105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398

Analysis

max time kernel
112s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/09/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Size 146KB
Sample240915-ayd85swdkd
SHA256 105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398
MD5 a5f2eeb4c5cbb2c2ff3b103e304c4a37
SHA1 604025da6efc564ae2b3b92c33eb3a2995ca81a4
SHA512 96e766e4f3aefacada98a5336320db9d26c5d7d5d150125183e5415786b57d46b3383880910cfbdcd0928960d4abcaeba19c0854b0fb4a863391f0b13617bf4e
SSDEEP 1536:NzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDrZ5bKzpnSPyZxedH4UnFgDXv0R:eqJogYkcSNm9V7DmSPNHnFsvCT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\RCl10Ol9q.README.txt

Ransom Note

~~~ LockBit Black Ransomware Since 2024~~~ >>>> Your data are stolen and encrypted Price = 2000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: WERTYFG34A48MK4D6D525F3F372263313 + ID Number.README.txt >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

Renames multiple (10646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
928	8691.tmp

Executes dropped EXE 1 IoCs

pid	Process
928	8691.tmp

Loads dropped DLL 4 IoCs

pid	Process
3828	SearchHost.exe
3828	SearchHost.exe
3828	SearchHost.exe
3828	SearchHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-661032028-162657920-1226909816-1000\desktop.ini	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-661032028-162657920-1226909816-1000\desktop.ini	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPghbf0b8hbh2l3ocjog92nix0d.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP4b460lyuwnp_16pbx59rlf0ee.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP9989j3symkl16b_9xqqo6_znb.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\RCl10Ol9q.bmp"	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\RCl10Ol9q.bmp"	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
928	8691.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldExist.snippets.ps1xml	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaps.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluError_136x136.svg.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-150.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\ui-strings.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-64.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\PortalConnect.dll.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdadc.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Utilities.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\ExcelCapabilities.json	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\MarqueeSelection.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256_altform-unplated.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\it_get.svg.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\BlockDisable.rm.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\types\ISemanticColors.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LargeTile.scale-125.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Views\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-unplated_contrast-white.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\ui-strings.js.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-80_altform-lightunplated_contrast-white.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48_altform-unplated_contrast-white.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.RCl10Ol9q	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\RCl10Ol9q.README.txt	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardPreview.js	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.scale-200_contrast-white.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintSmallTile.scale-150.png	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8691.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	StartMenuExperienceHost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop\WallpaperStyle = "10"	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1022"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1022"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1055"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "9650"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1055"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1022"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1055"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "14874"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "15159"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "14874"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "9650"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9650"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "15159"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "14874"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "15159"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp
928	8691.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeDebugPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: 36	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeImpersonatePrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeIncBasePriorityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeIncreaseQuotaPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: 33	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeManageVolumePrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeProfSingleProcessPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeRestorePrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSystemProfilePrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeTakeOwnershipPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeShutdownPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeDebugPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeBackupPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
Token: SeSecurityPrivilege	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2132	StartMenuExperienceHost.exe
3828	SearchHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2372	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	87
PID 1392 wrote to memory of 2372	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	87
PID 4220 wrote to memory of 4952	4220	printfilterpipelinesvc.exe	91
PID 4220 wrote to memory of 4952	4220	printfilterpipelinesvc.exe	91
PID 1392 wrote to memory of 928	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	92
PID 1392 wrote to memory of 928	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	92
PID 1392 wrote to memory of 928	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	92
PID 1392 wrote to memory of 928	1392	105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe	92
PID 928 wrote to memory of 1456	928	8691.tmp	93
PID 928 wrote to memory of 1456	928	8691.tmp	93
PID 928 wrote to memory of 1456	928	8691.tmp	93

C:\Users\Admin\AppData\Local\Temp\105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
"C:\Users\Admin\AppData\Local\Temp\105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:2372
- C:\ProgramData\8691.tmp
  "C:\ProgramData\8691.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8691.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2132

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2128

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{6963CE1D-316B-43BC-894E-9C517949B64D}.xps" 133708342594770000
  2⤵
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

EEEEEEEEEEE

Path C:\$Recycle.Bin\S-1-5-21-661032028-162657920-1226909816-1000\EEEEEEEEEEE
Size 129B
SHA256 73b6d74d89c16b1773c434d574b201cf46586ec6f0e5a6d7859962a691720580
MD5 5adb34a66cfd3984f31474eb6f95b9bc
SHA1 8d92f2cebf5fbbd15288f7c613034e1bf8332892
SHA512 013146745fce52505b414b069c5c5bc11a422fb6ae115ad55701a469699a1a5cccb8c3e4bd6e2f9d0375b1eed32b4eba34b52edc69652acdb79ba8e0b3d7732d
MD5 SHA1 SHA512

Submit Download

oledb32r.dll.mui

Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
Size 47KB
SHA256 01d846651cd236f52898e227ebc3714c5db6f06c25a95de45311d4c78e6dc93e
MD5 e7d8aff8a096d40a32873b414f1e4b4b
SHA1 21dca4980ce1fe21ab53d2bec5af9d77af782418
SHA512 00bcb27185020bfc4db049ab7f101642c82a5745058c6e63fe5708e1e802c992233baef8732bae7f4555285742d81133720c4a6d291779c6bcef82e0d8c35fc0
SSDEEP 768:dcuCrjrKWj7+s1vKa3WH8IZyeqmCHp92BWnJ0XRWSG9/6K1oVOL/X7VOCZJ3zz5o:uuCr3K4/JJM8QYmep+yJSU6OpOCZJj6R
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqloledb.rll.mui

Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
Size 43KB
SHA256 770a0a662a0d435aa0082b5dd060011c0dcd30e285c557fb07b7d634d018840e
MD5 a55c8673ff64469abe13a320d3c43a6c
SHA1 43cec407adad27814ed7c5e3aa178e6df83dbedc
SHA512 fdcdc8e3bb5b05e288ebc28f15879b94373ccb28896d35e0fca4b5391a49d0fb656b7b80a9fd462a62768f1c4dfa8bc69fa49e57d880d124a86ab8df1ef49c8b
SSDEEP 768:gls1x9v7MhhGbhHVg2ocgooniWIAu+V1fTuyyXe3ClO+U/9zGTpwWcATxMk7dSPV:glWBHaevAnSvXe3CLmYTDTx6PV
MD5 SHA1 SHA512 SSDEEP

Submit Download

msader15.dll.mui

Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
Size 17KB
SHA256 edddcda06a5a44aff87f687358d3d9fbb6e8c2e7d268ee857bc8ff967c26ad8f
MD5 92a7490842348039bd63343985ad6ab0
SHA1 2ec785db0e19271687e09f3af283dcdde08fe6b3
SHA512 1a61780bf046515dd42200b78739327b8ac98aa6e5208937aed7107b6799efbbce03141c40fea2026f6f415ac3773f9e4e637a3bc9d4fdc8d37e06b427be5887
SSDEEP 384:g5AYh0GuL8e0EulYoTzu08JG9i8A35O6oG24LR4PKzFwCh5IIGH:g5AYh0GuL8/EuCoTzu0N9iVg9GH14SZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wab32res.dll.mui

Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
Size 92KB
SHA256 5604cd3ae7edfbd11341dd0b7a38c3128ac01027befb293d136fa9304906aa5f
MD5 1c9f9253cc45f8eaaba83e861197320e
SHA1 f6ad6b07fce9846a6f5798df618d6b7b412ddbbe
SHA512 7898ae5c5c62afbec5bed7a62dff30b221d915cc10440acad025ed3cf8ad0db4e217c1c7a569ff87bd5465eec2d4e0c1f14fc06d5800c77b0f4ab9554c733a4e
SSDEEP 1536:H/fgk9GnrnVsXDnZv590uxJC1+NeV7+1GBV2KC4klPU2TvTQB:HXg9rnVulQuLCowVNLC4kNUorQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

msadcer.dll.mui

Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
Size 10KB
SHA256 fb39ad8b5d35161423080e97c6632bda26fcf2bcc35ca5454ada623bd434bc05
MD5 63f6d38f8dab943b4727b45a0005c413
SHA1 e2c6a4518ac8a1be185ffa28181d3e090b9cc62a
SHA512 3050b03ec4decc33df8a0195c3cf1505b1c9c1da3759de602e521c92b28ef122ff482bd1a58fe631f7566480f6dba88536076e2eaa1a29e355dea2b3a4c46076
SSDEEP 192:2sZIzA3rsMLP+3AbuSkD/N6Ao0Slybvkf7ERXt/wRZnQPNmdjRdDJt:xIcrsMLPKeurFtTkDERXmRZGQjr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdaprsr.dll.mui

Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
Size 7KB
SHA256 652830dc5991285c5f9fd94ffd1fafe04910566793ebab22456b96086c1da6ba
MD5 6580bc63781e48e211ab6fdde6d2d348
SHA1 92b0aa10689a9f81aa1b3c61a068d68c66aab6a4
SHA512 612623eb2db523edfcfbbfcc3fbbf1454e759efc7ef68a7c5ab4e7c2ab68e125387294f2f3ce46f96f3a8d34a21f1e9ecfac149cef55a6d48bb22c834befab37
SSDEEP 96:Uo8HqIKxlf/EVV9gGz4IKxN96SK5y2U1mD1ecPENdcwyWJ65Ga6m1X1uqsNReR6P:UfzKX8Rgc47LWg2SDEEVJMhdgqsNJEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

InkObj.dll.mui

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui
Size 5KB
SHA256 c58ee3ab4247214aea3498fbcbf61d1818351f27e3c9957e8751274ac6928307
MD5 0658653af95cee23ef3d23f4de5ee05d
SHA1 4928f57cb070050d5816c122faea6763e1bdbf4d
SHA512 dc004967f056c8abeb75dbc674b43d2df191c9aca70197f32db16ac4bdeda73729c13a108150a14ce33c57c116804d4a84171a425352e2804844d0635b857cb9
SSDEEP 96:MtSISBXIf1dMFBJAw5n9WiN8fzvE7iI83S9Xj7ac8BRb7ibqMGXPJ/67D2R:eSIkXVu29EsGs7acGmbqMUPJ/2o
MD5 SHA1 SHA512 SSDEEP

Submit Download

TipRes.dll.mui

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui
Size 24KB
SHA256 1d1b156ae1d5d9d03dc90af44244bf57e242ef75c056cace0c3fb6e34c957cbd
MD5 824c218776391149407cdfcd458f20d8
SHA1 4d4f3686952a055923833bdd3849c7d503adae97
SHA512 382f71e7e98520d11b6991aa8c1dd45a9ea10c2cb3a509d1af3bb11bad64108a7df03e5f6cc3771b945bd6227b96a32590ea9f70d52e40bc447f00fa43e92a19
SSDEEP 384:mAYXw7gWm/YfnoSKmhXfkqLQZpKgXEEweheG/OpJEzJv5FxJfwNBOAe/G2L:mZXwgWRAS5LQfNweVAGvPx5wmO2L
MD5 SHA1 SHA512 SSDEEP

Submit Download

TipTsf.dll.mui

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui
Size 3KB
SHA256 d0845cbc51797b8c9f9ef6339777e6182dbcf4eb682d60bb47f869a395b33c1a
MD5 30cb46f3a44d78693a2611688f0fb96f
SHA1 13ff6a77d748933a193b9581a64d2b0be688e748
SHA512 275079bf12d0fc5dd3adaf3d004b7627dfa716e981fa2189a58064aeedf5fd27dc07a39a0603ae2152aaf467da2361c5db261ee0ed4f14c0d21d9b11b00f4db5
MD5 SHA1 SHA512

Submit Download

micaut.dll.mui

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui
Size 9KB
SHA256 e10f28372f89bdc9811cc801bf70b6f1876fa494cb92dcba5fb8205ce6be68d1
MD5 c7850422b72c1d52957dad5531f2dc28
SHA1 388768af674a5e9a0d7d22ea8d228c00f0096a56
SHA512 eece1ab06c554bf0fd57e01a432c8060590822cb09ec99de5a9f5acbc389d7f395b9ef551e27b8eb58657315b99683136814a62a0070c03c76daea67cce8a175
SSDEEP 192:/mQOEsXoHm6sCdcy+x9+gzkPn479OIbeWf2MMwBDjidOAcY9AyTuAaioy/IV:rOEMoHGCdcj9+Ykg79nrf2TwhjidOAij
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtscom.dll.mui

Path C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui
Size 3KB
SHA256 bf5a64b89b0c54c6f8ac01eac9678217d6441e64c30f0a1e0d265a277cd69f1c
MD5 7a95d60251b2fef98790fc39746a46ce
SHA1 bd6bb802f58fdc9cb5abc779a34a4f876c486675
SHA512 c936010512b4e74a201ea0fa95d42b7ea42341ab89d8ac574d800f7f7d00ee4619df0882a28e0115f156e80d8b4aec9e8c9ad402dcb394c31d6bc7f509b49267
MD5 SHA1 SHA512

Submit Download

iexplore.exe.mui

Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
Size 5KB
SHA256 a19d79eaffb20d919418a8db220557a430da1606c8d83f9df497d5ecffa92718
MD5 b8d0d856cc37558f9963fcf76d9b0278
SHA1 a10d106c69a15ba792bcd07146752bf7c903e4c3
SHA512 70dc21d8ad2baa5a934f4c0205fa94bb2d22ae2861bae46f5f330fe6c78e1be1fd558c666243c0e5e0f80d92b61edea4d53e31556f5372f89ae3a93dbc8fabd2
SSDEEP 96:HzfDWeS8SvUoQ/wVPiuIUgoGMO1pTTvvWJRVDECd2xTR/7R2uslouFiB0qnVJGy3:HzfjS5vDQ4V6uIU/gpTzSPDnWTR/F2u9
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMPMediaSharing.dll.mui

Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
Size 3KB
SHA256 bea10bc1fd639d4dba282bba82fbbcef4f10f12e98301134c9a4ce042cd0657a
MD5 5997886d68f951b65eb56819ca55d745
SHA1 93270ba742953d5c9eef994ada4196cc532865eb
SHA512 4dd43e11b6db6e85b57e9046ef3729a9845c63f4e87ffad9694be301ce2c0db8235ba37270dab55a2c36332a747bc4a1b75aff57d9432e0296b1664953760c6e
MD5 SHA1 SHA512

Submit Download

mpvis.dll.mui

Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
Size 3KB
SHA256 2cce689a0382e12c1833a8b03c96d219f4d8004da3c9f9ab9f77b7ab407c243a
MD5 cc4487ad92c9947e93a9accce70ef912
SHA1 eb2d8a7989d890190070509e0533dfdbb8bdeb50
SHA512 a411efceba01af5651271b017b2ad5c1e5d28f03aab1812d90962f0afe3001679ba89e77744f837a0052c37aa04dc117e66c21c39762821dccf8e46eb91781cd
MD5 SHA1 SHA512

Submit Download

setup_wm.exe.mui

Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
Size 53KB
SHA256 cc4a298d8cfbcf46de165a90cdff3a376b35a6f7ebb60032cd51d3ad959276b5
MD5 9836c992a197016238a266e13e1353c7
SHA1 385bd95fa37f035272b4a788db06827d9c368592
SHA512 878b9a2cc81f152a1528c4b53350de53da15ae6ece454720a7aa7a2c84a951eb42b063b9ce44e96aaef85d47d104d7e64c2d9efb764e644d49e81cbd4b8f786d
SSDEEP 1536:/YTYlg0p5FMa8ufwZDBIrsXTdVdGOXJIzJe:wTWgs5SufwZDDXTxGPJe
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmplayer.exe.mui

Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
Size 3KB
SHA256 e15c328397e97615034179b6abb466bcf6d7b40316b16633b5caefce42f5e938
MD5 38dcad1b9f1aa4d7deb629d1f3a216b6
SHA1 d38913f1d7720cd3b20d736cc47ff87de48ddf37
SHA512 6266152218c3cd6112c6f4472f594eb282cc80012c0ed9a4bda74b8876673c054f37ae31866f509a5aeee55b86f44b42f6ebd483fcbca131b8b6adc0606d925c
MD5 SHA1 SHA512

Submit Download

wmpnssci.dll.mui

Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
Size 4KB
SHA256 5fbabffbad29a1a30497c5f0af2d4d809b9e2c54109f724b7de44a46862381d7
MD5 af8bc358e077a738e8a4b7f6eb72041e
SHA1 de0e797d2ff11be7992800d2d95a110b0e6cda4f
SHA512 5daa91130a375aaa258436d354fc674725ca19a2e56ac7e06169d08a325713d83e731d9b57373697b00a0f363bce7e4d393862be8d5032bb63dfc5c78007f959
SSDEEP 96:2OHbbJPz/RFgRHHu8lJR4rmJ00AwwGnfFIBXGgRrXlsABfabf8n59GYmR:2OHFAs8l4qJ0ngOr1sARXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnssui.dll.mui

Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
Size 3KB
SHA256 c6884333eba83b13f4ec42dbba11032d806b9415aff6cc9d6c8022d3e0f4afad
MD5 b5e09acabe7feeaa56cf5bd51903f5ac
SHA1 c2c4cf0d896d5ffffcbc6bd5989c70de8e330a28
SHA512 c965bcb34437a81d9d72d818dbcb8e827347a8cb81546511fcd7d9717f5603dce1b3005b72aa2163d008f3713ff55887e4dc2233e0d251eb6b13e1702fc4d91f
MD5 SHA1 SHA512

Submit Download

wordpad.exe.mui

Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
Size 49KB
SHA256 ca72dfa68e238181d83101e4754985069577e06963baf07c2995ab94ac6bf656
MD5 cf9a6bcfb4ad71ac89e3a42a5c4c00d5
SHA1 0a7f17cc46a81ce9f02be0b0e4f6cd0a6da12ffa
SHA512 177ef3aa5d2665723ace774d725c3b6b8d2c1a38492db92f5bc41ffe0901e760cd5d08265bd237611fb3e626969314b57310741000d3315df611de830fb7bb01
SSDEEP 768:DYPPUf3sv3Up6FCBqI3BicwmTgzoTtVOHrYlfgnrH0f2OOCyRW:qPUf3ss64hUcwmIoTCHrYlfgnrH0RVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TableTextService.dll.mui

Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
Size 8KB
SHA256 19066910c2f6c4c91f45d606e69083b61843de931fc3eb34924e5c83a533d101
MD5 c02ebaeeb1e5b44b323eb253325ac6f5
SHA1 8843bb0f4106929ab898fc14010b40834ced3bae
SHA512 8cf2fa906ca1ebbfdc1d30578559b3c68c1cd0007e41d50bacbc55c8ffae71ca2d20511718e9f7960df2b486d98cb2dbe1528c4a903373f0f61f477bc2c690bc
SSDEEP 192:3BE7QLoBChelDcgEz8jwtPpNl8yAB+TSlWyNkqa5g9:R4QfehcxzamF8yAwCpNkqa5S
MD5 SHA1 SHA512 SSDEEP

Submit Download

PhotoViewer.dll.mui

Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
Size 16KB
SHA256 2246ca61eea1c587e46feb63b1a3219bc572772fe19342f1b46001f98c89c4e9
MD5 e09886a8e4a14cd7085d2d53a8acbcba
SHA1 9cf71e6727b614aeeb0eae41281c701ae3b52d51
SHA512 cec7c1be0dc6a59788b021245d8e06c62f8436433e23c22bf41018d5b9c19731b2a9e467e985d08b330541466e4e9d68946e027a49e7417cc7c3e466d70e9096
SSDEEP 384:YWvxQ1+cnk7MAzOguIKdq5wYUE0+cnte9mpDdiu:JZWcMAzxKP+cnhpDdiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140_app.dll

Path C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll
Size 555KB
SHA256 e2d7fa8b60d6fcf8d9afe7d50fdd6f6f3b5d3202e86635db01b6d732e8107e33
MD5 5bc57b8e2e7590349002ac62bfb8e6f8
SHA1 7e53a7774c3cc0a204fa1cab0004869e78b2814a
SHA512 e4e1ba330a9967582339a232b7d73c5be2758f763d9f582c55f583c22a43c044db2197939cc67c670577299bde9df1f6485e8b5c3fc438301d103fa23aa66c66
SSDEEP 12288:Rc7+dvotIRN0coCwpdkX7w7k5FtUtOLgmSxQQEKZm+jWodEEV0838g:Rc8tUQkQQEKZm+jWodEE68sg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vccorlib140_app.dll

Path C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
Size 319KB
SHA256 7abf4f426525438d6a14b2b653c1ba5c5eea8af774707a47b1c9d7e44156ebde
MD5 57c7b0a94744ce6523e9d5b3d87cf046
SHA1 9859cbdc1a458bcf9315d0d65ed2cdc562edda46
SHA512 83a825effcc66ff29d1a15e9b9ba84d0a3b130a06eefe91df38b22b49c9259f98e8059c18e7e36eb52055c5627a4d7eaf64133ee1bcc482c3ab09f8388826c38
SSDEEP 6144:LAuA0rqo8rz58u233KHtdZ/HMjxJVn+sPCO:8OrMrzPW0tQn/6O
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1_app.dll

Path C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll
Size 35KB
SHA256 6db75fdc6cbb380ee2644ae09f57378c761568b10912db6baa069f0fbf482f1a
MD5 c19bc1a54b8ea1fd0241b4a8827851b8
SHA1 5f3b45c5f073d3583c6d70765d7b392554d4431c
SHA512 03f88f279b2e778bf68a34bf45e0e6d8dda48d0e7b0077e953f3bac6f169628a20786a9a9e2b1ca2e3e588d989cc9971336ea5b526058bcf535fba0837a4720e
SSDEEP 768:oZ7h6GETAVEi++Q2SvvT6VzAqq4ZqECsIgpyu:oZ7DG3x2S2VzAqqDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_app.dll

Path C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll
Size 92KB
SHA256 3c850de2119d6311dff3e575797a476011d8272007d7dc82ae47771c9811d2a4
MD5 2580290b1e5712b0fefc38a6ff06e115
SHA1 1ce764c2d902db219bc764ed964cc234e3aa337a
SHA512 3101d88490dcf8717c504f7b791a236ba366060433aeb12d1b1d80b01bfe3b264ea787901a32ef6ec19c5e9be576bb0b19ef9ff15177644d05f6e2d80c3e28ce
SSDEEP 1536:MQmiwGUoqPadggR1NtpDPa3V+y4FpQXAb2WiRAecbfoyt1PPG2:HxKm/TDOtQb2W8Aecbwyt1PPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

8691.tmp

Path C:\ProgramData\8691.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCl10Ol9q.README.txt

Path C:\RCl10Ol9q.README.txt
Size 1KB
SHA256 ce7e57b1ee943eeb6ec10d4556da9b16f2cb02401109d60590bb8f78ddbde478
MD5 6c20c5b93268232ba3bcb18e6dd215af
SHA1 2008645dde0884ad7bed5732a4005968472e7ca2
SHA512 4a2465070eff7a0e3d99fe137634f2a7768f5df383f4b10fb00f214c40f4843e0712c117c1b0e422ce7650d3ae04e5d1b4993b7029f3007a52fb68e408a1346c
MD5 SHA1 SHA512

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 14KB
SHA256 34a46763c6e611a919964cd7b518935308220cc995931f30c9556caee23f4c82
MD5 22cdbc7a1ef3b83b5401a82b74adc38f
SHA1 f2242156eef5caf483e4a00ac4491a29acb003d5
SHA512 609b3213196176edfb246cd8ebd914bd9d348e0d5cc815e4c1757c8138feffb373e8e909269bc1b25f7ab61e051c5a7fa8448e9cab2e4909ff46ff79954971be
SSDEEP 192:TJAFJnMU/9oBiV7vi12YJDtkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1E4:TJWJpq12kDtuJ6pmXmlJVjeQ8RJoewB
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 17KB
SHA256 d0d012478f51a621689124f2bb212e28bc1404027861c8f6724efa371e90fce2
MD5 b3e27e4d949a384acf9bf4d49f6f0bb3
SHA1 e5dae6ba2e1d639ddcbf8ecd343561aebe46ba2a
SHA512 75760c9014eb5f4e95776cabbf564613a0ff27417fe4f286ab84f783d3ea2a71758e552cec583d4d75f33d74d96df76f3269e348387e501dd086b8d1b18873e7
SSDEEP 192:9JAFJnMU/9oBiV7vi12YJ8tkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo15v:9JWJpq12k8tuJ6pmXmlJVjeQ8RJoLw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6TE31N54\www.bing[1].xml
Size 2KB
SHA256 510dd19bfa96cbc550fc6f76b14c2186afa6cfa5e7afc4f176d66ea6634b2e29
MD5 b142e664948180b1f992208f5c9b8de9
SHA1 62b3e2e909585de6434754f0e0d49d643d31a651
SHA512 2fd1198d5ab66a5eabdc2a45f36a75f193404b0d65e77d8a5213c631b80ea58094adbfe4097b20aaca38b7e34460ee3655687ade9eab1262c3d538b779a72376
MD5 SHA1 SHA512

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6TE31N54\www.bing[1].xml
Size 19KB
SHA256 ad801dd8767b76e9d6895a2fa542cefa5e8c52e143bb4e526ee6781a4561322a
MD5 5cf4e6060bae419911312a172e813234
SHA1 f064ed712b8c1e529296a404438c62ed9ff52fc7
SHA512 9ffad954df295b27322f13f5aacb259b54ca8f83b7d592f9cac9fef47be20b44a5c10962764ed8ec88eebf3adbf4cd61a3996e3d7f6338607b6f267666ca8b54
SSDEEP 384:Afz+HQfz3YZ52dS8mkfFlAADAx5rMFM1ij9DnHZKCcX5UBayLmjtaBWwEtKUBDBi:AfzIQfzoZ52c8m+FOAMx5AtvQu+8aht2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 10KB
SHA256 cf338db863dd86bfcb7f14b5d6f511488b97fbb6ea9bffa88ca9d5576c89e517
MD5 0883bd5c463c5ae57e3cd84e8f2adcb7
SHA1 376330e45c799379d3649de596635cbe499f99cd
SHA512 ae2b641d2372c34d817a0f67d649dd723fa02354d930571191380ecc6ca3d6ad69b7d8dbe8e4b7f64db2d42d098d48f3f8f8f1ef20b07a174594eadd0fd51425
SSDEEP 192:NJAFJr9oBiV7vi12YJrtkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1oPPaO:NJWJVq12krtuJ6pmXmlJVjeQ8RJomPP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 11KB
SHA256 88b4cb4348ca01951fe9712ef654ff9e94ae652b056175955901b22dbc0b18a1
MD5 43be0474482b1788a61d3e48f589d11f
SHA1 401ee31aa5f53bbb0dbdbdc2f36508f360198e63
SHA512 1f20d66481ecf07e663c874fff5a22b7184f4721e33545f105c022403f4a8f7ff45ee720ec6c952376f41075a7b0b13003ce1f4c2a136eb971547ebba14538c4
SSDEEP 192:8JAFJr9oBiV7vi12YJrtkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1oPBae:8JWJVq12krtuJ6pmXmlJVjeQ8RJomPBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SettingsCache.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
Size 846KB
SHA256 9111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
MD5 766f5efd9efca73b6dfd0fb3d648639f
SHA1 71928a29c3affb9715d92542ef4cf3472e7931fe
SHA512 1d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
SSDEEP 6144:ihaEEDPDnLcCG+aYvRvX7Exc8Mk9RZ8o79FYgGKfHX+nEON1cKXKFYg3uq0qWYGv:ihJW7Exc8BFYgGKfHX+nEON1cKX6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

Path C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Size 146KB
SHA256 4c4de3695174894f651fefb45751b0c733af99bf4fe4ddfeefd4e037227ab0c5
MD5 d93cc0ed554fbc743e67aed7b5d506bf
SHA1 4d26c0f97400b1adc4f33a65baaba1b927062521
SHA512 981f33477e346208ad75554374a732775ec2f38ee37ad93df6218d8a33b04b9ba465694d0f2ce96f5f99c5c10db1c087dbd318f05c545aa3e9462cc83d35f0fe
SSDEEP 3072:izV/PVhWuFGYarZtS6fuFVsOrCbzV/PVhWuFGYarZtS6fuFVsOrCbzV/PVhWuFGR:iFJFNarKE+VsRbFJFNarKE+VsRbFJFNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-661032028-162657920-1226909816-1000\DDDDDDDDDDD
Size 129B
SHA256 68218650056038cb5ec9d4f3dcbbf1c6a6ee8d8d4040231f13b12ed418548a5f
MD5 18487ef850a7c227d0602609208f5103
SHA1 81743b839afadcdfc669a127ee14bedea827a24f
SHA512 9aab59f4a303c9ee70091582986236756af844aba063e98e871931e919a410e383c3c94459791df6a893233abe0815edf2b4a5a6006cfaadbd40d48c2deb17ca
MD5 SHA1 SHA512

Submit Download

memory/1392-9987-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/1392-1-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/1392-2-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/1392-0-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/1392-8050-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/1392-9071-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Download

memory/2132-6235-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6241-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6148-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6144-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6236-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6237-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6238-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6240-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6239-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/2132-6149-0x000001BDC9780000-0x000001BDC9781000-memory.dmp

Download

memory/3828-21384-0x000001E43C980000-0x000001E43C9A0000-memory.dmp

Download

memory/3828-21397-0x000001E43C860000-0x000001E43C880000-memory.dmp

Download

memory/3828-21398-0x000001E43C7E0000-0x000001E43C800000-memory.dmp

Download

memory/3828-21495-0x000001E450CE0000-0x000001E450DE0000-memory.dmp

Download

memory/3828-21385-0x000001E43C9C0000-0x000001E43CAC0000-memory.dmp

Download

memory/3828-21353-0x000001E42B6F0000-0x000001E42B7F0000-memory.dmp

Download

memory/3828-21352-0x000001E43BE00000-0x000001E43BF00000-memory.dmp

Download

memory/3828-21357-0x000001E43C680000-0x000001E43C780000-memory.dmp

Download