b47fbd57ca03918a0c58661efe40cb525d0dbbcb2cedd09a
SHA512b2ee54974f8b45b90e5bb83566aa8b463378fedcfbaa559e639a4b9709d76e1e1d01fb1955b36517e50c0e41d08cd976849616de8c404992bf1acd2b2a5e0705
-
Filesize
6KB
MD5fd6bb6ec751587ccd1e587acc30526bb
SHA1aff704ea025bd71d07df75f35347ffa32ec3a626
SHA256e86de36ba61014b3a858e3c2b7fd8c3998189f1d7bec870b91e272d8cec90083
SHA5124036bee458757b312c7f992ccf1efb16d31b43fe9affe1436b74b074690ce707d6914ec34912849934339f0e2907a5bdd51198740409a0e1004c27b94ec5bc90
-
Filesize
6KB
MD5389f8913807dd8b75e06d19683205fa8
SHA195a3cab7320ce35564e56a422a5e536865ac0fa9
SHA256f284e09492e74a71665aa5ac188e79ed3d114bcdc60af61e0ad3a4465fc504ca
SHA512907b3c410d64b65fc792c7143430b95a79781c3fdf5c9b3ab94c36384243f49e084fc110ff9c5511a5536135c2e96b9e3de58d09ce57b5bc35ba6c57cb1934cb
-
Filesize
6KB
MD5360a70ea8e4710b0d454ac0b61b9db63
SHA129f824cef89288c1a71d42c61935008d3de7ed9a
SHA2568501cf8b25c6a9ded7bfa2b70ebee0fa32658422c643a0fdca11e9635baea22f
SHA512b5a3c978296e0ae6ed34e84bcf88238bc649c643284f96ff424a2367d28ef34dffe372ac3477bc7ccb20ddee8670227fe6926cdde58c7195af356d17a3e4cccd
-
Filesize
6KB
MD579b0b85682dcebca4e9729bd9e114dc4
SHA1b0e9c0fd7cc56a91a0ffee21a52e26e11175a952
SHA25662f9695344603eead1087f6f885b368d41bdb08e709c7abbe53972717ebdebfe
SHA512e2491c68d0f49ea8be2c4fdd6dae41148c739e780e7e8baec9edbdf73a1e4d16efa8101510d7136574cf7cee20afe1bbe3ba8174edd625a83d3cc15b6c2ae62a
-
Filesize
6KB
MD59f585b8e168cfe78c419024724931d72
SHA14cac30ac001837e2932686c74c4474d89578e9c6
SHA2566db6c41f0126740a948115c13d1afefcf325f4124c8710916f28b4c174badd0d
SHA5122db3ba3d20710ee5fea072a0f40f9d7ec3507ff9c2243d4f6e38bbb793d419cb9d2418bce94773d3e10cefa6d2949e149eb0e063aa0c4ad4a4e07dc7b83ff678
-
Filesize
6KB
MD5e8133df0a9d20f31d1401162928e9014
SHA16e1ebec0abf86d4325534404e21b287d735cb224
SHA256c980b2f9d43bd98d5d6cb322e82dcc6248be0a5132dcb829948ddb36c4916e10
SHA51291279b5430e6461fa17dcc45f60ccb4fc4434469102177635082fd4ea484c62f6ac8c5b11b202a0a446fe960af251e105d49653b5ec29e794877d9375ad5a2cb
-
Filesize
6KB
MD5776482fc6c0ab2ca170eb281b90624d6
SHA123c09e958b28f228a293a0a5bb283d254b4d63ff
SHA25664f2d423b13d3fb12368ee303f9b762bf59eaf3a3a6b17243c9c1033b1ff07d9
SHA512d997744bbf7eb0f46aa468adaa3fb554ce2fee64150b64e81f170477813c9c8d910861cdeff52d87fda4f2b81a9acfa4982f5360acf69bdc893808cdfdb0a329
-
Filesize
136KB
MD558024149fc0812be8c6b78b83cf951c5
SHA17dd3fa7d5e2dde6dfa08912d86211ab62f89f94d
SHA256e43a9bc0be02d4a9e271ecb39b7ccc515c6e28f34ba97cd856e2c7287d854e7d
SHA5127fe15e2d348297d401eb243dac0afc8d865b7d2316ef0a1c1c5342d36dd06ea63678d2df8c58f8e00a7fe4e225dd160bd104e4c759297f7d91d5aff97c48d8a5
-
Filesize
109KB
MD597d53a221de28a1a57835413d2b9de91
SHA1d5b296126c53ecc8dbc0a43688fecfaeb99ce336
SHA2565e38535e1b02245982b81c6d7d10d6dd9bacf8d97605b03534d011c4ee3a9ab3
SHA512a02c7e1a75777803fac04553e360307daf7558e6a13172cedfa022b8bf2dd50aee0557d7b001fe306ca34a0bdbf9acd7ea88940ae0caa826ac5af2685b8b8e1e
-
Filesize
98KB
MD5ca48636db15a8c9619f768519b123551
SHA18b4deb84faf10585381a87a978fd7f706163afd5
SHA2567fd3a59010247c0f1eaee779d8ab2deb8958a7231bccdd041f45d0c5e7716e32
SHA512b200ca0a2cabe1101d172409fbf769089a54298123f76d4d3176b01e5f4cea5b0d08d81170058d381262cdec84987aa71cc0e683650509ac6202943fefdd367c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\C7OAFFS1\support.microsoft[1].xml
Filesize13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4RJHRD2W\favicon[1].ico
Filesize14KB
MD5572bca271094d6c9b04351541a1181b7
SHA1492ca901e4541c05d5cbc28900e637be0845e929
SHA25610c8a1bc3df4c706a4a58560fe08d94032ed275e640db4dda43d892986da9ff3
SHA512a3fe8691e54edaf367b0111cd5a2caa1d50f7be76159805097b5a4a62617fcf21ff7bb93679fe9a4ef2b376052754e189dfc789067878d5d834bcc437f083858
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF7C0D954B30EA4E6A.TMP
Filesize16KB
MD5893c9761f751dfafccb5d0b9692f1c41
SHA1e318a678e88f755f30f86a0a8f63d816aaacd997
SHA2564b232372554a04918428850d1df2f34acbaa965687cf2d1f51013fd427135ddd
SHA512b4771a5fd789b8e59c587c6d0e7cc4ef80124c5987bce311eb6c4a17c6a5a3b85d76ec9a8da20a6379f29eb50ca2c0138b197872f562b0a4a8de1fdc8d8f2eb9
-
Filesize
84B
MD5d4c1894cb5c128306c4d4031d5e82750
SHA1644da1a0f41e9e88572ee2aefc36cc30adb13a47
SHA2569d2f2b20405646193e6cb12ee13684f6a130c02360ad160a5f69ecfd31fec4aa
SHA512e87ac6f1b4eaf9b5a1a3cde1e51514db508abf388197cdeb067bf65bfbef8b3079ed29c07493ec5264f04c1ff02c819658df6ed485cd9e063f33655182e60ffe
-
Filesize
84B
MD5e5ff651f18df1f7ba5ccb1bab6dfc34a
SHA101d9d36285822d6948d97f52610a1bf2a17639cc
SHA2560d4ac92a375db7e9453e03e9cb7bb8e6831faaaf7adedb787ac0448cfa366721
SHA512001102308d24b86a7d70c82406ca2fcd949601cb35df533a46f756e1fab8c60f9bfb721048fc9ff93b2f5d909b26cd9f3534d59934d0330322d48af86e743d1c
-
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{7D62DA27-A1DB-4A43-AC50-E380B2402C5B}.session
Filesize1KB
MD5a3d4e1a75b83561bd0a241d24636e3f8
SHA1450252f2ecca6fd1712694403b5053b51d628081
SHA2568c72a7b4e46d81afa51d081e8832c766cbeb46329bc453600d3f2e325f281e8b
SHA512fc67186c0ecbc993126e10e8fa9ca3402a2d68f13df501cb0c9106ad8531033d27b4132a1b3146dabeab8c32ae120e312db69429a3f3a83e85b00d73d03dfeae
-
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{7D62DA27-A1DB-4A43-AC50-E380B2402C5B}.session
Filesize1KB
MD5c6919255368f424320b3b30f9e76c31c
SHA179dec9e1f3b2aa35a68bb26b09ef1bd218590ff0
SHA256fac6e7ebd5d936d3436875d690867e4f0a743666af4f11de981b4066a54e2f54
SHA5124b099b97bb03354c6c27a63f3efc843800c602c59f2599e48f4579f238eb2ed716d91409b28421b7681f4cdb3cbc295375b6a128d65b044ddc47880cb4b4fdda
-
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{7D62DA27-A1DB-4A43-AC50-E380B2402C5B}.session
Filesize1KB
MD5419372525ba2f2de21f0cd76059a6471
SHA1644af4d522956868dd45fc6f99b493a16d4715c8
SHA256e224f492e8e83f6905f0d2dade0635698f35bc47e7fb26637b8f91d5119402da
SHA512c5cabe00332160ea334205a53f5a962b06a671b79b8884134ecd609a5e6c5924ee932078fd3a2236e22d35b3bcff81e6be46a5f7e05dfe6e70dcea618272aafe
-
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{7D62DA27-A1DB-4A43-AC50-E380B2402C5B}.session
Filesize4KB
MD538263b37555df9b2f9ebb74736a39334
SHA1aad12e953dcb4d89d17ec6fc4eca5b1b2f4cb0f8
SHA256acafbe7761ed8d4888272ec6e232d2bef5839ec235cdb51643d98d301123c60d
SHA512e0765f2873084c3d40bd80940800df9c53021373e7ea2d1ab731b75c9f609115f2f2475491b561b2969082ecab4bcd83cd34e75ba787df8971085744740df490
-
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi
Filesize1010KB
MD527bc9540828c59e1ca1997cf04f6c467
SHA1bfa6d1ce9d4df8beba2bedf59f86a698de0215f3
SHA25605c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a
SHA512a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848
-
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav
Filesize724KB
MD5bab1293f4cf987216af8051acddaf97f
SHA100abe5cfb050b4276c3dd2426e883cd9e1cde683
SHA256bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344
SHA5123b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49
-
Filesize
24KB
MD5e579c5b3c386262e3dd4150eb2b13898
SHA15ab7b37956511ea618bf8552abc88f8e652827d3
SHA256e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2
SHA5129cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb
-
Filesize
33KB
MD55569bfe4f06724dd750c2a4690b79ba0
SHA105414c7d5dacf43370ab451d28d4ac27bdcabf22
SHA256cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527
SHA512775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165
-
Filesize
2.5MB
MD5c5afbb8da79525ba74aa0fdc5bb5d17a
SHA119a7bb8f31f40592c350555eb450924193aa5aef
SHA2565f3c2e1ad778441373cbfdc5d07884376175a9409e260e60edd292a95f9bc4ca
SHA51236cd962ae3c4c0bec993a1c379130ffbd5ef475e234e4ccfebd51f4e52ff6861bc3c1ee6ab20df4e8a1b04f4ba7f2f9437c9bcfbad9573cffc74a4680ddec589
-
Filesize
916KB
MD5f315e49d46914e3989a160bbcfc5de85
SHA199654bfeaad090d95deef3a2e9d5d021d2dc5f63
SHA2565cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7
SHA512224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e
-
Filesize
789KB
MD5cad618323b07c0f4f6273ae08df1779e
SHA1e67715f81f83ce7cda32f12a116cc950b6fd0dac
SHA256854113f2737ee276ba34fac399e8a615e4de4c712dd7a761ab0e198fa09d87fc
SHA512efd9403706accfe996b5df58300b5e0a0b461727bdf7c5492e9914369fef09ae06cdc2d00d30ac6d494fc68dadcf423d800741f7c22d5c1d565ef3fc675c4565
-
Filesize
1.0MB
MD57958e5251e5e6f9c3b7752ff1543e28a
SHA186f6a8439ce6a6b30e6347c5bde7e091e5fad0ac
SHA256b31c3f9d08337314050552a7dfdceaf42bb6d22baee287cde6238a6d965d87cd
SHA512aec50b136792aebbd5aa8e5d316c39b728ff28e411dd54db99a18d5c7b9447f25629c4220800ee8dd8cd2b24a98a11d46f32b45a62bda5135c2ff0a731e032ee
-
Filesize
1.6MB
MD5713f3673049a096ea23787a9bcb63329
SHA1b6dad889f46dc19ae8a444b93b0a14248404c11d
SHA256a62c54fefde2762426208c6e6c7f01ef2066fc837f94f5f36d11a36b3ecddd5f
SHA512810bdf865a25bde85096e95c697ba7c1b79130b5e589c84ab93b21055b7341b5446d4e15905f7aa4cc242127d9ed1cf6f078b43fe452ad2e40695e5ab2bf8a18
-
Filesize
88KB
MD54083cb0f45a747d8e8ab0d3e060616f2
SHA1dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
SHA256252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
SHA51226f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
-
Filesize
180KB
MD5d552dd4108b5665d306b4a8bd6083dde
SHA1dae55ccba7adb6690b27fa9623eeeed7a57f8da1
SHA256a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
SHA512e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
-
Filesize
96KB
MD53cab78d0dc84883be2335788d387601e
SHA114745df9595f190008c7e5c190660361f998d824
SHA256604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
SHA512df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
-
Filesize
128KB
MD57e6b88f7bb59ec4573711255f60656b5
SHA15e7a159825a2d2cb263a161e247e9db93454d4f6
SHA25659ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
SHA512294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
-
Filesize
312KB
MD5aa82345a8f360804ea1d8d935f0377aa
SHA1c09cf3b1666d9192fa524c801bb2e3542c0840e2
SHA2569c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
SHA512c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
-
Filesize
860KB
MD5b3dce5c3f95a18fd076fad0f73bb9e39
SHA1e80cc285a77302ee221f47e4e94823d4b2eba368
SHA256df2e3b2222dcdbb5e0dbdd1200ec8fd5f67fcbea99e0023df54307eab60030ff
SHA512c184436055cf74884ad0d2bd5ca00bcd5a62d6be46253fe8c71b4daaa5c710b9df34af1b6e41f6d1af94bcdec0d33679a6a1b34bf9755678b4e177f368c11d4c
-
Filesize
26.0MB
MD5bd5e2a887df8108ee29f4bdb0117b2c8
SHA1be855bf3c8b580dc1399efff22316599fc3ce075
SHA256938ee79a11100217ac366bf7989b82f284de2b075f9dbeecf4b98a6c9000a382
SHA5120370d5be2e7f701967959b8081c34bb0d2967c31a45c9326a5d0a01e1586baefa2d4e7c12c0de40e701fdf2dd6ecdb5f01f4d8712becf86704422e1cd0f86d77
-
\??\Volume{38fc2686-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d0f95da-c534-48e2-9a15-96dde5da1a4f}_OnDiskSnapshotProp
Filesize5KB
MD5a8f6b6e8ed52dfc2b7db0594bd4a7a81
SHA13cdeb9d61d7d861003703089a7856d52ac1ed772
SHA256742da4162ae8da74921a34fc615414f74d6d41a58c3e37033f5d25164930ecb9
SHA512f3b8b8a7ea42a0e9ff5696b919dc3514026570ba4bd17eab9d2d5dfa72458a1038958f8967ea7815825e1f14a75282e00a9020db1a3a60a684c0b06fb63f5223
-
Filesize
126KB
MD53531cf7755b16d38d5e9e3c43280e7d2
SHA119981b17ae35b6e9a0007551e69d3e50aa1afffe
SHA25676133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
SHA5127b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd