Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1049s -
max time network
1057s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
galaxyskinswapper.ps1
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
galaxyskinswapper.ps1
Resource
win10v2004-20240802-en
General
-
Target
galaxyskinswapper.ps1
-
Size
3KB
-
MD5
a4b38fa93c168beff3ec2fb7c5ada641
-
SHA1
ad9ee01cbd84e96e599a8182ab5f61c501a24742
-
SHA256
dc4e3c07f436ff0c8af59ce1818c6397ce63d7b9f9b17aee03816ad019a5127a
-
SHA512
6d55a51402c32bbd471fad065675d761f42d81e73df5d48a0977eb0bb90e6b8dbcab635a595d96126f48aff5394ee6da0e57e9b1d212975568c95cabbb433094
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Explorer.EXE -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 40 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "aux" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "con" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} Explorer.EXE -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts powershell.exe -
Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates\6ADD4E9CF6FBAC24D33C0A4AE1AB6D8DC4AA4F98\Blob = 0f00000001000000140000002999f93d203d49001654d99725249d413135add40200000001000000cc0000001c0000006c0000000100000000000000000000000000000001000000320066003300390065003900310061002d0032003800650033002d0034003500390034002d0061006100300031002d0030003700310033006500630034003100630035003800610000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000300000001000000140000006add4e9cf6fbac24d33c0a4ae1ab6d8dc4aa4f98200000000100000000030000308202fc308201e4a003020102021047b21d541500ee8348c4c0d0d33784ce300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303930313133333833315a180f32313234303830383133333833315a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a390ac9bfdd0b339bc58a865c1ac4c748a5b3370464fd00fcfeb17a037f985e972d04a54de99e619454709ab26794123abf2fbaa8b7e83d6c8962ea8043e7ba74cc2a84edd917c6f22123995b483f018174aa8a373d3086b2a259c83ee19269dd1e0d65e2a1e365ac02d5158cc49520624b476ec20c2d976b23579ef40ee94f469b7f31ba8cc1ba874d281ebd5ec262ec811dd3545977042ab16accfd8a9a184e51647ee29db956f9cede1e40e8e889ea183d71b053a1883578d7586210d6b6fd01d0bf9400c7210943821cfaedf2a5de1521a398469334bdc3d1f6b56f6f489834a4fd8415f812804431200411110c13c1c762e2a7c5911d8d57f09f131a7070203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e4050534251574659540030090603551d1304023000300d06092a864886f70d0101050500038201010060b69f96bf064dce70dee652fad3f07e83950ca248fa08b9195ab0ade28877de7b8d5502cce3f280cd2606a4d0af571688d0a6dbad74287a2d591eb64085b5d5f5c8d3da61e66326580169b0acbe96daf54e586461683b6e127c448a3d2846b972c29f436cd8086f6a53fa5e4f07e1719b035fc75b62284068be70df96806b939cbd187b3065bb639d00d77ac26f6d4959f376b9a41f7e66ce64ac72a30166a2354589607030f08838d574c1ff9059c51b74e324319457760922bec32337127ccd141735e0fc236dcc4c5bf4912fe45bcc3bf4090343e587e17797e040f2bf2aa2e45375377b8307e2d36ab243a361e49b495a5e83f649095077192d4410a484 efsui.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\6ADD4E9CF6FBAC24D33C0A4AE1AB6D8DC4AA4F98\Blob = 0f00000001000000140000002999f93d203d49001654d99725249d413135add40300000001000000140000006add4e9cf6fbac24d33c0a4ae1ab6d8dc4aa4f98200000000100000000030000308202fc308201e4a003020102021047b21d541500ee8348c4c0d0d33784ce300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303930313133333833315a180f32313234303830383133333833315a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a390ac9bfdd0b339bc58a865c1ac4c748a5b3370464fd00fcfeb17a037f985e972d04a54de99e619454709ab26794123abf2fbaa8b7e83d6c8962ea8043e7ba74cc2a84edd917c6f22123995b483f018174aa8a373d3086b2a259c83ee19269dd1e0d65e2a1e365ac02d5158cc49520624b476ec20c2d976b23579ef40ee94f469b7f31ba8cc1ba874d281ebd5ec262ec811dd3545977042ab16accfd8a9a184e51647ee29db956f9cede1e40e8e889ea183d71b053a1883578d7586210d6b6fd01d0bf9400c7210943821cfaedf2a5de1521a398469334bdc3d1f6b56f6f489834a4fd8415f812804431200411110c13c1c762e2a7c5911d8d57f09f131a7070203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e4050534251574659540030090603551d1304023000300d06092a864886f70d0101050500038201010060b69f96bf064dce70dee652fad3f07e83950ca248fa08b9195ab0ade28877de7b8d5502cce3f280cd2606a4d0af571688d0a6dbad74287a2d591eb64085b5d5f5c8d3da61e66326580169b0acbe96daf54e586461683b6e127c448a3d2846b972c29f436cd8086f6a53fa5e4f07e1719b035fc75b62284068be70df96806b939cbd187b3065bb639d00d77ac26f6d4959f376b9a41f7e66ce64ac72a30166a2354589607030f08838d574c1ff9059c51b74e324319457760922bec32337127ccd141735e0fc236dcc4c5bf4912fe45bcc3bf4090343e587e17797e040f2bf2aa2e45375377b8307e2d36ab243a361e49b495a5e83f649095077192d4410a484 efsui.exe -
Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File created C:\Windows\system32\spool\PRTPROCS\x64\jnwppr.dll Journal.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Explorer.EXE -
Loads dropped DLL 8 IoCs
pid Process 1016 Process not Found 1016 Process not Found 1016 Process not Found 1016 Process not Found 1016 Process not Found 1016 Process not Found 1016 Process not Found 1016 Process not Found -
System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs
Abuse Rundll32 to proxy execution of malicious code.
pid Process 1900 rundll32.exe 1868 rundll32.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Explorer.EXE File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe File opened for modification C:\Users\TEMP\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ie4uinit.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Explorer.EXE File opened for modification C:\Users\Admin - Copy\New Briefcase\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Contacts\desktop.ini WinMail.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Downloads\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Explorer.EXE File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Explorer.EXE File opened for modification C:\Users\Admin - Copy\desktop\desktop.ini Explorer.EXE File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3502430532-24693940-2469786940-1001\desktop.ini regsvr32.exe File created C:\Users\TEMP.PSBQWFYT\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini WinMail.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Feeds Cache\7JXML4U5\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Searches\desktop.ini regsvr32.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Favorites\Links for United States\desktop.ini mctadmin.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Favorites\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3WOHY2HJ\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Contacts\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini Explorer.EXE File created C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Explorer.EXE File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Favorites\Links for United States\desktop.ini mctadmin.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP\Contacts\desktop.ini WinMail.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe File opened for modification C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\History\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Saved Games\Microsoft Games\desktop.ini solitaire.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QLC8FPK\desktop.ini Explorer.EXE File opened for modification C:\Users\TEMP.PSBQWFYT\Saved Games\desktop.ini regsvr32.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini Explorer.EXE File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\AppData\Local\Microsoft Games\Solitaire\desktop.ini solitaire.exe File created C:\Users\Admin - Copy\AppData\Local\Microsoft\Feeds Cache\72EHROQQ\desktop.ini Explorer.EXE File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\TEMP.PSBQWFYT\Music\desktop.ini regsvr32.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\spool\DRIVERS\x64\jnwdrv.dll Journal.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\jnwdrv.dll Journal.exe File created C:\Windows\system32\spool\DRIVERS\x64\jnwdui.dll Journal.exe File created C:\Windows\system32\jnwmon.dll Journal.exe File created C:\Windows\system32\spool\PRTPROCS\x64\jnwppr.dll Journal.exe -
Sets desktop wallpaper using registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Control Panel\Desktop\Wallpaper = "C:\\Users\\TEMP\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Control Panel\Desktop\Wallpaper = "C:\\Users\\TEMP\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\TEMP.PSBQWFYT\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\TEMP.PSBQWFYT\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.INI ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT ie4uinit.exe File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.INI rundll32.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI ie4uinit.exe File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.DAT rundll32.exe File opened for modification C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.DAT rundll32.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.INI rundll32.exe File opened for modification C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.INI ie4uinit.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT ie4uinit.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log ie4uinit.exe File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Explorer.EXE File opened for modification C:\Windows\INF\setupapi.app.log ie4uinit.exe File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Explorer.EXE File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Explorer.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
pid Process 976 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSOXMLED.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runonce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinMail.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runonce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinMail.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Explorer.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Explorer.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE -
Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" ie4uinit.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Document Windows\width = 00000080 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d0563b9a20c6f846555dbd7a15d269fcfe52d167fa6aca3724567cded008cd1a000000000e8000000002000020000000cb9ed6b8425f72ee75e3db2b27ab17cb356b36422399204e79d83701c27f28fc9000000020c8a1e52ca1b5a98c785899fe48a050f957baae08fa883ea75a18f4bb9602cdc99d81562e54dc94b41e5090111d0aca62f976a2c0bea3d06cf2cf88a5e384010e28fb07778d67735b88c74148dd81877d031a84cc4bbbb5c10d52ea03c3cc6fcc702c9d9c94ad0fc6530884bfeef0ba443193b0349f40f2d47eebfff993d9f109b89d11ef98724682545d91b29a82c840000000db4538bc0210fb8a0184ede4cd2cc90f2ca6516afcd2cbb7a4f92dfd04b6f0da6b01262c0b88d4f2196d0d18e88a3a3b3da1ad9c1b3c31af3db872c3c29882b8 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Main\Show_URLToolBar = "yes" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\7\IEFixedFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Cache_Update_Frequency = "Once_Per_Session" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Show_FullURL = "no" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\13 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\39 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\33 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\37\IEFixedFontName = "Khmer UI" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\18 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\28 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\LowRegistry ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Document Windows\width = 00000080 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Document Windows ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Toolbar ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\6 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Desktop\General regsvr32.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\37 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\SOFTWARE\Microsoft\Internet Explorer\Main ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\14 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\7\IEPropFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Euphemia" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\SOFTWARE\Microsoft\Internet Explorer\TypedURLs ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\27 ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Document Windows\y = 00000000 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Main\Anchor Underline = "yes" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Main\Show_ToolBar = "yes" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 103a485873fcda01 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Settings\Background Color = "192,192,192" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\30 ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\New Windows\PopupMgr = "yes" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\20\IEFixedFontName = "DokChampa" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\23 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\5 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya" ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\International\Scripts\18\IEPropFontName = "Kartika" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEPropFontName = "Times New Roman" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes" ie4uinit.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141" ie4uinit.exe -
Modifies data under HKEY_USERS 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2\Extension = ".asx" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mov unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f4225481e03947bc34db131e946b44c8dd50000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\1\0\MRUListEx = ffffffff Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.aifc unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mts unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4 unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\PreferExecuteOnMismatch = "1" unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmx\CLSID = "{cd3afa93-b84f-48f0-9393-7edc34128127}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\MP2.Last = "Custom" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.au unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\PreferExecuteOnMismatch = "1" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0" Explorer.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\PreferExecuteOnMismatch = "1" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/wav\CLSID = "{cd3afa7b-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\OpenWithProgIds unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/3gpp unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpg unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wvx unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m4a unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MMS\DefaultIcon\ = "%SystemRoot%\\system32\\wmploc.dll,-730" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wax\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin\CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wav unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.avi unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/aiff\Extension = ".aiff" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.avi unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2 unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wma\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.3gp2 unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.asx unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mid\Extension = ".mid" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv\CLSID = "{cd3afa94-b84f-48f0-9393-7edc34128127}" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.MOD\OpenWithProgIds\WMP11.AssocFile.MPEG = "0" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cda unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3 unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wma\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mp3\CLSID = "{cd3afa76-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\OpenWithProgIds unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1002_CLASSES\Local Settings\Software Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\OpenWithProgIds\WMP11.AssocFile.MPEG = "0" unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/aiff unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wm\ = "WMP11.AssocFile.ASF" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/basic\CLSID = "{cd3afa73-b84f-48f0-9393-7edc34128127}" unregmp2.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2636 notepad.exe 2720 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 976 powershell.exe 976 powershell.exe 976 powershell.exe 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 748 Explorer.EXE 2984 Explorer.EXE 2816 solitaire.exe 1764 Wab.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 976 powershell.exe Token: 33 2136 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2136 AUDIODG.EXE Token: 33 2136 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2136 AUDIODG.EXE Token: SeShutdownPrivilege 2244 LogonUI.exe Token: SeSecurityPrivilege 2788 winlogon.exe Token: SeBackupPrivilege 2788 winlogon.exe Token: SeSecurityPrivilege 2788 winlogon.exe Token: SeTcbPrivilege 2788 winlogon.exe Token: SeSecurityPrivilege 2788 winlogon.exe Token: SeBackupPrivilege 2788 winlogon.exe Token: SeSecurityPrivilege 2788 winlogon.exe Token: SeManageVolumePrivilege 2268 WinMail.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 2804 ie4uinit.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeRestorePrivilege 1900 rundll32.exe Token: SeManageVolumePrivilege 780 WinMail.exe Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 748 Explorer.EXE Token: SeShutdownPrivilege 1360 LogonUI.exe Token: SeShutdownPrivilege 1360 LogonUI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2636 notepad.exe 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE -
Suspicious use of SetWindowsHookEx 38 IoCs
pid Process 2268 WinMail.exe 780 WinMail.exe 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 748 Explorer.EXE 2616 WinMail.exe 3012 WinMail.exe 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 2984 Explorer.EXE 1552 Journal.exe 2100 WISPTIS.EXE 1552 Journal.exe 1216 WISPTIS.EXE 1552 Journal.exe 1552 Journal.exe 1552 Journal.exe 1552 Journal.exe 884 Journal.exe 884 Journal.exe 884 Journal.exe 972 mspaint.exe 972 mspaint.exe 972 mspaint.exe 972 mspaint.exe 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 2160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 2636 976 powershell.exe 30 PID 976 wrote to memory of 2636 976 powershell.exe 30 PID 976 wrote to memory of 2636 976 powershell.exe 30 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 2788 wrote to memory of 2244 2788 winlogon.exe 47 PID 2788 wrote to memory of 2244 2788 winlogon.exe 47 PID 2788 wrote to memory of 2244 2788 winlogon.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 2244 1752 csrss.exe 47 PID 1752 wrote to memory of 1776 1752 csrss.exe 50 PID 1752 wrote to memory of 1776 1752 csrss.exe 50 PID 2788 wrote to memory of 1776 2788 winlogon.exe 50 PID 2788 wrote to memory of 1776 2788 winlogon.exe 50 PID 2788 wrote to memory of 1776 2788 winlogon.exe 50 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1776 wrote to memory of 748 1776 userinit.exe 52 PID 1776 wrote to memory of 748 1776 userinit.exe 52 PID 1776 wrote to memory of 748 1776 userinit.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 748 1752 csrss.exe 52 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 748 wrote to memory of 2116 748 Explorer.EXE 53 PID 748 wrote to memory of 2116 748 Explorer.EXE 53 PID 748 wrote to memory of 2116 748 Explorer.EXE 53 PID 748 wrote to memory of 2116 748 Explorer.EXE 53 PID 748 wrote to memory of 2116 748 Explorer.EXE 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 1552 1752 csrss.exe 54 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2116 1752 csrss.exe 53 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 748 wrote to memory of 2124 748 Explorer.EXE 55 PID 748 wrote to memory of 2124 748 Explorer.EXE 55 PID 748 wrote to memory of 2124 748 Explorer.EXE 55 PID 748 wrote to memory of 2124 748 Explorer.EXE 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2124 1752 csrss.exe 55 PID 1752 wrote to memory of 2268 1752 csrss.exe 56 PID 1752 wrote to memory of 2268 1752 csrss.exe 56 PID 1752 wrote to memory of 2268 1752 csrss.exe 56 PID 1752 wrote to memory of 2268 1752 csrss.exe 56 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\galaxyskinswapper.ps11⤵
- Drops file in Drivers directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" C:\note.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2636
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2440
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5081⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2604
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2660
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2384
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1956
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1752
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE3⤵
- Modifies visibility of file extensions in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:2116
-
-
C:\Program Files (x86)\Windows Mail\WinMail.exe"C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2268
-
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
PID:1648
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2112
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install4⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -UserConfig4⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Windows\System32\ie4uinit.exeC:\Windows\System32\ie4uinit.exe -ClearIconCache5⤵PID:2624
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,365⤵
- System Binary Proxy Execution: Rundll32
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m5⤵PID:920
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /06⤵PID:2400
-
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /06⤵PID:2648
-
-
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Sets desktop wallpaper using registry
PID:2812
-
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:780
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
PID:1584
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:1844
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install4⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level4⤵PID:2112
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f8b7688,0x13f8b7698,0x13f8b76a85⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=05⤵PID:3056
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f8b7688,0x13f8b7698,0x13f8b76a86⤵PID:1540
-
-
-
-
C:\Windows\System32\vlmvdx.exe"C:\Windows\System32\vlmvdx.exe"4⤵PID:2956
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun4⤵PID:1952
-
-
C:\Windows\SysWOW64\runonce.exeC:\Windows\SysWOW64\runonce.exe /Run64324⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1640 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices5⤵
- System Location Discovery: System Language Discovery
PID:2456
-
-
-
C:\Windows\System32\mctadmin.exe"C:\Windows\System32\mctadmin.exe"4⤵
- Drops desktop.ini file(s)
PID:2884
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:2804
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2364
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵PID:1552
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵PID:1764
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2752
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2812
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
PID:2804 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe2⤵PID:316
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE3⤵
- Modifies visibility of file extensions in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2984 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
PID:1308
-
-
C:\Program Files (x86)\Windows Mail\WinMail.exe"C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE5⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
PID:2500
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2340
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install4⤵
- System Location Discovery: System Language Discovery
PID:568
-
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -UserConfig4⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2548 -
C:\Windows\System32\ie4uinit.exeC:\Windows\System32\ie4uinit.exe -ClearIconCache5⤵PID:2748
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,365⤵
- System Binary Proxy Execution: Rundll32
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1868
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m5⤵PID:1900
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /06⤵PID:1856
-
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /06⤵PID:1692
-
-
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Sets desktop wallpaper using registry
PID:688
-
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies registry class
PID:2752
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2604
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install4⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level4⤵PID:688
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f8b7688,0x13f8b7698,0x13f8b76a85⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=05⤵PID:2272
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f8b7688,0x13f8b7698,0x13f8b76a86⤵PID:1996
-
-
-
-
C:\Windows\System32\vlmvdx.exe"C:\Windows\System32\vlmvdx.exe"4⤵PID:2824
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun4⤵PID:1576
-
-
C:\Windows\SysWOW64\runonce.exeC:\Windows\SysWOW64\runonce.exe /Run64324⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:444 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices5⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
-
C:\Windows\System32\mctadmin.exe"C:\Windows\System32\mctadmin.exe"4⤵
- Drops desktop.ini file(s)
PID:2192
-
-
C:\Program Files\Microsoft Games\solitaire\solitaire.exe"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"4⤵
- Drops desktop.ini file(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:2816
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:1332
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2960
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵PID:3064
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵PID:1508
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2384
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}1⤵PID:3048
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:796
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
PID:1640 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵PID:884
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1416
-
C:\Program Files\Windows Journal\Journal.exe"C:\Program Files\Windows Journal\Journal.exe" "C:\Users\Admin\Desktop\hi.jnt"1⤵
- Suspicious use of SetWindowsHookEx
PID:1552 -
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Suspicious use of SetWindowsHookEx
PID:2100
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Suspicious use of SetWindowsHookEx
PID:1216
-
-
C:\Program Files\Windows Journal\Journal.exe"C:\Program Files\Windows Journal\Journal.exe" /RepairNoteWriter2⤵
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:884
-
-
C:\Program Files\Windows Mail\Wab.exe"C:\Program Files\Windows Mail\Wab.exe" /CreateContact "C:\Users\Admin\Desktop\New Contact.contact"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1764
-
C:\Program Files\Windows Mail\wab.exe"C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\conner.contact"1⤵PID:1556
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\telephon.cpl1⤵PID:440
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:972
-
C:\Windows\system32\efsui.exeefsui.exe /efs /keybackup1⤵
- Manipulates Digital Signatures
PID:2808
-
C:\Program Files\Windows Mail\wab.exe"C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\conner.contact"1⤵PID:2916
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\conner.contact.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2720
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\conner.contact.xml"1⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Rundll32
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
Filesize
1KB
MD5405c47503b3d60abe58a4644c285bbef
SHA1ae522c9c29447118fb9309720c7cf76dcda283f6
SHA256ba22ce92a6fc2030bcd69fe4176a4a390b75a5bc70886c79321802525f84da3a
SHA5120ab1a4d5cf53ef2dbecaef095602648cb9c0800a7a2c52920407e85ea74e17b2e4f20ab58d8d6e1e040efc514f9f8a2230159617e2d59ba356a68b104d4a9ee7
-
Filesize
964B
MD546a4eca2a791d84afecfd9f129a567df
SHA1004f2926d9377cc23c5b68ce26907435b8539643
SHA25606b6d34db7e9ebecc07e0b53fedb2a9bc2d4563b1d2037b7630fbc002942baf7
SHA512dbeecf882210add0dd4ac57f75ccdf6a9604c3308e92f70747313f89a7f9c590f4e1cdd507e53ee37e0a1b7e437320dc6ec1299d406ef34ddd67dfd900fddd98
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
67B
MD54a3deb274bb5f0212c2419d3d8d08612
SHA1fa52f823b821155cf0ec527d52ce9b1390ec615e
SHA2562842973d15a14323e08598be1dfb87e54bf88a76be8c7bc94c56b079446edf38
SHA51234d1a29c9142fc5a875733c49886ad52a077045831aaa79239712bcd0f312637ba86882a71d37d9d68789ef53e30be5d3470f56d03377cd1eeded98af898ff80
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\01_Music_auto_rated_at_5_stars.wpl
Filesize1KB
MD53094088e14afdc15d7427b093b8b7b17
SHA1ed10bf7cf3df61ba95f45dca39042473efe07197
SHA256b2b5080d83a1853fbec424e6b179b784c57716600e1b58dd8b2c5fee0e098fe5
SHA51250cc06540177f4d9c5ae4d458f16ad725410388fbb36109e09a47b08c5dd6fca1a764858c5259c5cb781f8962cfc81226d79c5877f5cddfc47b84dbdd5966f45
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\02_Music_added_in_the_last_month.wpl
Filesize1KB
MD5907bfc98ce854ae312127c952d8be0f2
SHA102defe8c5f9cc85742e45ba55e4fcfe326fd960c
SHA256c475dc7423c2ad60f25adaac754cd8b68b57ff04f26ecef78f3e5961b986a324
SHA512db4045f992bad6ad660769a22345c5e0d965ae521d6828d612b15f0163622c629992c313a41bc9e381f9b0f098117eef840d33100af4c6a3634eb0013a7fe1c7
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\03_Music_rated_at_4_or_5_stars.wpl
Filesize1KB
MD56d791b697af46d6777182af7f18c2955
SHA1d73e8b5f4ee646c1c4ab6d23f3cb3394cb833ca8
SHA2564825eb90140f6b2f4f7ed0df66b24e10ff5d0da70af53ea495fd30b3aa791870
SHA512268cf327a9f471d547ad1dae47833cf6d722c08f9cbf5e7867a422282ce52dc320340ded93473a598903bfee9bf6a1a3393779468dbeb27d3390dbd59e6d20ba
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\04_Music_played_in_the_last_month.wpl
Filesize1KB
MD5f8d3a4cacf055f5ec5c62218ea50d290
SHA1974474ce3fe345d8015863bd6ea7242ba118532b
SHA256201f2170812cf8041964c4d3c5ef539d96adeba6a68b69ecaed0affe3ae8e25f
SHA512ac32cbeb05fae672047705679043aecf9b56314baa09c2d3abb7eac655710d7cb2c967ea1772767e366bb502e8ad6de375302f51ca62a76d962ee539b45bfc21
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\05_Pictures_taken_in_the_last_month.wpl
Filesize797B
MD5821d2be672f05514127c117cef460c6e
SHA11c75f314e7658a3dcdcad315e301f2bae6d47b31
SHA2563abdb6cbd88ad1557054ece3f10dd1a8494ed32f423b3cf8321b18decc489474
SHA512146d6293173b80ffe3721ae6e61293cc1d838e8a72713be8b859ce33c69ef753408057be9ce15a78d573e253548ee674ca3fea77efa3d330ce8c8a50f8a8a988
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\06_Pictures_rated_4_or_5_stars.wpl
Filesize785B
MD50a8a40ca87323dc16893194b00c7fe77
SHA1b88a42a85053e0a7483e331b66ba5a40a6290e10
SHA2569aa433bed2e090cc6904f1c24d5a7b5a1ed6d8f71a997e661b886c69383fd53e
SHA5125932f09106d622054e6d624221d754ff471e3f37d9f585ed23db7f7327fe1e2f624b22a8f7f2827b607fdb9a30683b8f20c48a39cd35a57ad5cb78467af2c20e
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\07_TV_recorded_in_the_last_week.wpl
Filesize1KB
MD5b9987b1f9df6d0afc01558b907e62a16
SHA1ef202d5d6f90b37c71cb757f3babb0857ce54d86
SHA2560892efdb8459d81d4c5e1085239734d9910b9c6a1debd7189cf385141f0b19d1
SHA5126bc86075632c3e56ffe1d371f4178299e93e014f5c5c83dfdca2dc9efd1155633409c79ec87cfe2afd4374b83771ae56a3eb7fac00f83921b433cb49216037f9
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\08_Video_rated_at_4_or_5_stars.wpl
Filesize1020B
MD5a3787a42b81fce0e448976ad158edd93
SHA145ff275c0c32eab1f0b56e8b61e8ead18cfd1675
SHA25694bc17ac59bde92fbca00fcc69aed68fcbfe2c1754dd45f4810765f5fdf774ff
SHA512b36ca10f580ec9d455fb57149bce1897fe48fda6023b2fb55b6b4b80a91f1754311b91edd72c13103e0da9ed90b696c28d6904ea91984ade69ed50791f4065ae
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\09_Music_played_the_most.wpl
Filesize1KB
MD5467e71aa2fd951eb0a1af3d6bb8378e8
SHA1fb654c0b2663d4fa5fd0f1658097d936dd0429ed
SHA256a54bc2cad63ced4fd9ff2a3a094a26e264e8a5ce8139193896d13236f494e2ee
SHA512f9242a4925b910f4a114652967a6e2f49444a3f0d9f35402fef28cc8d39c58720930084112baf92eb6716af541fd76e3803ccc1e742cec07f1d4fb6abc13a42c
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\10_All_Music.wpl
Filesize1KB
MD551aeed11707741118e0706c1259df22e
SHA16434e915b018c6d15898fe0a4d006bbe3e1edb60
SHA256ec286113e5ad77ac34063589a137a6dc4b4cab8845cd9c5386519983fa3b48f0
SHA512a674487f9cabe1fb2809cd98958dce696f7f066d3738bfb30317201ed804df3c72f2d24d6f9c0832cf446c8a965e21f3ea50aada1c69860a12340d6eca88e942
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\11_All_Pictures.wpl
Filesize585B
MD574294ef495559ed32731f19096d70312
SHA1fdc6cc849270016d2a382d7d0daabf44a4556cd9
SHA256db34d82f2cd23e6e55a64e12d2a0a9c27ac2ded156483238f22a336ca6825110
SHA512b068d903b83945f146abd4cf384da99af608643c62b647ea65db33c3b0e0face4727a74be3210a9c6469bbc403d1f5c59d92cbd57722737e992b0e4f5e66662a
-
C:\Users\Admin - Copy\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\12_All_Video.wpl
Filesize1KB
MD5372d0beebea5460409a6a1c53ac52a18
SHA11b5a925e00f9a4cc3a18feb8f74a2e39ef11eeb6
SHA2565b8b62b35e5dd8a46ccccaf3fc3743be9e0965d24cbcd20da2681065eeb37ef3
SHA512efb412e3a17f4eab84fb9f99b9e420d18e23610a9a66bcd7298c3ba68fd24abe0c1f2e58faa411e059788d34f4cede45f9e25c6578d13faefb8ee79acd50f2e0
-
Filesize
4KB
MD52c8e4b5c21697cc270c2024064c4eb93
SHA13a9b25c868cf0b2ce9503c802da78f22f689fc6b
SHA256b5f9b106011e1d84aa5349ce86b76b46da8bf7c6b5c580b7da27fb97dd1688e8
SHA512919b9ddf5f2b40083940e509bca9bb089919ab20d6ed1481bcd295ee0b270656c826b64c3364e2e147d6e825adcbbaa663ed23e38e897374e913cee4110b9c3d
-
Filesize
84B
MD52d969131bccec01149620521aab5d9d2
SHA1ef8864ea141862fbae6eb25c0c62b34f5398c304
SHA25663b9a95398fa607bdbd5187b15ffd20aa6fb3055cf6eb524cdbc9450ef5675cb
SHA512edb7139066dba40bfb2f0aedb48d7103eb54de28e4a5c61a1e200a3430782f04eebd1ca26a693a616444782d5c1966fe40dacb3180900cc0c80a81b0a53c41d3
-
Filesize
512KB
MD570c19455f580dd8a5ae98a491acd68a2
SHA1f33b5900aab5ee066b2a7fed8d91ff0b839b4e7a
SHA256fa00de3eafaee0a950c20568333d4e10f7207bc0bd3914c7985eda0cf2c18808
SHA5128dcf5c1f7e9f04f9b834a361f8e5f176a7eef67dc65fecfab7b2bdc3d6c46c7c76742beecfa828f0becdda4ed69fe38dd57460946f3feefc4d40d12b3f4fcb0c
-
C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
Filesize2KB
MD574b4e629066d19dfc73ed8599e21d240
SHA1cad0c68fdf8bbd8f0b9765fa555fe4dd182f44a9
SHA256f7e412e17d9eb96d73d98dc6c9191e913ddd3441f55da502f2a841efe802a7cd
SHA5120044a039a181a9d2ac49425d6c6b56bc1eca6d25a202b59da7ada5311f06e90bba3744a678da00c69a1936ded22beda0be9871a59ce2d14bf8127536668ed00b
-
C:\Users\Admin - Copy\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d19fae791eb5336cf4e7fc1ed920a556
SHA14e925e8ff7fea7dac91a6ad895ef737d3f55e285
SHA256f267317a006d3954857c9adf5ce4bd8b771850b582dd396f17aa1860461b5aaa
SHA512d11c2cce4ab038bde40efca0ce102a2675e8380246649eaa182167a03477d967491cb626c0d1a79733c0b1b8be0f887dfba9d5f2f613c6a427213c14ceaf1d96
-
C:\Users\Admin - Copy\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Filesize48KB
MD5248d17bf9239c380e63eaf612c3e44f4
SHA160a6c948cb802f4a5c9c163d64fe61f6d06da8e3
SHA256b0250bf41457d908f9cd266667f7d97007862c3466f9756d40757f04a1939bb3
SHA512e33b9b3ac5edab1fbdf8d8ab1e493c87fd5c4455e4e5fdd68afc9d41d6eabc4f7b4e1bdf72a06a1c348b5aa8b6734f94983d26eb8737d0cbd4092336fc6afbd3
-
Filesize
120B
MD59a4c9d91e02179e4ec1e3781414b2af1
SHA12d16a543dddffad38f175710548ca4925591d678
SHA256c0cf77143685ecbd600c444d4b12a548c1372a8273dad01983e659c6a739c0da
SHA51258b1957d1a83b20a590fe7aa474f8b230c12c7344c3b9650d908568d686473e7d27bc6f4ff7fc99c3a860f7dfa02f3177f3c267c41e54c1b191a30ad86671ec4
-
Filesize
579B
MD5f55da450a5fb287e1e0f0dcc965756ca
SHA17e04de896a3e666d00e687d33ffad93be83d349e
SHA25631ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
SHA51219bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
Filesize252B
MD50f49375aa0b4ef970510cb5116a17c9f
SHA12c47f714a83771bc60a5ba4762cffff12c7a4db9
SHA25601b42c8714c6b66f05779a9b52d9c22afec8a9c167ceb5964bfcc5a14c221d09
SHA512e6e13ce6b0bb77442146dad6fadab83ec60352ebd5d52a6d6228b0f94e76b7c3d4304ace8746195c3cd7c0014f98efb91adc860c307a317b91a5c92adacd115a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5472d450bb99331e3b2eea1c017a1fcf1
SHA1c40039227ba4128ef1231ee25eedacc694b32aba
SHA25627b9c596ebb5eccd6082c9a0bb413ac1379f6c28a95f12a76cf1ad917c725fd0
SHA512beeaf6218a528d3a7d489cd90b5c584680a5c68ba2ded5acb99062daf74f7aa9b2193a9384c198bcff5c419b76f68fd4c908704ff9aa955392b8707fe5ce650a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3b15732585ed015abcfc25be59ea150
SHA17ffc7f35b27d43d875d71d5c2a9f68da8fb121c0
SHA25698e1fb354ebfe3015d7798471b686ed9b832099e37abb965c44d647546983686
SHA512850893f415a8d14c127a1026a85f9c1f80935c82b58b64b6f4c489f841e865c5f5e04408b7c0fdb6cf970763a753788ebe168e345bfb3ae14a95aa1f23cf966b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d77876195b54e98465e5c10492c30761
SHA107273f99ec1fadd37739e4258bc1fd5d8bf383ab
SHA256685536d3fa77742085f8c8fbf55962a9857c0152688e647d8015c404a581331b
SHA5127d177f1aed61f4519f35ce3ad93b25c62bd6c8e191891f9b537a74b23e4664e95d260d935a1de625d32bb4192d2fdd79292ae24745ed7af8b2743d8ff36d1564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2ffdf120e2c2d8c520bc94da64d2776
SHA14b3220fa26dd0bd0f2c5468e32861efb979dd395
SHA2565349ab07806a130a463f3641c9e45c80d24a17a857bfc82863d48cedea6a48d9
SHA5124f4d8a0605bf6bdaa8e38632b9279287aa36ddb5fba9957c3ed621daeeb30bc63d659c71cf7486c8c43cc1274971eec2a73ced24ea2e382a4bec8a8e0909912e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528cb95992ba83840883114804080b9ab
SHA1ae60c9b01fd8ac0ed68447ee73278a12534a4b51
SHA2561f2b5c2b6b82157c002cf6a9c34a8ea8d6e44cc9e70d2756ea6c631746beb00f
SHA512cf16a34fe6085aac16a5c552f008c7f75a6015d764d5f80f42bf697294c0e3f56f0046458c2cf3ac662f875ff78376e2dee2961f952eacf765dfd582f0043cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ad97899aeb1e8eefd752a29b634c15c
SHA19150b01cf9995ac257f5d760c6b9e66a0d5158c0
SHA256e87f3cf9a7117e007f7ee862e21690c63dbf668c7ee63d967da0f48902784e20
SHA51299fb30f0e3590515cf10315b53ef8db2a201bfbb46b54351fdeb4845bfd7ff2d2491aa47656cae906b6cb763882be138f4523cf41eff9513e34aab21e4ed5275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531e0d27a03999539f9ade2892492295f
SHA1a79565b6fae11c9bfa02b9400ac03842553e8547
SHA25684f06ca7e5f20956ccca97ff015ea0db2c34e4310e67e1187381fdbceda637e7
SHA512246a977495ef4c68c4b5ebb22a73e44418fbe95a4eb6b3a9298804be002644eac5b5e177884e01adbbe80b994932760068aaa58d8806d025f8fe52c2f76a820c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adb54f8862ce1039767dd617ff245bc1
SHA12a69de5cc1613a597654b2f895f24111cc0f982c
SHA25637534aea308e435ee5746f0556b2fd4e9d7c59449b712a66c08ebbe1ed75568c
SHA512b579fe4e6a416d2b7950faabde1ba4b0759e5aba98c2fdc5308102a154520f5d6f7d1f3d8565c2321fd2bdc96bfcfb5ca33a384248c1569aa9420742276b0422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af67d259313e1544bf4e015f9002fd89
SHA14dd06e0cda5e8b504737ca4abf707fe36b0d8502
SHA256bc4a76f66714b77366973c94cc75b890ce7e7087a0dc2f99cd4da9769968a4b3
SHA51270fb3db3e78069d4e7af82160a4be5ed04b8526670294930ce3adf9a158aa3be1a6fa3a83d4522e933a320f4aaa82956b715f2eba5c82579b4b543b0142f80f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f15db010d887d22f30c231a75ab01cb
SHA1751a75283e365de9614585e3d23377228844f9bc
SHA25683b8eb5fddcdf2932e595daf7e2e307bf95d740a16344ac0ec6e48d61f1860a0
SHA512aa6d71bb1b14f2ea9d92aa28cc5a3074f8e08f5345795ec491d6f8154b29e0c2baa7b28c6df54813be501dea588e062daf00c1d257d8c1f4a637c90b3a2c0ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff987f1c984fca0d91ede7832d891bbe
SHA135ac6d7d82bc8ec547c1fabdf031499beae8475e
SHA2567868690652b732230e2503135b7b1eb91abc77dc99d58ebb111c7b811c591005
SHA512d7cbb9b6894037151939c59964ce729a3e3b641e39826542f0eb75fe5ac0ef9fc00822e68f7bad6aa4ae6f8d62e38a7da205bb8b8c8267cae8a011767862a8ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c42e344232ca3fd377b389f4a51d7d43
SHA1ae432240d808fd0a7bcbe98d11916e00fb90b1d0
SHA2565da86c1f86b835cdde044b8fb17bae8b28529bf4381798ec4d1103429760ddf4
SHA512e1e20f3fd178fe5746db78985a0d9ce775858cd50b4988aa3546e7350bc8f8659f2c28e38b4acc3daab7fc71493f943c618b5e69edb42a83be651a8be8d976f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df6dae95e7d5edeae2ac96ddde3ae175
SHA111ef9c0e550bf067656234ec622b4f01d0176a8f
SHA256814211daa6cde0b133fb6cf0eeec2bdc93fc49e1d6404f542bbede876972bca3
SHA51213577c1cf65fb04332c3ebd518d7a47063fb7ddf4b4d4cffe938380be29bba5b230ff0f28665e1705563c1accb8b64ca147c21c5720dbe6407a85aa0bf457260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa883d12b43d8b15003c03920f8923ec
SHA13f5778fccc0cc3a3a179a48017706bc93e715dd7
SHA256faaea9ed566367f2534d109f4387c3b13f5e5f419943d602623b0cc36044ceee
SHA5125124d1871c182382a6ed78cbd8ff318afd58c4fcd6c209067d7c699f7c66c1d87f9fb968bc0076aa432abd79217b572e5c53ac349fa6b90cd681804f69675ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520dc1ab852212fcb2564d8b4360b20cc
SHA1eb548d034d374d4a3d8b8dfa93af75e37606323d
SHA2568e6eebe9bcecd75db7fe30fabfcb8352594b9c193dd4172d1962f5bf67617fd9
SHA512c14276a51c87ba3fe85afc2e33c19b7200042153188925b39cb7d5af19d7dfae29faf36c356dda7c889484ee35d4f0194971c7eb5fe7077c3a5a8d2bc2312df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5061b1d9d75eb4c4f6b897544a6c22a40
SHA1c38771704edb9ca6bfc28c3045725212def326c6
SHA256393fb864259e30e6627935dd281e5c233ee4b26a5767007c8c84a30d37992fe4
SHA5125d8028b7bb32e9f605fe1818bede3ad8f8e91629728f82efbbe0fe781bb8f65a8326d3993b57f59088c665c98e1a19ba3917cb2a19de4e08fddbe6987bbacd65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ada650a658d0da418fefd658e6273f2
SHA111c34091df03cd19ae19904bb3d004fdca6ec5e1
SHA25659eb57df2bb07033dd78f20bb0337b0136fc2c26b34e34c9be5dddd349360651
SHA5120e94c42edba3c342ff7a2fd9af9b629b127c068c1266cdb7df47b2af9710b75bda609e98c72d9c978e8286f0560e8995112f48afb88bbfcc2cda36321cf1882f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b433b647191f367eca1fcb4e936403cb
SHA1ff5f9444e2bb3144be056fe24bfb129e49dcf1d3
SHA256b25ef51f8745271539d742b62ef4799945ccc81f2187c992f6b0d9e3f813bd54
SHA512751f0a8609284b97d3627c50e764762a72861737a9913db6dd918f97d836f97f70812f406f127c6f9de7b33e05cb60fa3f1e68122eccf50727cff3ee34b2e8b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578886e587f290a1927af9254e5baff0a
SHA145f659459d394b2d1445542ea3e4c7da7c774a6f
SHA256a8c94851db4af27fa4d673182e1cf22491a7f2f6c21842669a6639f303633ea8
SHA512dde056e3fdd061d851613ded587063d658bddf99b9cf18f220e5228354e135d77a37323451b94dfb333b044ea6ad65598a86b99ad9dc031ff721624480a88a4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529e054b4d3b5b3fd455cdee549e7b831
SHA124667e067bc30a50f6a907ff3fa3f6582a900ebd
SHA256f347261e65ff60eee0405e5c24b24cb6245659cec8fe41f5a84e842106ba23ae
SHA512a4eb0103e67f82c43f5e59b5074773e15be3310de56332b536767011d8254292a19488308cdc21abccef5c75899f39a3fe237c75c5d198aed5d5ed42e228118a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca83c663ecc457efd54919f91fdbc538
SHA16db176342f5aba81d60cc0055880e2b9b00fbcc1
SHA25666d6d89608d1fc402a079c5238c9452b47fddceff65cc19b4d4edfa1d5ed686d
SHA5120ca26ab53ea6f7ea5a7f001eb1d2bb107fffcfd751cfadbea31e45f2bd4e5adaa8c96ad0428cc998cafef79a76aac5f864505bef65d633cd38694aeaec6266b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54328a777f84e7a51f762ebfd13597d99
SHA1d863da7d5a005c63fc020900a2c565260807ad46
SHA256a2bdbe9028bc810c6befb1809a65d6313185ccfd80fe0156a379a65f3debe674
SHA512aca91ac8c725f6a0d007a1cdf8e7c3878df24f776a3a549069df701f084399e8718522a3e0fa194bcdb5cf08387e671932206d241092acc440897da76eaa387f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b00c67fb8ba8508bf0717c68ff4b2b23
SHA11c5e070da29534dc63f736d34c605318407f8d66
SHA2563c9e4142b84937274329301695df65b1919525ceac49d9ae149f2ddd5a468781
SHA5120e05d568a68382dc7cf0197d77cf7cc2f4e523f5fc4cb0debb867fe52252f11c3fee36f0897c5375e6734604e8187e0c1e883f13d0e39d6ca69230a119f081be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517904414950eebbcaca4b5a85309c7a3
SHA1d40bb75fea3ba7ef8a9d0b7a98b1f98883b789c3
SHA256e08980c513f5dcc9ad6122e405fc1493f8d0ac46bf6e437215f8ce1b89bc3708
SHA512fe81aab2c37e1167a42a1cdf423318e5c72f697bc92dca06323f2bc82eb0a6fc1c1ab087f3682623a9c999cc5e77579a63a02bb57e7154b2592d23cf077108be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438a7740ee6d614a62f3ca4fb06a793a
SHA1945d985bda893ca511361e40ae8131f427d06db2
SHA256d62da2545668bae1eaa2b6a9675c3b81f21f437f2ac4ab8ce9ee1ef418b64bec
SHA51241f0eaa3e81361c622cff3352127968ca6c1baf5c7013ee7dc2dfe58add963a7b7f91585047c988fd2573a5fc1fcf11cf109b8e5cbc881974af33bf579aa8670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed72d2b45b29cd965708f6556103ab5d
SHA1d5592a6d763dda7a132546f91a9d99c925630d3f
SHA2561e9e27e76d890d14adf96b1dc18a79ab31be4328c11506fe49c971b24fe387e7
SHA51291e5ef0c8dc3b7d74ed2a51396eb1ca07c8bdb5cdd3824bdea47bb203525542bb69853aa82432841c24b38092b3e28761cf653a1dcd49adfdcfb9bff9ac75452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f272099772ccf6452100ae3bf082e8ed
SHA1917046e4c7ff09713d137e7f22d8853dcb8c3a2a
SHA256b9d4e408ca925502fb30abf8eedeeda8e5a39057a54acdfd6528eeff4e17f234
SHA512c208cc79ea1d8d2fa2ef3b9e2329a2a8d06afb51dc05add3fee7ac6f1a2e0f55dff13ad1085077f478c28daedd5abd85e8fe19d7c5ba20a94d8cab2ddb483c79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e785fc4b867daeb7b616a083aaa7a36b
SHA1f058ff412ab0bea7aa9b7f77f2885e60aa510ec1
SHA25678347d79fa9911f259afb39fb5d75d45c4d3afcb7b9eba03e19d21f9394578da
SHA512cf04ef245b4db159964ef524bb7eaa042fb51253def5a913083292709b8984e8c01fa94fd9dc0f1c1846e0ad7c78d3a56e75a231b572e9abd63b4e33720788d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5680426caf6357ead2796db9ab5650b9c
SHA12c056d55371d6cfacc544afc551cc21443a5d9e8
SHA256fd693495cd34920b1f73c197f4579442cf9462c14f69cf7525da4453da2cce52
SHA5129a507058e8264e3d1dc3effc1a7a0fd23f55bb8807430db6739e81c64d1ca6b8e1d426336f86a35d67d8bf28f5dbb0f6887cad11b368ca5fd3a5cb7e508e3c91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d58a09b2dca145263e742145ebeea7cd
SHA1cc18a5984d7234d36410d82fb03a942be812ffc0
SHA256ca3c12791f3a033ad4a2948445458e71339c9c3581042a49d7e3faf392b820f1
SHA51284e44d6ce73b649541c131d95d30ac8eda0b4888d022833d934787f984026cf4f657451cc5477fd75ebf43519f3311f2b799096e788f10e426ef1b45a48ede8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b41055f92893395dd1dc33f2fcb5c17
SHA13140c2ed263f0347ee52b92b3f9f8dedf2430218
SHA256de5acf355ecc6259bdaddcd73193d3f5783b250a5d00e97b5e83663651403ab1
SHA512876e918a6fb58f03bf6e165f19ed8323e390ba37c093090100b9e4caf9b9338093d61aff26734843fad6ac031aaade173e588dca1898ba5181485e54afd7bc84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad7f2a97ade520e5eb62db835ca6e8ee
SHA15b73618872710db9da83308254796db18601e8b2
SHA2566b43bb4ca3b80ffbfd9d2dc2398fa084ee4c71688a8809186aadfe1efe6d7950
SHA512a4dbb1a756854fbb71b6bf2a32dee9246f417f98f7147a9837a799d35d728ac07c6a3467e913fb94143af942edcb27fa3a7d9219bbca878516b5f432dd8c28c4
-
Filesize
770B
MD598074b3244029f13b389bcd64ad562e5
SHA11b93866fe21793fddcc36a69ae4d3bc3886f5ac8
SHA25666c594be50d4ae37ad5eb0c87b42ddd1847568dc5171b1ff77dbe251f061910b
SHA5124c7e4926c704669152bf088524fc6cd2aca495d717f7d82c5a2ffd465d3ec820fd2ebdb71cd1b2a43c72d503cfbf696c1fc2bbe72e877844416188847e89d4bd
-
Filesize
862B
MD57cc62e820786a5ff5d900831d5e4b39c
SHA1be1fd11f3f7f154d1b5f0d80686366e277909507
SHA256d79a2b7f0f42eae18597f29a072c716dd346d100af3079f50e26c03d9e622e82
SHA512336f61fdff6e53ef05a12dd91b579c3cf419ed44f500cc9231bd435a8f9e48bc80bfd6ca66523f3b679de35669b444477d0997505c56a8ed9539952239b494dd
-
Filesize
344B
MD5a53d9a4206e3940bc3fca71e0496165c
SHA19436db6deafabf5c3767f287a06358e106e0ab80
SHA256ea63f33a155a25adcafa0ff8e83bf5a3c7f5ecc2ccc92d50b9f66aa16b3bb125
SHA512552b97476d854e09294feec2c30f66b4176d2cdee1fdc30084a3989f9078da8295eb6987bca7bcf13ab4649d7599d942aca36662e57675d4f16b164ceb4fda88
-
Filesize
344B
MD5f3b7b25a39b8d95dd17ec420a43db6e0
SHA143afb334bc0421ead37a5c2d279344a3688f7304
SHA25680c49f0df62d2a1f0126b0b295ce01ff1f0e0c2dd184e1285f7f02ddcb3bb24d
SHA5123a99a49d66d1c25433013d29b0ae01c6065c5a61014e304e7b7ed3ae64a83e1258eb28610c2aa343f6e5b3c6b11f80fa97110b9108197d1b9509a98199d5592c
-
Filesize
6B
MD5bea07e6d2b8dce396fe21baa61b34956
SHA1665332b36fc8fa1ed11210cdee83b639b451e592
SHA2562e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
SHA5124ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[1].xml
Filesize513B
MD59b55e2567f65aaba11cef2db31e1b241
SHA1d57802dd3300c047de23d2999f06043058387f6c
SHA2563560cec605fec655f9a3bf7c56ba6826559ce5b8f6677b5e12540bebb1882988
SHA5124c72209fde50a6e95cf9d1fae5b217405517a64011e6a7e8aa34546405f8601a67113833091e479b9f63b3740a1289db14d1be5ae2975851df5094d2d46c111c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[2].xml
Filesize493B
MD581273a523a08b32c71e70f86df3f4cbd
SHA16e769064e1c6a7ed56019fb8b1cbcd16f46dccf6
SHA256a1cb2d86caba31d2e55770b8fe13a8a66f88cf4ce3a4e6d9e6d39560916bf800
SHA5124882bcf1f07413e735599ac90385c5173100354534ec5abfef8cfb3905e6388c2ff7cf08e8ea3331e9c061b11d144f72e201f52e1dd3475ae235b4aff257dbeb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[4].xml
Filesize490B
MD5b5f026fe9fc96462422fe6446eea589a
SHA101d2c47f08bcf467e336ff1babeda4bd697c42b5
SHA25614d53fac8c50650fe20fa733b6751326d6feeb79b01d25eaf172fdd5e6cb32ed
SHA512b39615b48a02fc96267f4f697858eb27bd688c5b427275db9ea3fc2a24b548064089c65879a50e26fed0e31d75508ef3a59af74d53ea73e88510df888a0568ad
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[6].xml
Filesize493B
MD59f47e73d9c0748e71f1c8b993c1699f6
SHA10fc44c44138ab7d3cb8fd62ddb63bbed859893a0
SHA25608bb6fde09214cd19c0afcd407f234abec9b1301241836811fceb42e06d920c7
SHA51241038c4236de5996258507f259f57924858abd10b4d5db1c0411c05486bd4d41dc661cfda864cbfefe088f72b8939303cfe1c3abdfe9257cee18b26105b17454
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[7].xml
Filesize531B
MD566cd8ae2700130587ccd7566631d8c6d
SHA19afe84ca56c010be197d1cce008c3fe7a4acaf61
SHA2568a442392c1d1e0598e7aa463da5f00f1693cedfafcf82a830397da5210797e52
SHA51260d51cde84a63c7621e7f7b5ed82ea0a7eb26d149f8328d92d95a379b20011cc75dc6fd6d7aacd13db74ab716c28e38e3ce1fbf3b3896d9d8f85517ba7c5f32f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\qsml[8].xml
Filesize311B
MD57399696d1d0f6ad5ebf8f38dba99fbbe
SHA181e7d8e83746114b932d5a158d8f60b43ef372b0
SHA2568ec403034cfc55ad367954737d45e9d00b62ac2f369c38baf9f67474569bcc17
SHA5127244c42d923dfc232a2c707496d43cfdecff88238405ef86110605b4c6857583c68931d56c3fd20de1c32a19a00b85ec966cb8ce026144a8e84e5614d73d4886
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\favicon-trans-bg-444-mg[1].ico
Filesize4KB
MD513caf3227254f379f898b6e6e61027d3
SHA1450717390f9dc753bea909c3fa716e7dcd5cc05c
SHA2561e8014a08904c253fffb5ce408982b731fdb0dbb6a2401192ef2ad7141c2aa9b
SHA5129c0c2079c9b013a092105c05b4b94c9012dbecbd90236532dbbccf8aa26d86c4d7c87c44cc06ac1c2f025ac084aaddc5dd1e916319cdfd911d939019c5b8570c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
9KB
MD5c961845738963e52074d5984dd80ccad
SHA167c2262b6d9ad35f65e88ed616d06a05e809db95
SHA25606f81c22a4b49639714602f5b8e63a5aaf2d07129bed12308dc607188a369c88
SHA5127c711a700a9694145e190a6a1232cc2b386f16991895efa05a83ed2eaf335824648f14f9cd105cac54eb73b47ae03d1c25326bfd39c5560c788ed82f8ebda84d
-
Filesize
1KB
MD53879dd45c9c16a75626528527115f9ce
SHA1b4f7ddff5eed6efc5ab367d3d1c0d5992cb45eaa
SHA2564f5fc289c3223124d82e6c5225844ab0fe80c271af0c9c97e4e82a7dcec4f9c3
SHA51203b3c172bd6630adbddac541cfafc1f66c2ca483bfafd55667368e15abecd345e32f688bf60bbb6cd4f91a2edf7f2b244b5c124418c83a82f7b01f53e729ae10
-
Filesize
13KB
MD568135e9112fba7c958553a93676abc28
SHA18d2ecaae6ee4cbd4930519c533e1aa3ec1e4674d
SHA2569f6de518dd90e0f871ab45af29949d632a6f61eb753ba9d05ff6202f79ab513a
SHA5122066496c2c54e436a8d3bf837d081495c25771cfe334225bb3b7eb6223626e3419e831a6bc4973700210a2c2b2cdd8e1e46a6069b7cd0c5d4e9fb8b0e7be4535
-
Filesize
645B
MD56bd5fb46283aa48e638bef47510c47da
SHA1c38d46ec6c9bc8baece4a459b617f44d10af973c
SHA25644fe5eebd80e46f903d68c07bcf06d187a3698bf3953bc58bb578465e2e0fe6c
SHA5121aa743e7e6fdde7381abcb4e795a82c000dd28dafe536d430a31f96b6d67d1a02751523d2d6dca589a393e2951baf3bf3271958699b163aa5b8abf2f572d8449
-
Filesize
2.0MB
MD5b219cd618598dbac4d6430d28016df7f
SHA1f094d1b764a16e4958ae0d52b70dad1ec584beb6
SHA25655891bc530b3f50d493e7a07e3ce6ceb62f522132318b4820fbc397810472ff7
SHA512b4cc564e9321aa9985796bd94781e37e8b2450947c91dbf47da84decb17b20e496a858052f11e786431b185553f7391f1815cce0e39f2e1f248328015a483d1b
-
Filesize
2.0MB
MD5fdbd2895cc27caf125ac718cb95c9d0f
SHA1c6aba01ea8193b695d8faa374aaee3d1ea5c8dfc
SHA2562b19a465cf484dcdd5bd1b3ac57500b6f1ccdadc6970a3b05a3e5cda40694bb6
SHA5129c768429e849f2cbf3f9f2200a349fbcb0593d45dbae56e8d7ea3462c7ae3be4b69a8527dddb90460e701870d778c48aa8eefd9f38d4c6949bfe698ea6027843
-
Filesize
498B
MD590be2701c8112bebc6bd58a7de19846e
SHA1a95be407036982392e2e684fb9ff6602ecad6f1e
SHA256644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
SHA512d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
-
C:\Users\TEMP.PSBQWFYT\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}.gamestats
Filesize2KB
MD5a338c1bb5704e723487ef4f8d5d592f5
SHA19b6e89c7fdf4ed588a98b673dcc3073f85eaea5d
SHA256c096f55238f36481b0e846e37004e813ea0b34ddbc7a94f0155fd64ed4dd5672
SHA512ab62aac5a5fb6f599616d0998cb8011ca18c0631e42451958af89bcaa8db2b6e179651cb14c94f3f6868b0c8632a4048f8c9e6ba7ea6a31abb168e1362188952
-
C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Filesize1KB
MD549ac1e90cec116759e541c4c9eaeb6f1
SHA18f4fda3e029bba100fa52a63124018f0d5cd1807
SHA25642d064af194659b1c48daa68f1fa219736277371074054a347baf881686adac8
SHA512402a5bd65dd43920ccaf94dba2ea6d0ba935a287000f1ad57bf69315daff68a2e55572a035a06a0a34f5eca4cf6bbba91ba15ea0558aa15a1025b5469a6d7718
-
Filesize
1KB
MD5696bffbc8cd1ad6400f10220607837c6
SHA14f7aa526dcfe9b2931d58e3730d68aec56ba8c15
SHA2565ccaea1aa0a029d4c535f919ff30467be23ffc8f4c20c213a29e1b7da74407a7
SHA5127552a73d36c23f85df32dca367d9719dc699ce6823d55f03fa11e27ed1becc80b5e8842ca9e102cda1fcddc508149349f5ed939e7596ff04820a1139f0799363
-
Filesize
3KB
MD5540909b827b7fbfc9cb6b381e96268ff
SHA18224ab5bdb00c3d2bff178ca426f854712497cd5
SHA2567e777d352b9dd94c6f26325d3e7a328de57aa2602e832bf6e88cecdc9deed949
SHA5121202647a445571c480ca8b78d29c984eca15b087b847606832795df4784c43e6eb76dd2ca1460af207f9dfbe43c40314c25aa28d9f400495812d647e9858410d
-
Filesize
3KB
MD5e6bcda381a6f90047efee05cbfc3e7e2
SHA1622469c566b03d044e4702dcdd2f00b40df89131
SHA256f1bb140d9739f2f4dd7963c138011b0cf6fed9c491cf1cb5ef80a19ca7e4da96
SHA512a1fc1e9fed2575446b04782da271e700341ee205fbd93c48d73ce47c12722331f05486feb49901c2b53d963ca8e08999242d91078a8bc00f107a34cc0d2aa2b6
-
Filesize
1KB
MD57e40f5e4b5efd5dda70bf756a98ac8d4
SHA1838770370b9a7c2a44520e1496a52b03ce260629
SHA2563a20029b5abed0cb1a6de9d1addbb2cb3ad5648fddcb5b4cb9e4a66dc3a90263
SHA512240a1b362d6bf82d0e8cc5e4c9614e04e3526ce44a15e8215a48c5147152694090b132bce1aba728305afcc0284b8369caf12c908178e0399bd44ddced7396f2
-
Filesize
3KB
MD55dbf12fd78780c64beb7adeb16a6cdf9
SHA1d8a8fc433dac1dab50c8887c3f3f6ed83b008bec
SHA256d71129f88890e673cefc472667ac18f0e98a92ed48695aed94b554b538c11807
SHA5121414829411fce28328f8b09b57ebbca3025c17490ef833c2f01526ff445b2cf25d1dadeb2b4a52c8057fd5acb9158b3993ce5fad4fd36e4f64decf678e0bb491
-
Filesize
3KB
MD507f682f56bafd98cd0b78b948f32fb63
SHA19f6e2cb196df2ea3749f9d1f377de20435f24791
SHA256289bbbe4ec3b6ef5f418d52eeee2512800b2576fb66e89207c446349695954d4
SHA512c8f22f57fd38c34c53269f8b8eb9011471baa97aed83db3a7082d1e1312ceac60deb4c31b161e2dcea2241a9ff0ceadafb4beb32342790d23b409afc568fbf33
-
Filesize
1KB
MD5aa4238553d2ed26c73021359686b1cb2
SHA1e14f8be45c0fa3a445420d9865132c3fc5281fa1
SHA2569f795de97f11345ba27e33a1d576a1f526f7d129e658257c11629bd7a5e23886
SHA512c4bff8763338af4cae951a22a468ce0ab0c3a808d3717719a90f338997de839dde038b5c86af810a16dd94c71ab29b055564ab43b49d5a5b6c87a2aee8aeed78
-
Filesize
3KB
MD537fd8ec48b71916e407a3cb961718610
SHA1cf3ff1026fec3bfc8c0bf509178c1fad3d1496fa
SHA256e2de6c71d53717f0ec258133890e8d1cb2288ec860042ba2c447c2abb21d80a2
SHA51285a30df456b479d1908054cdd1dd3de2891b64eab55f7824b0dc00d88f7ae6d0355f5046e0ee48abfb5d21094fef23ae6cefb5be99ff86f0a11b7348b72af43f
-
Filesize
3KB
MD54ec6392c3e2bb3a0070143ed78e4739d
SHA16c0dd6485316ff00e9bbd8edce237a91ed2ef14f
SHA256bffb00f2555ddf8c83bb2a6eca70db69c885013d37f94f4ed84ee45daac13f56
SHA51291278579f4c2f7500830c35c8b5da7576662620dc53d7ee51788e730580d16859150413533513af2ab09058514cec34023469aeeac7187895c3a2bedb1f23305
-
Filesize
1KB
MD54f92139cd322a396d7e0d25e5d151301
SHA167f94e2990106d9481e78ae08356d7a4ec1737d1
SHA256f47afaacc544f681170b9d6ec201dd92d2a166966da9ea1274675b1a9d6c4b96
SHA512cf135d6a55e5744b905d2ab65d7d021133c353161a431a1026055632f0988e5760c7f0b334d17f3dd3ef1d98320efd207c36db1948adc00d2fa6035a172498dd
-
Filesize
3KB
MD575ea080d8bc100c57b5a3afb6fc3bdce
SHA16aa0bafd1759c41b9a8b04f8ba8bb5be45442812
SHA2562b66c6a394f11989cc6f43de711c050f6859aa486618071ea288a3673b2515a6
SHA512a08f677901f465c59d1832bc7f6398422baa63e70e270a570056d2a7796fbf19fe9e5213c0537b83fdf05fc18f5b4414e6df3984cd45dfaa2f27398589a3bd69
-
Filesize
3KB
MD52cb3cb6ab5ea5c33b219a54dd03a44a8
SHA1e66121cfa31af02ba9c8fc010433609662108ea6
SHA256a6342d9908f86c1753c158a88b89b9edd149e22323eb2fc7a6a7140e0ce12f11
SHA5120842728d01c264e9e87d9933460f50e2e3d3d8c7b06fe797ce2f9a66cd044ba75b3873c121c17fb9795a989666257554dd5ac33460885918656f91c1b3fd2ab3
-
Filesize
87B
MD5764bcd12f24f7fa8fa5887f720a19179
SHA15c8348269c4161726f49fe257f0bf1d9179489dd
SHA256d3cdda5c91a4998c77a697056ab5b3f23f44483de31714d3a069e4a67055c518
SHA512581d7c9076f036482ea5b116fbc179e402f2264239c1f118af3fc9c2914eb23583b770f3d9e6f8d03c9017ee24a3d88873d547bb0d200017de72121c41dec160
-
C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5afe4de1b92fc382.customDestinations-ms
Filesize15KB
MD57ae64f5cfee0454d43a4d8418b22b726
SHA1406dbbb491413044bf132aad4e3474f242e98aa1
SHA2566cff8e65bd01f301f361758d61c18c2ffba71283113c40cd2517ab3e991608cb
SHA5120884b957d3b560ca9c7d006c732676c355da7de662f52651f6072f2dc17dac9e380ca99ae20e5834991e10fbf9156b80634b6e983f9e8625ace31a164798bbf4
-
C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8RESG2XY72T4SR4IE4JE.temp
Filesize24B
MD56852e3a0bf1c01bb4dbfcb51c1a7c087
SHA1707c3647eec303e0801efdf2d4636b3d409f42b9
SHA25674d6d8c58d0beb0716eeecdc55366e193186924a616e057cd210f4104e5d85e9
SHA5120f3611602e82223cfe186acc3dc731642bd72e9ca38a903b832ce0b637d28006b899fd594264a2f067b341a3e9ae19a9c7f6136a9a9da5abcfe7dbcc27150378
-
C:\Users\TEMP.PSBQWFYT\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ST1NED6NP1F3ZTQ1Y04G.temp
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
140B
MD543732b12dc5e0c37046900fa2a1f0df8
SHA1dcaaf6b16847f4ff66788aa1416c137e62361d0f
SHA256e8e187d06caeb619b7a60d6fd4d1f4e9d70f5a232b02826ce3ebef56246f942b
SHA512578126bec9b73a8d55da85f4f9fd8d91b21c1b25314c706cfbd5efee5a869e85514423f0d437709c9888dc98fdd9f9778444430419d3316113d2b13540a458ed
-
Filesize
80B
MD53c106f431417240da12fd827323b7724
SHA12345cc77576f666b812b55ea7420b8d2c4d2a0b5
SHA256e469ed17b4b54595b335dc51817a52b81fcf13aad7b7b994626f84ec097c5d57
SHA512c7391b6b9c4e00494910303e8a6c4dca5a5fc0c461047ef95e3be1c8764928af344a29e2e7c92819174894b51ae0e69b5e11a9dc7cb093f984553d34d5e737bb
-
Filesize
174B
MD5d385184bf31315837b8da7d826bad53c
SHA1538f3096eeb3741a342e71319b388fab75e15c77
SHA256f37e0c0a499590762e35fe1ffd723638717bad807b2d47fdea0ce3f875fa4726
SHA512550f6a9c919d6e22aab8434605baeac45cd12d7c1069335d2ab01086df610231cd1ebece460e6298337ee06a7f5eec7ea84e8e3792578e198c3243cf59dc6cca
-
Filesize
92B
MD5beafa86203beefa0943fa75a59635415
SHA1a36cd01746cb0b076ff0d26d2b991d2c04cb6943
SHA256abab181ff99c3f50a4504f7ebefe710abc0e7f787076bbe734f5072a41de40ac
SHA512ec9280c5aad060903d42c0d68a7e01cce368ee5cc3c0728c27535ba3fdc37d9683c4a81c9c5ae0cc6ce1a9e32940cf0ca0f9110eb73077e953bd42390169f155
-
C:\Users\TEMP\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms
Filesize28KB
MD504a1ed3f6e446a68fc3ee7d5f043d393
SHA148cfc63883bf5f9e48d874bce775838941828322
SHA256e46f0b53dd983cc9e75b63209fa2453765b793fa123abf0f3b2965edfb57fa16
SHA512020642a9f057ffe9d47761ba6634eb0713e3603074888e75b6fbabf25a1f857b2523a638653ee8b56e09e970d8bd0b26cc23f370c54967eaa79acea43aeece53
-
Filesize
1.0MB
MD56e6e7d514c57322a491fce08c975f112
SHA1c5912584ba8ede2f2e6c506d8e18e0c5472bf9be
SHA25630b32fde78e60868e39a41dbfdc8f4e9b9b27736399d2d5a084925920e44811d
SHA5124fb60e3d00c1c98a9c1fd4eb807b323e34716c81f23ea971df8dd0de0e8e39c333022a4b4f412f84c8f0e4bfee1b3490d435e0c9abc3b5ad59079c73bd658573
-
Filesize
68KB
MD5063892156eca9289a83ff4495030794f
SHA1fd15ea591198b0f311fa32dfa9143020858953f3
SHA256550dd546acca1732706ddb203ef11395a9dece0e8495c81154fe82ac2b8850d9
SHA51262b346fba821007303422dc6d0dd09f647b76d0ae336b82b82fd536cd60620e4fdc2f9ed52f98758486af2e83cc152094abacad4698a4af56636c178983e7881
-
Filesize
2.0MB
MD5b3d817d4b6e07d81bcc8c6fbc3c96a9b
SHA105273468be5f432eb62897db04a8b8b18118c1c6
SHA256a8686f20453fa19d82bf30eaccff82a6fa80945ea4402c42c76fb6fcd5c0519e
SHA51253ee56afbc7d104bd610103c548f8476a2b1590d634f5d78762d06e2372c3b58d36cc0723901071585beb5496fe6db13ca422b4395ac2afecb2e62f5c7ce6290
-
Filesize
8KB
MD5e1146fa8f5b03dd47712955b9b867a3f
SHA16e1a0adae8f9bb1809e2c098f078b85f95ca32bf
SHA2560400cedaabd646705d092e73353c311821a42efb390acdf7c63a207bd12f1277
SHA512ccbb4e76709d09741e1ebef6a8be16341dc8f3c35e363c05ca2022071cefef52732b7a567ff165224f1415184db99ef959a72743980b683c9d2b7fd1f2fc579d
-
Filesize
2.0MB
MD5f3f175d4edf2bc0be936ead77153e1e8
SHA1675946924a8510d124a5a4b6fc6491050c828e30
SHA256a498dcb60845b3dbae5de806820edde86760ef83fe956595682313be11314001
SHA51272a80d0db4aa9fce25adf880b8bfc67245c942f6055462f38c0153af205e86f486c795d4ab3cce4fa6a0630c189a9c594900db1d2435fd58b95baba555abe1ee
-
Filesize
2.0MB
MD5588dbbe69a4e1f50e56287b3815c6c16
SHA1e68c909fb61597c18b865fff9f9520b49050e750
SHA25622211380df0e7ae5737e1e242b353b8c3ced842d78db8dfe7f1964a8c3563515
SHA51291fa9fd3906dc832b70d36e517d49a3824417c5623e35b798c4ef27bcae37ef76a67b4f88be038c9407b63fc914372566f70a19b1b5cb214e2ab9ac16908ab95
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
Filesize
24B
MD5b623140136560adaf3786e262c01676f
SHA17143c103e1d52c99eeaa3b11beb9f02d2c50ca3d
SHA256ee3e1212dbd47e058e30b119a92f853d3962558065fa3065ad5c1d47654c4140
SHA51268528a7eb0efd59bed8e77edbee80ec654ec3b8f58a82b1c8ce594dcd3aba07af28268aa83f161837f63ff4278068238aa294e0b5649a688db5a483314df6700
-
Filesize
24B
MD52034995f0bbaa16db835b462eb78152a
SHA1ce19b1a236f95307067d4979f8dd96c70d69c18a
SHA25662ce260f5e10fc17bf63faafa39912febf61d20fad51cc11606a295801743799
SHA5123427f74d944eaaf5a3e1dd22dc566c718be58e4ceb53ba414c72bca974136cac2f1cd8d0a2a0377ce3918c3f83b2480fffbd9088be135fe0fe48c5a499fa6759
-
Filesize
24KB
MD53006752a2bcfeda0f75d551ea656b2ef
SHA1b7198fc772be6d6261ed4e76aca3998e8f7a7bdb
SHA256dfd64231860c732dced3dc78627a7844a08d5d3e4cd253fd81186bae33cc368a
SHA5123fcfa7c8f46220852dc7efef5b29caba86825d0461a35559f26dbb2540c487b92059713f42fe1082a00a711d83216db012835673e1c54120ffa079e154950854
-
Filesize
3KB
MD5a828b8c496779bdb61fce06ba0d57c39
SHA12c0c1f9bc98e29bf7df8117be2acaf9fd6640eda
SHA256c952f470a428d5d61ed52fb05c0143258687081e1ad13cfe6ff58037b375364d
SHA512effc846e66548bd914ad530e9074afbd104fea885237e9b0f0f566bd535996041ec49fb97f4c326d12d9c896390b0e76c019b3ace5ffeb29d71d1b48e83cbaea
-
Filesize
1KB
MD5fb919bd0421e144a6387d428f21d00c2
SHA195428a6364361e20a8ae5aaf5d8f7dac36780859
SHA25628d45e3ce549ba441c4a3d390d87e7e47975ad1b0c3fb02f57f1777a01ee0511
SHA512dca83143d5509fdda69f3a22029ca9fdfedc31f490bafa469b88dd72ffafb4d194595e026e60364e4704b923973c35d4061c0aa868fcf4ccc6a40ce79074042e
-
Filesize
527B
MD513a03b674d60bea28e8913de86258da4
SHA15e2dba36599661ecfd007f0e341e674a59e5eb70
SHA256490ab622153dda333d8e876b22d2c5e442c279a8b0fc1eafe948a1e2a3850736
SHA512de3bcb7d99ce338c30a1cdf983f4192a148acf6982b0f59d2cfd7c116907ac1e8bcd3fab5f1ab5eb88ba6e85e64d227cf1a1316c7722851c826ab9c59ce544ea
-
Filesize
206B
MD5c2858b664c882dcce6042c40041f6108
SHA152eeaa0c7b9d17a8f56217f2ac912ba8fdc5041a
SHA256b4a6fb97b5e3f87bcd9fae49a9174e3f5b230a37767d7a70bf33d151702eff91
SHA51251522e67f426ba96495be5e7f8346e6bb32233a59810df2a3712ecd754a2b5d54d0049c8ea374bd4d20629500c3f68f40e4845f6bb236d6cca7d00da589b2260
-
Filesize
226B
MD5ad93eaac4ac4a095f8828f14790c1f8c
SHA1f84f24c4ca9d04485a0005770e3ef1ca30eede55
SHA256729111c923821a7ad0bb23d1a1dea03edbf503cd8b732e2d7eb36cf88eaa0cac
SHA512f561b98836233849c016227a3366fcf8449db662f21aecd4bd45eb988f6316212685ce7ce6e0461fb2604f664ed03a7847a237800d3cdca8ba23a41a49f68769
-
C:\Users\TEMP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
Filesize1KB
MD547b2e1c4ddd5fa161f4e7314222d7a29
SHA1f8e0a57ad324aa0ce6eafcbee54361cfc3fac7a4
SHA25620b9ba1869ed5d109962522c7c9a09e2675c457edd780f3723d33f9b40475772
SHA51207c8e9fcc6441c45540ced17802aea9fc84197733cc13af77516813c3beb346ae2748445ae99318309cbdc2da8e69e622dd91e658b7e9ba27d424eae6f5acf1b
-
C:\Users\TEMP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Filesize82B
MD51c61dc21f9b83172d65be1e94b79026f
SHA17324473ddda64b87c299bf6e3b9e9aff53f7fd74
SHA2568e920d7893b682a049f6a5097f880d915dc2d7bf8bc87ae558cd7f14466d5d1b
SHA5129660cde4d7606826c2fb6623460a2a286339970256e677c8abf8189fd1d58e0284c024bbf5c0bf539189dafa3e8d5269c1e0f7e3717891f2ae4771634731bbd8
-
C:\Users\TEMP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Filesize211B
MD5e5a8eb64419f6d85a1b7aed2152616c2
SHA1f5d94f8953bb235e35fccec0ea4f14ba69443081
SHA2565266b08d0c1bf229ec5eafdb6dae2a4849b6b394694d34033453cf8a379725a7
SHA5127c304bc842c81d3b5cff745d34b038a2a867063c65e502f4155439ba0642e8b0643f9b7254f74e85d5b150c134836b9e398a0dcb192550d97dfd431c3d93f1f6
-
Filesize
3KB
MD5d24c0f808cb15f3aa66ced77c248795f
SHA1653505bb3d34facfdf75456e11f0f2a4cace0c9e
SHA256af7d70d203560017ed1ed31a6d64f120e6abc7af09929e90e2ec3e9e1884cf60
SHA512c465d042688fb40d34a155d5bd955dd3bd122c8a2409238fe5357ceaca5eceac1848ad7e1506d422aa651dae68537beb5e99025df42b5aba9323158df85b5fd7
-
Filesize
3KB
MD5ad3d59b78daeb85f6a44c7748bfcccf0
SHA10bb9b4494139c590c8145f3ccf5b7901be242fda
SHA2561be9550dafae8cae1e46e0f60c0157673127fe50b0ca2d7a2ecfdcead32e13fe
SHA51201d4082ffb0def75e124371173144aae2efd3510721aa59b0620bfd15151423a503e3711ad4fd366967235411ce8835d0f190c78c95eb275e76de69d6c9150c5
-
Filesize
3KB
MD50100593d1f121cf9778f9f80f27dce88
SHA14dc87106195f18ba0104f1b0f775e405df9858a7
SHA256d755ca7d866c4d042c4bac4ab6117bf06f61247b054ba754a0b4fb0697c29703
SHA5124dc971128393f1bddcea2d1b08c5fba2bb57926c65801184000d0f1ec69b1fbf09c5bb91f4cb4afa5401be1ecb18cab66334eb19ea7cde1960572838bc24d648
-
Filesize
3KB
MD5734452fb83fec03668a135b701d3974a
SHA1b209a97e58a4167d3d7328a209119bce8cce6452
SHA2565c8a0a1e848408ea9509a4f081d49d91f37dd6962c577e8fcc90dfba04bd6ca1
SHA5128f465f13ab66ed2bfd8cdc5ab91b52bf7239cfec3179db29cc31ead1f923479a64b343c9c20814c979cae88a051faa7259116bbc557c184afb19b660ae94e232
-
Filesize
3KB
MD544258865f87eda94d445906af279b508
SHA12777e817ae7ee5b338352860dc10bda1ab2b1590
SHA25611dee7088f9b089d41b0e62c738bef81a199e38363bb29975a7c3394c0671d55
SHA512b0b35e67df6b72bf27d9f0dd705e0ba74b07b1ddf50b5b97782a4a6bbe2b35ca3d2e66e8f2596404d6b104e4485908bc66172318aa929a31f7499487058fea69
-
Filesize
3KB
MD59b95ab9fe60d6f1f0642e6af0e9ec654
SHA1be0fe7b9b2d7c7456e601d3c648c6b77d4647a3e
SHA2565ca919e0dd6b2f7e7f1a0ff621fb54d57ffe478a85f98a7a656afe1108b60114
SHA512aa0849c8ca9721df450d6fc2fc9c994da879970d385684c0c11fa175c2c6395e3717d83cef8755a1106c74db169c2b467988177c311d31e77be7ba7d04b2431b
-
Filesize
3KB
MD5eca086d7f3a7968c83bf850efe4cd125
SHA1fb714514722f078a5ec2e516af29c01304649faa
SHA256ee95c6da92610deeb33f1a305c7fcb4fe77addfb4faa7eb2379bb4cb89f60f45
SHA512bbbb81f39a068c14b98c8039db5654ebbf23203604a5b770fb737b957ba12e4af884142c1739de43239b9717042105cbcc791fd6740fee590c801424ac966d36
-
Filesize
3KB
MD53794e56c72a71397ad419c944bfd1e96
SHA1efc7a9dff954bbddacc2f484a0827ee07c67f52c
SHA256e282b00e1ef3d6b6d9bd7181ae40210e5b776dd35d7d325a7ec89d1b06d44e8b
SHA512b4669e5b39a6211377ac278ff29963be3b936e00bf2cbaa50c4c1e152f01599448f554476fd2ed2db4e33acc2ba2f19d97cc246fd87bf38ee92c554324936487
-
Filesize
151B
MD50ff56a4620c3221ff64ec61a3a0d3033
SHA13a45320be12b585dcdc5ab2af5ea1455b2c919a1
SHA2560b0a65accca705494739d03b6c2ea769c78cd0eee996bc95b0c6ebc0941f4b1a
SHA512962a340efeb6d18c85e5872997eebb83374e114be088689690ba438f0db8e2e4df6c24713a35cfaec518f58d5322cf9617638ea55ff279a9d161c4fdf9af74f6
-
Filesize
213B
MD55547a64ee3681b1fca07111e73dcc51a
SHA10b16a54ccb7c0284df649594e006ca96e07ac296
SHA256c6a3db953cc63f23aa5ff66de5fc6b483f6a1106cf1f77cbd73617b2c4340e0e
SHA51221a6b9b2c578ea8d0bfb22c1b37b0dde47395ec958fa5c73eafeb8b865080db132e565c7e8ce2ab1d2e934f414e23b820f3ff3571a7d737453f3ace76d11cc25
-
Filesize
274B
MD5453249f95d75eb5e450eb91fa755e1c8
SHA13e200e187e8cd21d3d1976ea0f7356626254de18
SHA25601bef150c18e377a57843965d55f18f0b5cb3fa867c5ab30f1e67eacd6ece48a
SHA5126125ffc1ab457bc1ba957c78c2a89ca54060c1969c4a981acf71025a1d79760159816d5fc36e351429de3bb5820e755b9bc22386f3d6892bfdf3da67d86f157c
-
Filesize
432B
MD5f107d0270e21a2fe91099fdc15918d44
SHA1dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
SHA256eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
SHA512b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
-
C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
Filesize738B
MD53a33faac6513738fd86f43dff8989882
SHA1afd4390e6b63c40e55ca08d27661a23d657b01a2
SHA25621a4315cbae2b0e8db633e86c344171da86f115bcbbb745680ff6f577668c910
SHA5128d7a47cba6b4d0da36151221c373625b67e44354b7cde41b5c3657e73a843b22a0a5b0bf92a4cbc32eac70b8292d674821085acf92bb58b94ea4542458c94b57
-
C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Filesize174B
MD5548b310fbc7a26d0b9da3a9f2d604a0c
SHA11e20c38b721dff06faa8aa69a69e616c228736c1
SHA256be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
SHA512fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
-
Filesize
1KB
MD5355790e5dfd7de026a78de197a49e7ca
SHA1a500b5e8e23fde0d5967bae6050a988f9961edf0
SHA25665691bc1e68d63e31bc71195fe16c72cb94632d6960bb2cb5c8065802883df09
SHA5123ae65ee5a3ece9161555116862db61fe0d362e7ce07991e4ccc4b89ee3ba853c46ea099bbee86a8467201516ecb6ab58b8e24f3e78d79919ac1b2dddf066236a
-
Filesize
174B
MD57f1698bab066b764a314a589d338daae
SHA1524abe4db03afef220a2cc96bf0428fd1b704342
SHA256cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
SHA5124f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
-
Filesize
174B
MD517d5d0735deaa1fb4b41a7c406763c0a
SHA1584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA256768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
SHA512a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
-
Filesize
338B
MD5e4e50dfa455b2cbe356dffdf7aa1fcaf
SHA1c58be9d954b5e2dd0e5efa23a0a3d95ab8119205
SHA2569284bd835c20f5da3f76bc1d8c591f970a74e62a7925422858e5b9fbec08b927
SHA512bef1fad5d4b97a65fec8c350fe663a443bc3f7406c12184c79068f9a635f13f9127f89c893e7a807f1258b45c84c1a4fc98f6bd6902f7b72b02b6ffbc7e37169
-
Filesize
174B
MD5a2d31a04bc38eeac22fca3e30508ba47
SHA19b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA2568e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
SHA512ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
-
Filesize
627KB
MD5da288dceaafd7c97f1b09c594eac7868
SHA1b433a6157cc21fc3258495928cd0ef4b487f99d3
SHA2566ea9f8468c76aa511a5b3cfc36fb212b86e7abd377f147042d2f25572bf206a2
SHA5129af8cb65ed6a46d4b3d673cea40809719772a7aaf4a165598dc850cd65afb6b156af1948aab80487404bb502a34bc2cce15c502c6526df2427756e2338626062
-
Filesize
432B
MD5eefa7f76ff11a5ec21bb777b798ac46c
SHA12e7a65ea8427d13a92ea159a5b8859ff99d2a836
SHA256840b46ed74821b5b61ca9ddc51a91cfe9151d11a494c89f183fadc02a78ac8ae
SHA512111301e33c0b33c154ffff274db5eb167de0ddb4e769cab9a2d9fcd2882e6192053149abbcb00d17ae5f7661bafecc1111aff2025c89d07b247633bbccb0e3ef
-
Filesize
412B
MD5449f2e76e519890a212814d96ce67d64
SHA1a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
SHA25648a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
SHA512c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
402B
MD5ecf88f261853fe08d58e2e903220da14
SHA1f72807a9e081906654ae196605e681d5938a2e6c
SHA256cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
SHA51282c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
-
Filesize
282B
MD53a37312509712d4e12d27240137ff377
SHA130ced927e23b584725cf16351394175a6d2a9577
SHA256b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
SHA512dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
-
Filesize
224B
MD587a61a68c2db9b094112d4f4290fb795
SHA11b5e6ec32415d010e5311caea31df96b0294fb65
SHA256e25a84c6e593a5bd6592eca920fbc126d3e96c8d80f2bb0b17a36e40ed42c1db
SHA512148411b6bd6133b17c3d192594338180846df638b9fd6bef7ddeb13c3858b3eab91940102349f2827ec69111adf7e506f4340b395928672180715798b4238919
-
Filesize
134B
MD5873c8643cbbfb8ff63731bc25ac9b18c
SHA1043cbc1b31b9988d8041c3d01f71ce3393911f69
SHA256c4ad21379c11da7943c605eadb22f6fc6f54b49783466f8c1f3ad371eb167466
SHA512356b13b22b7b1717ded0ae1272b07f1839184e839132f3ab891b5d84421e375d4fc45158c291b46a933254f463c52d92574ce6b15c1402dfb00ee5d0a74c9943
-
Filesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
Filesize
439B
MD55192bba9f8649f5ce279f693b2fbcbc2
SHA10dac581a6ac8f57797d08ecc5abbd29d4294a3c1
SHA256f6425800a18e290379561e4ca7ad5d3ae16c38d47384e927a67544983612971f
SHA512c8fbe4192cfa40489eba91d5689e7095e93fcc879f88523434971f5ad8afec1252859fc568f7e1a6d1e7c3286c0d076835e0774020573e4bafdf9cefa594fc7f
-
Filesize
846B
MD53518154475bfb2cc21bb7a4e4d30a8b8
SHA12505db68cdaa6950abe41c8db47a294b4dddc663
SHA256dc8c519a632f59102aa78b3263212dafbaf5342eef0545c1a5bd930c85e6f843
SHA512ed03f00b0c73ea601229d4b0baa3be156d5c1712977a17891ce1afdfc6da69df2c5621cc49bfc57d07c2a9d61344b73b8c7b26ea297e8b729d673bac9f766b3d
-
Filesize
363B
MD50025c3a7d7c4e90e58332958b00d83c4
SHA101dd4fdb260f66923004acb5a874111a9d14da38
SHA25636db348143da1b5c16b9074940e85761950ee30b533b7ca75924f2f4ef6b253b
SHA512b5631c94bad794541d16f2fa3a02018f4b34b680b63a9f3b6a3da4329216567a7ba9ceb8d4bd18165b0e55142f42e039f160ec675c0946237c276de1a6e642c4
-
Filesize
282B
MD598470d9bd7fba55a0c303065f9c4f9be
SHA15303b190e29ba48332f7c90a832ef08af5a1953d
SHA2563830022d5d7ef2ae2ca0a2b6ad73f0d4716b49bf7eeeaa87b618988d531b7c72
SHA512134e072c3600bbb3c724c2700da399a14ba5b907153969362b3dbff32c480d39e7f5ecceebc9122a5a27265410557a16eb6bf82c9b635b90ef1fa0ae9efb849c
-
Filesize
580B
MD5de8858093993987d123060097a2bad66
SHA10a89e87ba46538cb73aff1a47e4dc0bcfb4760d5
SHA2564c0d757717dec80eca8c6cbbfdda4706eb38fbbb7624933d5429dafc7bb9f0ec
SHA512fa348ac4025b599f460cb831338ce010dde8fba87587a6d078d6d594a30fee87ed112e412078c10604553f326cc7bd7627ae93b0e3d8a60cfeda0720cad29f4c
-
Filesize
504B
MD506e8f7e6ddd666dbd323f7d9210f91ae
SHA1883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA2568301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
SHA512f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
-
Filesize
504B
MD529eae335b77f438e05594d86a6ca22ff
SHA1d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA25688856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
SHA5125d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
-
Filesize
282B
MD5b441cf59b5a64f74ac3bed45be9fadfc
SHA13da72a52e451a26ca9a35611fa8716044a7c0bbc
SHA256e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
SHA512fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
-
Filesize
248B
MD50fa26b6c98419b5e7c00efffb5835612
SHA1d904d6683a548b03950d94da33cdfccbb55a9bc7
SHA2564094d158e3b0581ba433a46d0dce62f99d8c0fd1b50bb4d0517ddc0a4a1fde24
SHA512b80a6f2382f99ca75f3545375e30353ed4ccd93f1185f6a15dbe03d47056dad3feea652e09440774872f5cba5ef0db9c023c45e44a839827a4b40e60df9fd042
-
Filesize
248B
MD5b6acbeb59959aa5412a7565423ea7bab
SHA14905f02dbef69c830b807a32e9a4b6206bd01dc6
SHA25699653a38c445ae1d4c373ee672339fd47fd098e0d0ada5f0be70e3b2bf711d38
SHA5120058aa67ae9060cb708e34cb2e12cea851505694e328fd0aa6deba99f205afaffdf86af8119c65ada5a3c9b1f8b94923baa6454c2d5ab46a21257d145f9a8162
-
Filesize
278B
MD58e11566270550c575d6d2c695c5a4b1f
SHA1ae9645fad2107b5899f354c9144a4dfc33b66f9e
SHA2561dc14736f6b0e9b68059324321acc14e156cd3a2890466a23bf7abf365d6c704
SHA512a9fc4b17d75f85ae64315ba94570cb5317b5510c655d3d5c8fb44091ea37f31e431e99ed5308252897bdd93c34e771bf80f456c4873ef0aa58ca9bbb2e5ff7e0
-
Filesize
524B
MD5089d48a11bff0df720f1079f5dc58a83
SHA188f1c647378b5b22ebadb465dc80fcfd9e7b97c9
SHA256a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
SHA512f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
-
Filesize
504B
MD550a956778107a4272aae83c86ece77cb
SHA110bce7ea45077c0baab055e0602eef787dba735e
SHA256b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
SHA512d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
-
Filesize
40B
MD579654b38dfc0fe0212d55ad0f795ad01
SHA1f91a9ec6ff2f732b7c205c642812a66258875c85
SHA256304a8b7d3ab1548c7c49caac390576c502492602b518fe1c188f2c3dfced7af1
SHA5121cc3d5f5825d020efdc149d88b421bc8816fcc772c3b5dd90a3c275a63f999cdad6de97e6fd05d0d7f1498e28283c7799b5dc6113843c585090e6373f51808c2
-
Filesize
10B
MD553ba7faa722ca097a996ff26b810eed8
SHA19364cf73dc5a8e823d70271b89c94cba8fc58a1e
SHA256bb3101298d24dadbe4e929170a714df0c58cc89c9bc40170de6932dcbd263c8b
SHA512addb39423ed3b4d4daf2a9ff5f4f8d98e8475c0d91ba557c1e0799d012b8ac4772a92d86d980e35c466278bf9e8ffd9dc82be358217795ea489c650d9ea74448
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88