Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
0029d4cef8c491684ffcc733edf41560N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0029d4cef8c491684ffcc733edf41560N.exe
Resource
win10v2004-20240802-en
General
-
Target
0029d4cef8c491684ffcc733edf41560N.exe
-
Size
90KB
-
MD5
0029d4cef8c491684ffcc733edf41560
-
SHA1
71e9340b66c324a128f1b32df20a67766f5da299
-
SHA256
4f42d57faf56efc851bdf84f4c50786b431be91d7ba8422ab67807e0a66737f0
-
SHA512
15f8217a955e872e2b9e7503ab5853b2c406903488048142ff275bd390022f1e6cf5fb6f83a4c53b5f98a9ecb00a499bc8ab01640befa1fc51b2ebf6d6de6fec
-
SSDEEP
1536:wQWLl4DvFqc0kBTC92u3P4de9HjZA625DmgfKRvfDhdP:+JoQc0mu/3PTH1AbDmgfKDh1
Malware Config
Signatures
-
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iedw.ico cmd.exe File created C:\Program Files\winrar\QQ.exe cmd.exe File opened for modification C:\Program Files\winrar\QQ.exe cmd.exe File created C:\Program Files\Internet Explorer\iedw.ico cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0029d4cef8c491684ffcc733edf41560N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\ = "╠╘▒ª-╣║╬∩(&H)" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\HideFolderVerbs reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\LocalizedString = "╠╘▒ª-╣║╬∩" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H) reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ThreadingModel = "Apartment" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iedw.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\WantsParsDisplayName reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InfoTip = "╠╘▒ª╣║╬∩╠╪╝█╙┼╗▌╟°" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\MUIVerb = "┐¬╩╝╣║╬∩" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://taobao.taohee.com/?1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\Attributes = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\HideOnDesktopPerUser reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\ reg.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3560 3048 0029d4cef8c491684ffcc733edf41560N.exe 83 PID 3048 wrote to memory of 3560 3048 0029d4cef8c491684ffcc733edf41560N.exe 83 PID 3048 wrote to memory of 3560 3048 0029d4cef8c491684ffcc733edf41560N.exe 83 PID 3560 wrote to memory of 1672 3560 cmd.exe 85 PID 3560 wrote to memory of 1672 3560 cmd.exe 85 PID 3560 wrote to memory of 1672 3560 cmd.exe 85 PID 3560 wrote to memory of 1320 3560 cmd.exe 87 PID 3560 wrote to memory of 1320 3560 cmd.exe 87 PID 3560 wrote to memory of 1320 3560 cmd.exe 87 PID 3560 wrote to memory of 3360 3560 cmd.exe 88 PID 3560 wrote to memory of 3360 3560 cmd.exe 88 PID 3560 wrote to memory of 3360 3560 cmd.exe 88 PID 3560 wrote to memory of 3628 3560 cmd.exe 89 PID 3560 wrote to memory of 3628 3560 cmd.exe 89 PID 3560 wrote to memory of 3628 3560 cmd.exe 89 PID 3560 wrote to memory of 3320 3560 cmd.exe 90 PID 3560 wrote to memory of 3320 3560 cmd.exe 90 PID 3560 wrote to memory of 3320 3560 cmd.exe 90 PID 3560 wrote to memory of 2952 3560 cmd.exe 91 PID 3560 wrote to memory of 2952 3560 cmd.exe 91 PID 3560 wrote to memory of 2952 3560 cmd.exe 91 PID 3560 wrote to memory of 3732 3560 cmd.exe 92 PID 3560 wrote to memory of 3732 3560 cmd.exe 92 PID 3560 wrote to memory of 3732 3560 cmd.exe 92 PID 3560 wrote to memory of 1868 3560 cmd.exe 93 PID 3560 wrote to memory of 1868 3560 cmd.exe 93 PID 3560 wrote to memory of 1868 3560 cmd.exe 93 PID 3560 wrote to memory of 2896 3560 cmd.exe 94 PID 3560 wrote to memory of 2896 3560 cmd.exe 94 PID 3560 wrote to memory of 2896 3560 cmd.exe 94 PID 3560 wrote to memory of 4692 3560 cmd.exe 95 PID 3560 wrote to memory of 4692 3560 cmd.exe 95 PID 3560 wrote to memory of 4692 3560 cmd.exe 95 PID 3560 wrote to memory of 2916 3560 cmd.exe 96 PID 3560 wrote to memory of 2916 3560 cmd.exe 96 PID 3560 wrote to memory of 2916 3560 cmd.exe 96 PID 3560 wrote to memory of 2968 3560 cmd.exe 97 PID 3560 wrote to memory of 2968 3560 cmd.exe 97 PID 3560 wrote to memory of 2968 3560 cmd.exe 97 PID 3560 wrote to memory of 1356 3560 cmd.exe 98 PID 3560 wrote to memory of 1356 3560 cmd.exe 98 PID 3560 wrote to memory of 1356 3560 cmd.exe 98 PID 3560 wrote to memory of 3128 3560 cmd.exe 100 PID 3560 wrote to memory of 3128 3560 cmd.exe 100 PID 3560 wrote to memory of 3128 3560 cmd.exe 100 PID 3560 wrote to memory of 1240 3560 cmd.exe 101 PID 3560 wrote to memory of 1240 3560 cmd.exe 101 PID 3560 wrote to memory of 1240 3560 cmd.exe 101 PID 3560 wrote to memory of 1836 3560 cmd.exe 102 PID 3560 wrote to memory of 1836 3560 cmd.exe 102 PID 3560 wrote to memory of 1836 3560 cmd.exe 102 PID 3560 wrote to memory of 1632 3560 cmd.exe 103 PID 3560 wrote to memory of 1632 3560 cmd.exe 103 PID 3560 wrote to memory of 1632 3560 cmd.exe 103 PID 3560 wrote to memory of 1236 3560 cmd.exe 104 PID 3560 wrote to memory of 1236 3560 cmd.exe 104 PID 3560 wrote to memory of 1236 3560 cmd.exe 104 PID 3560 wrote to memory of 1692 3560 cmd.exe 105 PID 3560 wrote to memory of 1692 3560 cmd.exe 105 PID 3560 wrote to memory of 1692 3560 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0029d4cef8c491684ffcc733edf41560N.exe"C:\Users\Admin\AppData\Local\Temp\0029d4cef8c491684ffcc733edf41560N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\~9AF8.bat "C:\Users\Admin\AppData\Local\Temp\0029d4cef8c491684ffcc733edf41560N.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1672
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}" /v "InfoTip" /t REG_SZ /d "╠╘▒ª╣║╬∩╠╪╝█╙┼╗▌╟°" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1320
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}" /v "LocalizedString" /t REG_SZ /d "╠╘▒ª-╣║╬∩" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3360
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3628
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "C:\Program Files\Internet Explorer\iedw.ico" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3320
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2952
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3732
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1868
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2896
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell" /ve /t REG_SZ /d "╠╘▒ª-╣║╬∩(&H)" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4692
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2916
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)" /v "MUIVerb" /t REG_SZ /d "┐¬╩╝╣║╬∩" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2968
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1356
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://taobao.taohee.com/?1" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3128
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1240
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1836
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1632
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1236
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
636B
MD57408b1be46f0598d4e1f21d1a5d6252c
SHA1aed5f86bf363521c910bbfd0614e8fb658600509
SHA256128674b55407f9925bff787a97370f1bd8b0d29add8146056f810e06703e9214
SHA512c9f8c46a13dd0e4ca2bd8946533b6dffdaa88239e9011e201c0d1dc6177fb09cbe913a38651eb1bfee69e1ae3dd0deca42e5a774fd909503a3113850b3d85615
-
Filesize
2KB
MD57009a7eef740e60e8a82ed95f73533ca
SHA1152824f5a0782d9cdd13346c77e02f1803bc31ae
SHA256c75b7f6dbb633d810de7ebfac3be615f66c712d54423e2ba097fa22b0439b1ff
SHA512e6e3d9b84db4ab651fea7376fd4957f2daf6be87c38cfc463881d035a770be590c7639480c658bcaa4fa0beaddd49b8bd0bb8d64ae151bc224bd1dcf6fad734d
-
Filesize
14KB
MD5468fada123f5548ac87e57bae81f6782
SHA1edb8f012c25906e6afd8bf335b495e16c440243d
SHA256091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
SHA512635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa