Overview
overview
10Static
static
10Remouse.Mi...cg.exe
windows11-21h2-x64
3SecuriteIn...dE.exe
windows11-21h2-x64
10SecuriteIn...ee.dll
windows11-21h2-x64
10SecurityTa...up.exe
windows11-21h2-x64
4Treasure.V...ox.exe
windows11-21h2-x64
3VyprVPN.exe
windows11-21h2-x64
10WSHSetup[1].exe
windows11-21h2-x64
3Yard.dll
windows11-21h2-x64
10b2bd3de3e5...2).exe
windows11-21h2-x64
10b2bd3de3e5...3).dll
windows11-21h2-x64
10b2bd3de3e5...4).dll
windows11-21h2-x64
10cd9ccf8681...f7.exe
windows11-21h2-x64
10cobaltstri...de.exe
windows11-21h2-x64
10default.exe
windows11-21h2-x64
10ec4f09f82d...d3.exe
windows11-21h2-x64
10efd97b1038...ea4.js
windows11-21h2-x64
3emotet_exe...04.exe
windows11-21h2-x64
10emotet_exe...23.exe
windows11-21h2-x64
10eupdate.exe
windows11-21h2-x64
7f4f47c67be...3f.exe
windows11-21h2-x64
10fb5d110ced...9c.exe
windows11-21h2-x64
6fee15285c3...35.exe
windows11-21h2-x64
10file(1).exe
windows11-21h2-x64
1file.exe
windows11-21h2-x64
7gjMEi6eG.exe
windows11-21h2-x64
10good.exe
windows11-21h2-x64
5hyundai st...1).exe
windows11-21h2-x64
10hyundai st...10.exe
windows11-21h2-x64
10infected d...er.exe
windows11-21h2-x64
10inps_979.xls
windows11-21h2-x64
1jar.jar
windows11-21h2-x64
10june9.dll
windows11-21h2-x64
10Resubmissions
01/04/2025, 21:24
250401-z8184awycs 10Analysis
-
max time kernel
588s -
max time network
540s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/12/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
SecurityTaskManager_Setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
VyprVPN.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
WSHSetup[1].exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Yard.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (3).dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (4).dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
cobaltstrike_shellcode.exe
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
default.exe
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
eupdate.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
file(1).exe
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
file.exe
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
gjMEi6eG.exe
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
good.exe
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
hyundai steel-pipe- job 8010.exe
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
inps_979.xls
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
jar.jar
Resource
win11-20241007-en
General
-
Target
default.exe
-
Size
211KB
-
MD5
f42abb7569dbc2ff5faa7e078cb71476
-
SHA1
04530a6165fc29ab536bab1be16f6b87c46288e6
-
SHA256
516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
-
SHA512
3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af
-
SSDEEP
6144:zia1vcaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+:zHctWvVSAx4DQFu/U3buRKlemZ9DnGAn
Malware Config
Extracted
C:\Program Files\dotnet\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Buran family
-
Detects Zeppelin payload 15 IoCs
resource yara_rule behavioral14/memory/1104-12-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/files/0x0004000000025b2c-20.dat family_zeppelin behavioral14/memory/1104-43-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/3288-44-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/4988-45-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/1104-3561-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/1392-10730-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/2972-11700-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/3288-13633-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/1392-17018-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/3348-18380-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/3348-21964-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/1392-21965-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin behavioral14/memory/3288-21968-0x0000000000540000-0x0000000000680000-memory.dmp family_zeppelin behavioral14/memory/1104-21969-0x00000000009A0000-0x0000000000AE0000-memory.dmp family_zeppelin -
Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
-
Zeppelin family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (6069) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 4996 notepad.exe -
Executes dropped EXE 3 IoCs
pid Process 3288 spoolsv.exe 3348 spoolsv.exe 2972 spoolsv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\spoolsv.exe\" -start" default.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: spoolsv.exe File opened (read-only) \??\V: spoolsv.exe File opened (read-only) \??\L: spoolsv.exe File opened (read-only) \??\Z: default.exe File opened (read-only) \??\E: default.exe File opened (read-only) \??\Y: spoolsv.exe File opened (read-only) \??\X: spoolsv.exe File opened (read-only) \??\N: spoolsv.exe File opened (read-only) \??\I: spoolsv.exe File opened (read-only) \??\L: default.exe File opened (read-only) \??\J: default.exe File opened (read-only) \??\Q: default.exe File opened (read-only) \??\B: default.exe File opened (read-only) \??\K: spoolsv.exe File opened (read-only) \??\H: spoolsv.exe File opened (read-only) \??\Y: default.exe File opened (read-only) \??\S: default.exe File opened (read-only) \??\P: spoolsv.exe File opened (read-only) \??\J: spoolsv.exe File opened (read-only) \??\I: default.exe File opened (read-only) \??\Q: spoolsv.exe File opened (read-only) \??\O: default.exe File opened (read-only) \??\A: default.exe File opened (read-only) \??\R: spoolsv.exe File opened (read-only) \??\G: spoolsv.exe File opened (read-only) \??\E: spoolsv.exe File opened (read-only) \??\B: spoolsv.exe File opened (read-only) \??\W: default.exe File opened (read-only) \??\U: default.exe File opened (read-only) \??\S: spoolsv.exe File opened (read-only) \??\A: spoolsv.exe File opened (read-only) \??\R: default.exe File opened (read-only) \??\P: default.exe File opened (read-only) \??\H: default.exe File opened (read-only) \??\G: default.exe File opened (read-only) \??\U: spoolsv.exe File opened (read-only) \??\T: spoolsv.exe File opened (read-only) \??\V: default.exe File opened (read-only) \??\T: default.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\O: spoolsv.exe File opened (read-only) \??\M: spoolsv.exe File opened (read-only) \??\M: default.exe File opened (read-only) \??\K: default.exe File opened (read-only) \??\W: spoolsv.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\X: default.exe File opened (read-only) \??\N: default.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 13 iplogger.org 15 iplogger.org -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 geoiptool.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.1C1-5DD-85E spoolsv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PaintStoreLogo.scale-125.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSplashScreen.contrast-black_scale-125.png default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\TipsContentControlsWinRTComponent.winmd spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare150x150Logo.scale-100.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateWide310x150Logo.scale-150.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-30_altform-lightunplated.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\setVirtualParent.js spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api.1C1-5DD-85E default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintLargeTile.scale-100.png default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms default.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.1C1-5DD-85E default.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\DateTimeUtilities.js default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-lightunplated_contrast-black.png default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\delete.svg spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe.1C1-5DD-85E default.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms default.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-lightunplated.png spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf default.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms default.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\AppCore\Resources\GetSMDL2.ttf spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.targetsize-256.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js.1C1-5DD-85E spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\AppxManifest.xml spoolsv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-100.png default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png default.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardLogo.types.js spoolsv.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\setPortalAttribute.js default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ui-strings.js.1C1-5DD-85E default.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.1C1-5DD-85E spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.1C1-5DD-85E spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-96_altform-unplated.png default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-40_altform-lightunplated.png default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png default.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherMedTile.scale-100_contrast-black.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png default.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js spoolsv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-64_altform-lightunplated_contrast-white.png default.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-100.png spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\ui-strings.js.1C1-5DD-85E default.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.1C1-5DD-85E default.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.1C1-5DD-85E default.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-unplated.png default.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-200_contrast-white.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-lightunplated.png spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.1C1-5DD-85E spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-24.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare150x150Logo.scale-400.png spoolsv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-20_altform-unplated.png spoolsv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT spoolsv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\ui-strings.js spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.1C1-5DD-85E default.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language default.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe -
Modifies registry class 43 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400440010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "165" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "12383" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3351" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "15602" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7312" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2499603254-3415597248-1508446358-1000\{31489C16-CCC3-49B5-B888-8BF82AFC5684} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "132" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "132" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13761" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "13761" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070a00420061007200510065007600690072000a0041006200670020006600760074006100720071002000760061000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000007073becab118db0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "165" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10531" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3384" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "16980" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7312" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133727764362482282" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "12383" SearchHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1300 explorer.exe 1300 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1104 default.exe Token: SeDebugPrivilege 1104 default.exe Token: SeDebugPrivilege 1104 default.exe Token: SeIncreaseQuotaPrivilege 2776 WMIC.exe Token: SeSecurityPrivilege 2776 WMIC.exe Token: SeTakeOwnershipPrivilege 2776 WMIC.exe Token: SeLoadDriverPrivilege 2776 WMIC.exe Token: SeSystemProfilePrivilege 2776 WMIC.exe Token: SeSystemtimePrivilege 2776 WMIC.exe Token: SeProfSingleProcessPrivilege 2776 WMIC.exe Token: SeIncBasePriorityPrivilege 2776 WMIC.exe Token: SeCreatePagefilePrivilege 2776 WMIC.exe Token: SeBackupPrivilege 2776 WMIC.exe Token: SeRestorePrivilege 2776 WMIC.exe Token: SeShutdownPrivilege 2776 WMIC.exe Token: SeDebugPrivilege 2776 WMIC.exe Token: SeSystemEnvironmentPrivilege 2776 WMIC.exe Token: SeRemoteShutdownPrivilege 2776 WMIC.exe Token: SeUndockPrivilege 2776 WMIC.exe Token: SeManageVolumePrivilege 2776 WMIC.exe Token: 33 2776 WMIC.exe Token: 34 2776 WMIC.exe Token: 35 2776 WMIC.exe Token: 36 2776 WMIC.exe Token: SeIncreaseQuotaPrivilege 2776 WMIC.exe Token: SeSecurityPrivilege 2776 WMIC.exe Token: SeTakeOwnershipPrivilege 2776 WMIC.exe Token: SeLoadDriverPrivilege 2776 WMIC.exe Token: SeSystemProfilePrivilege 2776 WMIC.exe Token: SeSystemtimePrivilege 2776 WMIC.exe Token: SeProfSingleProcessPrivilege 2776 WMIC.exe Token: SeIncBasePriorityPrivilege 2776 WMIC.exe Token: SeCreatePagefilePrivilege 2776 WMIC.exe Token: SeBackupPrivilege 2776 WMIC.exe Token: SeRestorePrivilege 2776 WMIC.exe Token: SeShutdownPrivilege 2776 WMIC.exe Token: SeDebugPrivilege 2776 WMIC.exe Token: SeSystemEnvironmentPrivilege 2776 WMIC.exe Token: SeRemoteShutdownPrivilege 2776 WMIC.exe Token: SeUndockPrivilege 2776 WMIC.exe Token: SeManageVolumePrivilege 2776 WMIC.exe Token: 33 2776 WMIC.exe Token: 34 2776 WMIC.exe Token: 35 2776 WMIC.exe Token: 36 2776 WMIC.exe Token: SeBackupPrivilege 2912 vssvc.exe Token: SeRestorePrivilege 2912 vssvc.exe Token: SeAuditPrivilege 2912 vssvc.exe Token: SeDebugPrivilege 3288 spoolsv.exe Token: SeIncreaseQuotaPrivilege 2036 WMIC.exe Token: SeSecurityPrivilege 2036 WMIC.exe Token: SeTakeOwnershipPrivilege 2036 WMIC.exe Token: SeLoadDriverPrivilege 2036 WMIC.exe Token: SeSystemProfilePrivilege 2036 WMIC.exe Token: SeSystemtimePrivilege 2036 WMIC.exe Token: SeProfSingleProcessPrivilege 2036 WMIC.exe Token: SeIncBasePriorityPrivilege 2036 WMIC.exe Token: SeCreatePagefilePrivilege 2036 WMIC.exe Token: SeBackupPrivilege 2036 WMIC.exe Token: SeRestorePrivilege 2036 WMIC.exe Token: SeShutdownPrivilege 2036 WMIC.exe Token: SeDebugPrivilege 2036 WMIC.exe Token: SeSystemEnvironmentPrivilege 2036 WMIC.exe Token: SeRemoteShutdownPrivilege 2036 WMIC.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3696 sihost.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1300 explorer.exe 5068 SearchHost.exe 700 StartMenuExperienceHost.exe 1300 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 3288 1104 default.exe 77 PID 1104 wrote to memory of 3288 1104 default.exe 77 PID 1104 wrote to memory of 3288 1104 default.exe 77 PID 1104 wrote to memory of 1392 1104 default.exe 79 PID 1104 wrote to memory of 1392 1104 default.exe 79 PID 1104 wrote to memory of 1392 1104 default.exe 79 PID 1104 wrote to memory of 4988 1104 default.exe 80 PID 1104 wrote to memory of 4988 1104 default.exe 80 PID 1104 wrote to memory of 4988 1104 default.exe 80 PID 1104 wrote to memory of 2340 1104 default.exe 81 PID 1104 wrote to memory of 2340 1104 default.exe 81 PID 1104 wrote to memory of 2340 1104 default.exe 81 PID 1104 wrote to memory of 3728 1104 default.exe 83 PID 1104 wrote to memory of 3728 1104 default.exe 83 PID 1104 wrote to memory of 3728 1104 default.exe 83 PID 1104 wrote to memory of 3284 1104 default.exe 85 PID 1104 wrote to memory of 3284 1104 default.exe 85 PID 1104 wrote to memory of 3284 1104 default.exe 85 PID 1104 wrote to memory of 3332 1104 default.exe 87 PID 1104 wrote to memory of 3332 1104 default.exe 87 PID 1104 wrote to memory of 3332 1104 default.exe 87 PID 1104 wrote to memory of 1984 1104 default.exe 89 PID 1104 wrote to memory of 1984 1104 default.exe 89 PID 1104 wrote to memory of 1984 1104 default.exe 89 PID 1104 wrote to memory of 1608 1104 default.exe 91 PID 1104 wrote to memory of 1608 1104 default.exe 91 PID 1104 wrote to memory of 1608 1104 default.exe 91 PID 1104 wrote to memory of 5004 1104 default.exe 93 PID 1104 wrote to memory of 5004 1104 default.exe 93 PID 1104 wrote to memory of 5004 1104 default.exe 93 PID 5004 wrote to memory of 2776 5004 cmd.exe 95 PID 5004 wrote to memory of 2776 5004 cmd.exe 95 PID 5004 wrote to memory of 2776 5004 cmd.exe 95 PID 1104 wrote to memory of 1740 1104 default.exe 98 PID 1104 wrote to memory of 1740 1104 default.exe 98 PID 1104 wrote to memory of 1740 1104 default.exe 98 PID 3288 wrote to memory of 3348 3288 spoolsv.exe 100 PID 3288 wrote to memory of 3348 3288 spoolsv.exe 100 PID 3288 wrote to memory of 3348 3288 spoolsv.exe 100 PID 3288 wrote to memory of 2972 3288 spoolsv.exe 101 PID 3288 wrote to memory of 2972 3288 spoolsv.exe 101 PID 3288 wrote to memory of 2972 3288 spoolsv.exe 101 PID 3288 wrote to memory of 3268 3288 spoolsv.exe 102 PID 3288 wrote to memory of 3268 3288 spoolsv.exe 102 PID 3288 wrote to memory of 3268 3288 spoolsv.exe 102 PID 3288 wrote to memory of 2508 3288 spoolsv.exe 104 PID 3288 wrote to memory of 2508 3288 spoolsv.exe 104 PID 3288 wrote to memory of 2508 3288 spoolsv.exe 104 PID 3288 wrote to memory of 3908 3288 spoolsv.exe 106 PID 3288 wrote to memory of 3908 3288 spoolsv.exe 106 PID 3288 wrote to memory of 3908 3288 spoolsv.exe 106 PID 3288 wrote to memory of 2760 3288 spoolsv.exe 108 PID 3288 wrote to memory of 2760 3288 spoolsv.exe 108 PID 3288 wrote to memory of 2760 3288 spoolsv.exe 108 PID 3288 wrote to memory of 3232 3288 spoolsv.exe 110 PID 3288 wrote to memory of 3232 3288 spoolsv.exe 110 PID 3288 wrote to memory of 3232 3288 spoolsv.exe 110 PID 3288 wrote to memory of 1492 3288 spoolsv.exe 112 PID 3288 wrote to memory of 1492 3288 spoolsv.exe 112 PID 3288 wrote to memory of 1492 3288 spoolsv.exe 112 PID 3288 wrote to memory of 4356 3288 spoolsv.exe 114 PID 3288 wrote to memory of 4356 3288 spoolsv.exe 114 PID 3288 wrote to memory of 4356 3288 spoolsv.exe 114 PID 4356 wrote to memory of 2036 4356 cmd.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\default.exe"C:\Users\Admin\AppData\Local\Temp\default.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 03⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3348
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 13⤵
- Executes dropped EXE
PID:2972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- System Location Discovery: System Language Discovery
PID:3268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- System Location Discovery: System Language Discovery
PID:3908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup3⤵
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:03⤵
- System Location Discovery: System Language Discovery
PID:3232
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete backup3⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
PID:4148
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- System Location Discovery: System Language Discovery
PID:2896
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\default.exe"C:\Users\Admin\AppData\Local\Temp\default.exe" -agent 02⤵
- Drops file in Program Files directory
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\default.exe"C:\Users\Admin\AppData\Local\Temp\default.exe" -agent 12⤵PID:4988
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no2⤵
- System Location Discovery: System Language Discovery
PID:3728
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
PID:3284
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup2⤵
- System Location Discovery: System Language Discovery
PID:3332
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:02⤵
- System Location Discovery: System Language Discovery
PID:1984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete backup2⤵
- System Location Discovery: System Language Discovery
PID:1608
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:4996
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:3696 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:700
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js.1C1-5DD-85E
Filesize5KB
MD5468857f8b2a0c58c9cbefac010b16c2d
SHA1b532bf764cb127b6f16c6bc211b82376a0bc55d2
SHA256ef8a08684b349cc5b21ec7dcc905a0a78ad4d524d58e8ba53a287a457f07df38
SHA512236b28649664cc8f31de4480b88b6536d64d98befe384b92ebde038a929ca5c5408cf53bc59188f3e192fd4633b94ee392f7130376e44ba1bd17b4da61efcfd8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.1C1-5DD-85E
Filesize16KB
MD531cda50ae4f8736a1e36141d206f7853
SHA159474f018394ceb602a8d19019f726a3afbf3032
SHA256400bb08f30a6bef297f99c00a1591b9032f776367f1463d39ea9b20a428455d1
SHA5126f545719525fa3bf17f51baa40c71c4937d94e799b453f291d11819ef4c4e02a039269bcf2e8924fc070f393f4fd662980d2e8b4fb56baf75b8797c142bdec26
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js
Filesize395KB
MD5da74aeec8468cbd17d56858542a2f562
SHA1f20b4b6a3f69a1639ab668ed2e130f7d99c9d950
SHA2562617a33264698ec35d04680c73fe6b685b3c1daf6f7efc70b5a7278db4974a1f
SHA512a112b3a1094ac8c62bbea6a65d6beb0452f8060410fbd82a314548317cf5c4a88abdea85b907b3dbbf4158852c52f2fa530ee761871c8ad923704c23234e9e1b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.1C1-5DD-85E
Filesize176KB
MD5226edbfc1cf0e317851037439f5edd60
SHA12f9145ae60ed74c1f1cfe5390ae14990463c560c
SHA256a9060df85d18a801d16e5cc0cc17675b5fcdc6cf1cf9e568a8866f0947a5cc90
SHA512431bba878d8644854164502ce235f77c5f5724988323d27df19e16cd61b0c7736c9dc639cf15e3a51da5773f6d7972f4d070f9868c14494fc6ac37aea464214e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js
Filesize176KB
MD587a89150b6b17046ef9fae869cd89e30
SHA124695c4f91bec142e1e0b26e4c1caee5eb4a171a
SHA25661ca4dfe3ced124b34890998830fbb19b4cde335dc95504bd73f609a38006257
SHA512e3367d2920964cff0a7e5f86a9e099fb323593eee33ebd3c0e59f5c158664cc710db6387d0aba080402b21d04059c8d56728989dba90a6ccfe6beeca490d4be5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js
Filesize12KB
MD53fb1e83593f45db3d9aaa5475ff72a78
SHA15b009e7ef80d982e5260435436486372c90781b0
SHA256d73b2fdd99db217a2516d0c1cd22c7a5cf34550996b9d09bb4d223e9c333e739
SHA512f194a52b12951f1b90db48edfcfbd8a7b477392d2934ff432f5608d3ffeba96b070b9b50ea8bc4cdb65fe65b9cab3851009df357610b5c2f59831a75f131e16e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js.1C1-5DD-85E
Filesize10KB
MD5154b80438939a4effe5f4d7739220a3c
SHA1b77df872926bcf1093c12b31cbeccc15fc3d70fd
SHA25647fb6a1ecc76090b1750df7a7adad905b5045df8d7a1647abb9e1b8a6d084c4f
SHA512c2399cc746e5a266ec9c7a4b0e90f63211ccf7601da99e888c32dd0d643818aa2bff9a49f4771f9dd1c43d0a711c760134cb38ca6399f0d9eb73c9040cab0485
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png
Filesize8KB
MD5d8dab38a793f25212f9dc2d36ae43dd4
SHA1d0a70525f02ffb257b4cc9075d74739217e106bb
SHA2562d7852efb659e880fd1f442511ba6e15bef4c760ea9da7400acd4d19c1fcfb04
SHA512cd7c454746493cc5cbbcc4167d4e5be1e2b63e3a8301cf43adbea8472ec8dc97933932db71f681bc61a4eb075ce119ce8961a992187f651c9225b96bc7eb0154
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png.1C1-5DD-85E
Filesize9KB
MD53606f7f71f2d7a71b5eedd48ee80b38d
SHA14088143069f7d8a88e5ae68e34c8413018757203
SHA256b014b2a57c25c2699ff81d245893890d359193a8ea30fb8d70c7e0cdf1ed6c42
SHA51274e12d24e74c55e8c4b52874d0d44d68c1f5d54f62b658585333830a878bf3b334402f67b23d9ffdef7e46829d2e393f1930fa34a6099e477700be433ca3eb35
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png.1C1-5DD-85E
Filesize18KB
MD564c0a1e28e6f9ba04ce72f98ba4ff5e9
SHA1e585004372107b3d6b30648f387cbd4f60f2068e
SHA2568fd07bffbbba1e1aad9749b414bdaa2c7dd01d383560aee38813d62f1bff3e99
SHA512aa132bc5baeee135a6be256c60e10eec91d9570c30faebcee2738bb45a4e59b8e25abefcd447578880f874d83ec10f9d064430800b4f96005cec79873762f6ea
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js
Filesize7KB
MD5eddd4650eb2345bb675ac6b3ad1b9dc1
SHA13818bbbb398f6c3a7e5dc3c987c13a360efaffed
SHA256dd939a510759f1e92346ebd973a17a1adda87a7208f54953caa36aea6ba5db5b
SHA5120a8e848334d8e13a73e4b056ec39b79bab1f5e0e35ec227e967c04803c0bad1544125c6c00799088267c92e3d66d95c937be66b5df39f59502dee9aaf64ee78b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf
Filesize381KB
MD510c42f6bcf6f81f1156c90778e2f6f87
SHA1904306dbb17aa252244e8aca03cac07d3f2c7c1c
SHA256eff0a601727c51f76b3a7a6aafd1d28360366f1e43b3bafa2be81b17e72c5049
SHA51202f1bde9a00c72f2d3a55482ecac1d9c794ba8059290138c63ca3a07b6a95eb2c4926bd3d53f447e844cfdc7ea98fe55f4d27a71893e3a8e915641ad07d935e9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf
Filesize56KB
MD556f07ff31a8923b0b9a32d432d0fad67
SHA12b4d5f7c4e680eb92606fdb2844d9fa418053140
SHA2560417fc258ec891e4f55d028f7d9974f53bb9b4bf9c5797e0c138d438475e0ffa
SHA51253a3dca0765babccaba9e623eb301870e02d5ef3f60ca85da898e5eef72643865e5f207a6545fec6c92ef2afaf25d316b7564984b4c83d04e79fecb45fa8faa7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js.1C1-5DD-85E
Filesize14KB
MD577c054c2de3a4e0104e74a229903b3ca
SHA1db170fa6bf8066a050c313bba82b2448c006b750
SHA2563cdfbca55b69f107aa5f4d85de2b56316720217457273e7c4483baba667c80f9
SHA5123ffc8cfb64b82bce1f99aa6da203425323ac01eecdd657f5a39137100e82de00138a379b24fae035ad12563d2a76854b53460ea27492316f402c017855cff84a
-
Filesize
114KB
MD5b7c412eeeebaaea6cbc2a0dd98eaa190
SHA1ab5ae0e17ecf30cd0aa8c2a5a6c9350c591dbcee
SHA2564865ce228e80c3c9b08269de299154801539f3596dbb1e8d82052cb94421f02a
SHA512f7135236dcffef84061b84f12c88c22a4dcbb5aa4f3a0e48ae66bbb3cefa6c41a3ed127fc0fa1f5b367f2e639fd1b693747f388e796ad58bc642d67124f4614a
-
Filesize
545KB
MD583d75b57d9a4e5a0da769af1f0e5ed4d
SHA192421146a5ac2a7a75dcce7d41c26f19fe6b0506
SHA256b7939af3870dbb3e2295acee59e69ba10e7ef57a85f68a9e33cbbbada338693c
SHA5129f1cf2ae35eda90816097de206faedd43f54ffcc545174145ffe21dac59d83f602c10e058ac01664d779d3da83557d0ddc0fba2acc930775e158586b037d8186
-
Filesize
211KB
MD5e113d892f236a2c05bab8fc057dd4960
SHA115c2a2a28988fe7e9036238ec98f1d71cd07e14c
SHA2561ca0dd7ce24f47b386f66e9b3b751ef20edec28163b862fb8face642a6f856c3
SHA51201bfab521d16faa3289cdffb04d046d41a6bf696cfe6c0e5eccae4f13c509e6ec3f7c884b08691a27ddbf32798a80dfef9f80b12f51b3f996ec055676b0d3c04
-
Filesize
190KB
MD5eea7936c11c2d6ef85360d80626bd7d8
SHA180d77ab2daad09c080cd0cfbe0c0bbc1d2b7fc4e
SHA2569e091aa4fd4bf0f1bf33ec2a16339e88ba538e0b500533e837a2986511f69486
SHA512241202e72ffb34453364ae3d45011a73bd4e40c89f77a1fbcab4fde57bdddcbc03216f17c4e390811b25bbd237374d6dafa6cc86d47b1b2f58f9eae09dfce90b
-
Filesize
932KB
MD5c25464066086f5809a7c494b4a795383
SHA1b18052b6d088a005739dca81d4710cfe2414176c
SHA2560fb3bd1eff8533c0f934e51a66d4786d07495e795341797dea5c81986a454be4
SHA512db2584ebb7216f7b7d7ab28316bb9d6fcc8d77c7c69f0b990dab460462801ebcd634b6855630ad9f1b80a08956a6a03774fc374e2cc64ec58290514d928e34b3
-
Filesize
685KB
MD59df414301be867a2d941d5f8e085720d
SHA1280936da957f93473f840463b1a1e6420538f446
SHA25630635cebd3ff87747682da95b5b4862cf86d01e66adfb501d8fea3ffcedb1188
SHA51283569e1038ea6d8762e4a2337b8ce74bf59f70d8c66f3ca6963221ae5981d5559127b324209df797684178d8348aa7d88ac68b50c735c19bdbb7200348786129
-
Filesize
58KB
MD59e1bd9bfbe19c96b4d8da10c1ef6e5c8
SHA1bda674c9e561f8c2cb30430472c82716fc85f1b8
SHA256ad98113b0d8de7d0cce5299f8de5aa59c2edee5dd0af9c601c6f92b70b685f75
SHA51226bff96677ca69b4ab03406b31797c8b6d788fc2ac44c2f3f0e2a6f9c9c1bbdbef6bb83036dcb02cbacf77ee714e7638d325051e30054ea67190837f4d8f0d21
-
Filesize
6KB
MD5355785d23c629fa830bd41fd9db2cb8a
SHA13456b0e74b92f20e051d7fb9bfeadbe580bbcf58
SHA2561c9722944243cdb1aabbb596a75779fd0467781aaad2c13f7b41c78b7e44c20d
SHA512c97d231cae4b8143003a2a6ec99e61946bd18c8d8fcdc8dba58a5f508e9cc9041079bea212e72f6b82981bce7674e17cc8afd1e89bcc9bb7454e4166492ee89c
-
Filesize
9KB
MD5ede0e17c5b7c44fb87533ffe99d5d9f8
SHA14b431aa7752c0ede908c082a3fe5b3bc3193f3c1
SHA2565c5f1618a0d84cc27fc0febb7f4dc7f961e8bea6e9574351caf89ae072baf59d
SHA512fd21bc1997d3c82f6a026fa7cc81afa5aa905330459da91113a5cc2a0d595f360082d4065c00172c6d70870b4648f2fdc4f728efff517184cf19ac8b2058348f
-
Filesize
14KB
MD57a2a7c73a2c1c04dc211e4999403d908
SHA1ff6389e264756191c696887489a6045c2dc7439d
SHA2568a61f81231ba2adff5680f927b1d33c189d80ee6f8b1f55abd2c7bd0bc8e12cd
SHA51238bd12c5fd3acbcf73456449a6ba19a37c0459b279ad7d468b17e142c8db1fcf67e738e3bf1c08953eb47e44f7851f8bf52388dae1de8d51b4655a6e8f716dd8
-
Filesize
6KB
MD5920be29b89fe87544e417fc276508896
SHA1dc9ed5c75fb24661b85de1ca54c20e2c6325a82d
SHA256f107ce5346f89edb1137ad9053043cffd8f434655a1e9a7dd3b8035399016037
SHA51219610114a1e9cea6a6f942f629bef62157d9f3afedae245a08675ace87d624e0d4c3791fc055ad769e90c76b91f628c87317e3f0a0aa583bba3bdd76ff1b7e49
-
Filesize
10KB
MD51b1b4ee5f2a434b23aa6358b561ab0db
SHA1207023ef495b064f1e00f5d08e81647429b0119d
SHA256f2f47df56e3481bac2415b58cf6a16cbc901fcd21b28ff0ff4c991ed30cd6191
SHA512ff31f79a2b132f4476d578d3543ca6714741f2b89ff5052f0695d2a6e375f771c9534efdc6fc0500a3a8adebf1c908596f8b3ad2dd890c076bb56b744030e2fa
-
Filesize
12KB
MD54c6e75a7b9badd039e9f404fd1358aaf
SHA1fb23a585100b70cca823eff4eadf62defff879e3
SHA256a1360935644d30c2fa797a2578ff9026147b8e2c2f6460ff51b06396cab0eb9d
SHA51218377c6d556307626e33bb3028e87d78186ff5509fc162d36cedb58a4c47deda052e6427630e9bd990af7e837b6022a0ab14429fe1281a05c12f51e73915d9e3
-
Filesize
13KB
MD573fc67c264a419b9064b1a8fab6005c8
SHA181e1697946b0860ad279ddfb326e3a0ff2fb7f77
SHA2561f50a61ab39161578903aec5db83b53817a7f85e011169948da10a5ad3c47757
SHA512d5fd41722a2450c122eb1668745ba6d18db0eed5eecbe28215886927a0893471c8c8b9f1586cf1d9fe217a30e1e72e44722c126ee1a704d649937ca393023295
-
Filesize
14KB
MD5b210cf0c48433fd39316c23d2a22a841
SHA14762d504b85208c009bea08af85ec9f7a28e1359
SHA25643893f8baceb8fb0e53faf0623c82962fdec5c08711c3c2f362e338e0a1e200a
SHA512b8cab6954b303b29da6bee57a00f6a4f04c7acdd2477f6ac7a8b869b43f467a97b2d3d6ccebcab42516e1454088c3a53d07100ba17f4540471dbd42edd118e2f
-
Filesize
16KB
MD5aecfc6aea02efbb6e014a6ca6a60dc35
SHA1b3e2082fab5176cbcbd490cade39b8146f28cf3a
SHA256e7f0a43739650bb5192187cc243dfde0e8ae0ada8a1de712f42ce939ec2d4ac6
SHA512afbe19887674ee09ccd343c60574cdff7867864d4a1292fc47fe1c96768bf27a47f2ddb5a6eabd3f8dd8284d0b08e4aa9b2a017ae11202e58ecd397e12eeed0c
-
Filesize
6KB
MD57b86cff1068bccbc835bda0c752f6a4a
SHA1258ae15555324e4caf6f83766d45a82bbf44b426
SHA256599b8a3b0b140d96c89001c8f5888781e9ada751c95e2937177650898ebfaefb
SHA5122cfa085f79ee2d2b79c04b09e44c0bcc3c872756612d0caacf554e5c379e101a1ee903eef276893e5a84a4622c53441a3984f80bdcf0f3ba6fbcede1e51cd408
-
Filesize
10KB
MD57f0f19e0301f522d498717d4ad4d706d
SHA1081d0129932c18e6574f683a2938b2336681f444
SHA25697ea31bbbcd4d0c6db545f73f644cfc2ba5d81771e56a50cb17c88c6860bcee9
SHA5121cbe354eaa839eb7d3e0c5e621162498136f469bc18c9a3cbcbe6c95b345663b3614583daef10acef9d1593c37bfccc611a1d486dab93eea1d759580050fe5c9
-
Filesize
12KB
MD51447752105ac24d2e973d4f0a2f627ba
SHA1ae7325d3a8c1263359f1968c0935e7dec482fa7d
SHA256000685188f5419ac47159879d9260d827a2a43ad5b18ac7b8361aa21a789a641
SHA51225d1b353ae3aeafe6ed3286593112d7f32e332e40d5c0bd256fb8bf801c0a42da397c83244d0e68a0be2367eff74966246c18e11dc00cc132141c2a0268791e6
-
Filesize
10KB
MD5dcb0b23856686ddd05ec446b2114c1bf
SHA15232b39883c0f4a41c119737cc1f7ae06fc25051
SHA256e23184d46716aa018d4983a4a29630132d7316bd8a9ac7f3ebe48f3895e29d5f
SHA5123591db756a8ab1ffb0d8f4dbb5a0fa71fd89db091b663d0d43a355ff59291b87f9072f1ca68a625f52d01c841644c50491be8be00f6c9ee19c95cca5bbf679c0
-
Filesize
6KB
MD58d5e2adad136594ee4ac3d92dede6368
SHA1ae133be2c9242dda18d278a389876d724fb0ae01
SHA2564889190d2943de1e76587f48ea879824f91e68703cd1f6ce131309bb939de62c
SHA51233cdb1e6f6c9099e22c991db370771d09c6664f105ee877876e92a61a0106200a637e496ac60fd0fe03037ea21189d8b3e652cb899b9106b8a13a827ab417c04
-
Filesize
9KB
MD553ea4d38544fc8dedcbd47f4441a10fc
SHA1bef6619148464ec60e8ae209bba9ab01a1361bb4
SHA256676142cc1c9351d8aaca6baa69508530f7a2a9cd8983c0ff0744763e945a9fcd
SHA5124843dbdac04e423f625691c46568bd67731b7642e95ffc6fe9cc75f89de637d939f1d884e271007e97c64db8a846af145cbf0caec35823c1106bdb9bdf4badd1
-
Filesize
10KB
MD5984a92977d29be50ac83aedde5e81542
SHA11d82ea10fea9c3800afe2e809a79902e5ef695e8
SHA2561e1a383fa342e90abc39c86986e3c448fe5889001ea01ef2d2456c187af439e1
SHA512489ff98c87977bac70df0d6e4b93d7bfe934d2d88501511faf058c152ff5c31797d3bf50718855c825f15773ffd00203a25d48e6da7b1a41beb10eb026b995ec
-
Filesize
18KB
MD502a2fc9d0e218f7f49d00be35a05bd48
SHA18a830c10e00b6d00b7783495728c4e56011deca7
SHA2569ac723f76cf13b61937c87abab897e41237aa1288e588ee82727e66225f0ce1d
SHA512a68e522dd6e3d4d2d44f4f701594d84fea728b248817559a0c3cb33a13242dfa999875c2b3485562c7ccf8b4b4c248b482ace468dfcd8581157f765fbe276e4a
-
Filesize
9KB
MD561470c01ce71fb37cf1cce444f3eb1fa
SHA1074f77143877b9f3e24e67dbab357a12427c0023
SHA25614d8177ff29eaeb372c3361b230b5a0cd25d2e8e8d07d9ee0bb7750a476fd842
SHA5122c3a868fbcfa9a6043240a8afa80baa0e077c5cca35c37a6b2c2190f6ed92a133e2b529608a67c18dc7556cdc89219d891b6200531728ee169050b3419a1d6c0
-
Filesize
6KB
MD5af3cb767a785c58237a0ceb6e1c8338f
SHA15ef482535fbafe04a2d4c11a77a613c3815d3e5c
SHA25674e4e7a737d4fc77221c4e66b0d30accf965ebb01421c46371da70a0753d6e8e
SHA512a0fc745062db31861d25e5efa6efe29dd5e838a6be3488e7ed28062e0be3cb8935f68c4123cd8d8f87c798c65a58e48c746a265d36eb8e89b0907c0d11b11494
-
Filesize
11KB
MD531b5175877a5d31640f02ef1a2a7a0bf
SHA19aa46e29fe75f796387f96a0820aaa903e24d043
SHA256d288cdb991f6d916edd7dc5abba24999bbe8d25e950c1f6a605fe5fb23a68e24
SHA512c38f07d2fa1c677e789326019a4aef0bba63c6459c6b65dd2b7e9d227917e21ead17491c6f0015219e3e147f8bf8c6fb7abcab85c9846df2d50258b062688334
-
Filesize
8KB
MD5eca2ef491a79e391a6372b7b03cd9d1f
SHA165651cab063daf82b1830e2cd3bd76e5ccde3a83
SHA2566021b825aabcc6258613dd3a701f35198a2c4648d386d845d4d67d357de4aec6
SHA512077117828a4ef485e2467f14fd8447d74ce38128befd59fee8c75a6265fb83fc5152d82fee8e1b69386b81ca2087de5f4d39eb28ebc96de27997953848e3022f
-
Filesize
10KB
MD560b2cd4e17b4e863c074c79b7c56c708
SHA1520b9d64de59192ab3a74b2dbac6be8c63599551
SHA256c2e38801326a7eed58a7f69f72e6ab97b080eeeaae1a149a04268b789d2a1063
SHA5121429159c4a9acd4e2f13bc30d01b8916fa0a85ad21741ce5726067ddca5cc514e164ea9abc95bf2ea6ac04b3ebe38db652f1f311208338c789851564b51afd34
-
Filesize
9KB
MD55631b369734fca3fa3caa44b41688369
SHA181bfb79934c9bdb41a33fea8c8cdd46a1c67b496
SHA25670da5936330ee426c76cc7539439bf4084c710e82220f83ae08bf666b484244f
SHA512def003f0dd2b3666f88c89716d00399cdf9a44739e9b44b9277e8f46d2fa5e51fc5017f5dba8969ab1416bb3c780684cdf6691f09d5139601118c359bd58ccaf
-
Filesize
15KB
MD55b2bd2bfdb18565d99aee05d0c3cdd17
SHA1d6085f98bacd0e6aacf5fb3518bed54cb64fdd31
SHA256c4c3b11bcfe6e8736caceee37e5088afd35c51135da747a0b6c6d5a4d5bc5d04
SHA512d989e342d4c07042342e6bd960923faf80e029c0ae2d43fae366a1ccf4f3f3867606015ecb1699aa3b7c7347bb225b3093567d86fa2a87c474886b08b66bfa11
-
Filesize
10KB
MD5d7a3557afb453d6aca1ef741a75905af
SHA117001ff34ac73104156098d23ffd84810b5e1af7
SHA256177dd59eb484ba6fb83d6495488af5ccc8b065ee0d074d29a9ca226309eab614
SHA5127e1fc3c97b6db01e9391bf9c789b4c9b9297b1c91123525c98a4723b5f05d81110131f2704ce85f05bae49b7e8d1182ae48b37500a184b28d622af3268f5f208
-
Filesize
11KB
MD5cdcc3eb77dc361c2ed2f1dae16d48b07
SHA1f1396ef68da13e31720b317eada71912c31e4af2
SHA2560954291e7fe25f5be4a91a8a68794d14b1cd7781e21a4c51696479233f15980e
SHA512444e69106b2952945743ce5993015b36131dff416cf2b4132b144d496b147d8c820e2bc45b5bf14248f1d54aa5da5365fee800b5b78a810cd37d13fb1dc8820b
-
Filesize
8KB
MD58ceb2ba58f0b71197dbd056638276a11
SHA19e72759c03c6e64884a96bb2afb75be30b841b6b
SHA256f3c72ae92d6a2f26255a3f53e877481ca8896b860f255e30b337b64d8b9ac664
SHA51230b6cdda9eeb3ff17f3c36720ef36343a3512677b2424bcfeffa4864c48642c847129e1511c8959ca7a12fced24a18bc6c18876f405edcb9915298d5357804b5
-
Filesize
7KB
MD50b94f0da01dc5498f4b769eacc00d796
SHA1d3ff47eac285ad406f8427eb4b551d5e871593af
SHA2565292953d58280f1bf95f50fc8b7ac2ccbb8631e06b7ef43822e0616b8c7a9793
SHA5123585d13e233c4b43468b052c3a54b4a63e9cea81561330357d867d66dcef8fafd39301b49cb25665437b922880f883ef5e585b2c9b56fd472d1efc8835ad42c8
-
Filesize
5KB
MD501f5f01944876b5b96744d398ae23e57
SHA1bce4bec74940a7ef85b5b9d536abf8ffa2f1a42a
SHA256013b6404ae1daeb5b2018e96b9092f209fa35d4a9f6ee10f4afdaef6facaf225
SHA5126fd672f0d079e9303db851c598dc4c21ae0434a693bd994c2321fe409487f5b94d32d14ef59e1e23ac1b04e3d5e0f080d124551ab53b40107556fb95cfdb9a18
-
Filesize
16KB
MD5a167168a820e8de919ab4a6a617417a5
SHA1e8b714419e7648357d5fd13775798f0c59516339
SHA25632dd4c85f530629958efd3b34714e001efc1b314f2f79f4388594be8b457560a
SHA5120727548b3498d97d984840e920666090f83c130e8559ce22b925c7cadaac52595fcbc6392e4dea3f98a260514ccbf64bab6c144b7d7a2a90a18df339e55a895c
-
Filesize
1KB
MD5c3fae4c0aed1fdc70e301648f25e0b4e
SHA1769568f50d461b0da5cb3c4f9801f41f9b6b8abc
SHA256d36029d48d150d74426536e0ec732b80871bb797419750c0a70b6b8f6aee77be
SHA5128844aebba4d2a870315a3773340dcbc0bd88f8a58ad7e81df0891a4a8275068fe0fdd572a836a88553352fc1a2f15e2f246eb79abab92cafa0d446cccb0a2f51
-
Filesize
3KB
MD53cc07f3bac34f336fbc7f66030105a50
SHA14db2f1dd8bb1cccc8ca7baf10599d4bf00d2b941
SHA25635a4273a4734e5152ade6e82769bf72a392bc7dd0eb8ffb54299cab0a328cebe
SHA5124050c528ec520aee2d84b6e36cc902d632b70a78c81d66014a0dd0d067b88d083d14f8c1c330b81ca6ed006ce73427829c22c54f75312347025f0ce1a1c2c42f
-
Filesize
1.9MB
MD58da404a8db31649ed295834cbfdf8601
SHA192b79a4f413cabcfde40b7240b3bccdcf91954c6
SHA256c5f4d2fbbd8c42e2193e2c4861bb22ed20cb42d69966856823eae6296f1770b4
SHA51257b05c88769a862772022bf3657df739e8d032e9506bca8bf99e354a1814cd69f034291c6c5d833502a635f09a64f1688cd3faf9cc034fc277d94a5fa4a8bec0
-
Filesize
3.6MB
MD5357f825bf471bb10aaef7e4b258cd843
SHA1408d5338f14534cb3b99684530b0b299c33d7426
SHA256aa8e7514c289fea11fc1a2413b0d80158fd8cb28eb9861a1545192920d31b9ee
SHA512e3bba4edd1b515cca453fda01edafdab46179c960d3e726957612043839c542911b184f449246e28462e1433f93298ccb2f6c7acc143b256b90a7f44d1b0c7ba
-
Filesize
1.3MB
MD54c249f98ecc6be3d95a0cbdcfce3184b
SHA1913047948aa14253cd3c6b5ec75acf51512a7160
SHA2563c96dd7cdca854b6376e66a1197612efede8967980e71733be18b66d383d60f8
SHA512a814c03a2c89c668e827a5c152c1195c56b6117e4e3e80cca4b893361fd7b513af118f7e7ca93666ae5cb53bc91b3d2f328c2edcdf7f2f8cacf64b037f95d0c0
-
Filesize
1.7MB
MD59d2a8911d5a904566b9e0dcf38ea7b9a
SHA1d86f109c9ce25deeeb678c7cd4e355601ce38744
SHA25621dd4596595da6f5a6b849175b2c32f375e956971aa3541b8604217bf61facce
SHA5129e5fe41c41451870ec68b86eb2e19778ef61e8e5a842bb6d7cd05e21fd8fe6a98e4f249a5ee389a94cc541afc4308427495a3398d060fa247581ee37ad20096e
-
Filesize
1.5MB
MD562156e037941ce36884de6447e2df222
SHA1e52f03a8c8b807b4cc485065bb6a61148dbde693
SHA256b9dc1ce25842f27e85d0412e22e42cef56c183b98e1c7ffdff291c539135ed3f
SHA512a9f2b74e69f322fadb2dbeae221f51b57e0008015e775a486480cbfa5e77a14150289e01a0ee14ed1178910a2ddc1f4e60b7d724f636e996293b30bf60e5ae5b
-
Filesize
2.3MB
MD5c6521d474b304575540741a4b3733cb1
SHA1f9140d5f76b2d50ca8eff7f35066c160194dcd52
SHA25679b7f576997ffc3fa62ae47a1299ee4fc55f7fb85fed351d04e892a4436e5f56
SHA5124e048d869e2b69f4ae769ecf9c6e0ccb3771d4b3987c7e81665f6c00c7224232757ece5c2b331978ebb0037937326d66673ae67e15e1bc980abefd3361d0815c
-
Filesize
292KB
MD5842ad90f4bec74f2d261912093cfac5a
SHA1c3c4d5bf804538fcb09c4d3ca9b9ab20ea522ad4
SHA256bac3db6aa4a1a4ad56c993573989971819ba8eaa6cce0c30c09eaf126ae3a265
SHA5127b98f48b0099517589128d96d684dfba9a8cdaa8cf96661ab63397da3e17b277e1ec3a36574945a99c205cd8c7851d2be3384836728d12f465491ee3fc456bd8
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi
Filesize2.4MB
MD53f49b36e453315c2f10a168eddc30bd3
SHA12d1832f88f5f46b71b53ad72fb44a6680a11f289
SHA2569bf08f20579618bb8b5fc385520e7a267cc62dfe2503429e980f046d8a824010
SHA512693ada2f2356ed9b4ba6e92b0b52fd29db596e238942c94f3237cdb297158493f4128413ccabbbe1c53735af4c89ee6b56595bc3f5bb9ead548bd4c257b78e27
-
Filesize
2.5MB
MD5ec49da7a4669af75a92d94f681365de4
SHA110c01b4fe45ad82746a45c3a4b811d8f292aac8b
SHA256899451e4a837548814b0b0051fe2e5a9ac22a8544439c8f0be379c7e2c9fd453
SHA512099f9d488f820af6bcc92f4282b88c0ef2f4f269d7f27312bbf0f334d6f9818e2eccbbe0e9f225c8c219115e8336dbf3a10466532a969a027be4e829d28d3e10
-
Filesize
2.1MB
MD5a7f4e0d5e57c334879f8f2e6d0ffab35
SHA1a67c1448e4d894d44aff78ec12d682327bd82af0
SHA2560517edd70aca5e9976f9cf9db2b3c927c07a15b24aaad13b9fad892593caaca2
SHA512d7c82f195e14a089ae37f33e20407e12fde2cc003d8777da25eb2aab3540bb9b88791b3b47fe6d4bf59828d1b5de2b005709a8e0e93279afd811f8fce4501cd6
-
Filesize
974KB
MD5098361e310b9850b2570f3e62f65f213
SHA10e0f9d6be699ffecccfc7720e113edc5b7a14fe7
SHA256c69ffdd672fd3fbc71ac2ac1459f62b70cc2f7f83168eca18c2df3d4deaae7b7
SHA5127fe1efcf9b2137ae810cf48a4327f8c6a77aa68bd170bac939a72c309d2e9a16b167574237a5a912fe7dc4c805c5cc97f3f011e96e6aa499c735aefadabff6c5
-
Filesize
586KB
MD5e6f6925259188affc006fbba88a08c19
SHA1f9986e8d17748bf78a754f848dd97707d4662930
SHA256c524bce5085d3a4748567fde7f9824e45595b8bc1961365ef964df254f0d067b
SHA512d978553fca093f9cfefd54ca915f98594557be846125139491bcef3fb3b889fe6806c06fe962580e6a776695c82b6e94112df2d27656aedec4de4a68d27054a3
-
Filesize
609KB
MD57aec4703668f6b17ae2e65a793e96c62
SHA1c38fabc3ebb2fc2168fea930e3f0a86522b5f154
SHA25696a4c7043457d4269f62494c09028cda7476e001142c7ca783bd7a30602d1f81
SHA512a21999dbbf60e5ce0bed487e81011fbc9b96094db36e7fd8d88140b9195ea70aa65133efaa5e3507bdf660923ebfdb98a567a4b2072372cc396e8a40524795e2
-
Filesize
618KB
MD5a220d7926f024ef480d1530bf0f43b15
SHA1965f216f54702f9ea097ab8132cf9fb2a3dfc924
SHA2561120c0c8af74f3323ba3c8ac690e7327bf8e21426fb8d0e58fa0d98c969de630
SHA512e695fa34a8111e5003577951cdf0c02923f4d0ae1a4d2d602e0da136d73a8703b2ea15ca1120cdb56b93bfb4b9c1e26d66dd0eb98431c0602fbe889e594b6056
-
Filesize
606KB
MD5723ebc24912363432ad69d6c97129ad3
SHA11278a687f7bd7a881fe04fc84273cbefd45635d5
SHA256858fb1a5b7331824448c7600da8a1c03f23b47cbcdf81c7e77423c01681ca8d5
SHA512bfbf033e2fe03d3660710f7c63533c57459add838b405acf9572c94d23558f04acd32d8b3c0cf497b040737d6920487cecd55eea020c5cd3134988d3df234dac
-
Filesize
773KB
MD5064f4f42e689d8a9d705e661ddd5fb0b
SHA19df00e6dd5f65ac9bdb1e13c8c5a61a8ef9a81f4
SHA2568be25c2bcb5c6c1076b800cc1ca6d9eb5c97159d1b69ef90ccb06197b8ec93a3
SHA5121e7865d82be336f459c97d4369a0dd76e0fad14260e4605c72fd6a74d1081a78f062a527414322c1e1fb5e2f9e2521b78f04bba5f1b587bf70157adc42430ee2
-
Filesize
985B
MD59ab0fc6b6cb6ce7fa840d793a9eeaaf7
SHA1e192b0f631dbdc6a693d78dca193ea6c06882579
SHA25636459ee59013f555c0b5673b37d1b9359c9337c8f6c9d2c9611dd5929889692c
SHA5120b5a954c6a3686e3170505e2ed371bacb8f5f25bc58ddfa47cab40fa5df56b9c866305b608afb1b9180dbf231c7a28a6901e37428c36de1e9c48a7a588325a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
Filesize2KB
MD55aa7e3f405cec88c854569c8b565de07
SHA1d758d5bae4f5dd67c2d84c4c35c4d2d23a1dd3c5
SHA256f132ed0157e78fb86e8f2412443aa8443df2b3b6c8c6ea6f2244e60703dacd5d
SHA512a15ecd951ada9ead689666f9eacbfc6590c945dbf4a99c879144ddb73dcace5123da65739f0a545237d5372d9dd1875ec067c421f571c9c66eda20cb91ce1d4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
Filesize472B
MD55ca03431c032a7096ddca13349743586
SHA11e0c52d86ab00f9d222db23376c4c5b19714164a
SHA25620bfb2933cb8156974391895b2590640b02f039975bd0e4553a2850428dbdd37
SHA5127acc865322c8d375eeffe8d1159d9e63dafcde8c539eae5947f19d98ae745a9cf4afd966e2e30bf7b3b389558850e1c72bda5c37fca76f713c4e417aa70fed77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5f33dd0f163647ec937a9a53ecaf7cfd0
SHA18808fd00c4fba4a605e4a6416f6a5e3086640227
SHA256a9a86a188c7584dd5883f2f9644b505933c9189d5c35ea754922481f8ec58557
SHA51253552ba088aad341ed6aecbd091ac8f630ef2d25dc1cb1a930cfafd13c69f361cca6c7ef520731b10b339c20f3de65c3010a093e4b565aebe7ebd45c88604856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
Filesize484B
MD558f3e8457289bb68821be3980f9660a0
SHA1ab77cc19ecca476a95b816f733a10707490d57f5
SHA2566e23138955dd3b1684c511a3d7851ab0cf6a1069353a2e83e947693f220f90ec
SHA51244eccf87764ab15fab606889de5423934769f7551918b02654d1af6ce4f7b541fd58f6c4f73d0c8a9ba63a44c2ef9f507cca9dd91d5ebcb7430e5dafa41390db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
Filesize488B
MD5ed78dd3c6788fb60fb34beecd12b072f
SHA16c38d73efd14cdbf39e9b0a971de3883fc66a8a6
SHA25652ac56895717be985341ea6ab9f7cfa746b5c3abc1907d291eab965d79ea8521
SHA512f521a18b987a1609f9b6bf9e3a7a13789d4e3c2c961e6d7342432962269bd9d8a3be37a6276058026df57605103fad04f35ec5346a87026a5f652e6d178b0348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5030e67fa444610005befa781f13a0135
SHA1b7b081b3a8b9f32861c92f222bc7781aceb14745
SHA256527e83f3d5e9dec25cfec257a4a969803a85b64c0ee890bd5235115851076fa1
SHA512bb13edff03c49766ba14243ee7f7edcd0624b9b22c006439d536752f3af89f73b0644e925653e636072efb31b276db624f5c612762d70b2cab2d2e324b108955
-
Filesize
18KB
MD599a5ced9dfb5824225a0fab4c74a7b46
SHA1f0ebed42f94fabe0c10dcf1eb3eb084a904e144a
SHA25644b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a
SHA5122966164e08f60aaa0078dbfee9f4d5521b5c02525dbbad4ac14df0d6be948ba98ae1da33e05ceec07abd6d8a18278c399629621803acdccc91019372fa3152ce
-
Filesize
190B
MD56ebbeb8c70d5f8ffc3fb501950468594
SHA1c06e60a316e48f5c35d39bcf7ed7e6254957ac9e
SHA256a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1
SHA51275cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4NTU84VM\www.bing[1].xml
Filesize328B
MD5d4b65cbb00ce3906145c3220464940db
SHA14d62cb49afb906e6a924ee9358caad1033a549cd
SHA2567868e15ef90a3adb59d78c491bef57fc61c85428781a25cc0b987891242b3837
SHA5122a63d3219f5fffa14cebe62a718cf8647892be06ac73e1c97ca6567dd6b415c749c4dadf64246b8f7c35003f0eed2eccfbc1fa94eea1b225843ae4390af477dd
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4NTU84VM\www.bing[1].xml
Filesize17KB
MD5d6c780cff3a1b4f50da6c7cabbcc7168
SHA143e8ef9f2bd38bcb069cf12c73d7490cd4e884d8
SHA256645ec690f2a7a3e62a0af2451b4ab46c94a64a8a24d78fd3d6ea457ae0ab46ec
SHA5125a8f7ab3e1c1d531c90a99dc6fd0ca91ea822a951fa50c3fcc8bd37d111f2e645fe0f24f3852b669210e1e11b509e43bdcaf44feb2e0d90ebb8fdf320121d3cf
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4NTU84VM\www.bing[1].xml
Filesize15KB
MD530255d3dd32d4320c5fde1cf362c6580
SHA1eb54bc82bdee93183f67d32c881eb9f3c8cd0a98
SHA2566d22a756bb1e758f7c65463ef4b3dce8b619a4a1a9b57836644a474bc6f15945
SHA512588aeda03866f1b086941363180109dcdd0d4e7a92f352a7701beb15a5a2481c6c04034c51744806101d708dd02b0da8bf7da2ce42a84adc7ba12d371a3a5cba
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133778082059135351.txt
Filesize67KB
MD54c8c51362204a2804dbf83fae6432377
SHA18ce6b383c8826fb31247e5c161d7ec6fc3229538
SHA25618843b69a270dc0ce583909cdd918532f0f1087e8694cd3b6628e5171aec0224
SHA51275ab0460df4dca74004fcee064697cb46e1a05c7240473513dec9bb35b565eef23fd139734b470493175c016af5aecb08ddf989de63ca9277582c7c512960a25
-
Filesize
211KB
MD5f42abb7569dbc2ff5faa7e078cb71476
SHA104530a6165fc29ab536bab1be16f6b87c46288e6
SHA256516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
SHA5123277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af
-
Filesize
381KB
MD523ad9349454836bfec883d8e7ada4742
SHA17e3849406c71b50c66e9569e30ab6e06fdb03b3c
SHA256d7cb91207d5bd835dd37171b0ec02288be57640500b32fa28e3d517b6553c19c
SHA512f1b5d36c288108859eac499d70bd04be776369dc14ec798c15a3e0eb73bb869d3361108386da141050a6309703bf4db9b10958d71684358dc3f1cf47cb2abdb7
-
Filesize
87KB
MD51e8140ae972cafffe303ab435d608d9e
SHA12ba1e0c19ddfd22047789f16d7688c9916ab7bea
SHA256d3f90eb4b6558ae90353e88d0a5597a54ea039718ba01bd6e0ca9e0cc79eee4d
SHA5124f5d301e490b07cfc5f21e013d86b757b23ba5adf2d70ca6daabe026d610b7320af7eb4bd02456dd5c8eaf3fb6f888f1ccbcf335a5a3fd680d4125b8c068849b
-
Filesize
397KB
MD5e4e497ffdf84e8d17ac244c4c8ce0df2
SHA1d98fefea3c0fd95e11d56d586c8392d555a1eebc
SHA2567e657e3ad439576b50fba693412c964b4603c92fb40c768f817af6f6f94427f6
SHA51247200d5be4e73d62edc088ad7bfbb3e55cb9884e16b827f94d941c4611dd5caab2839110cce8eeac045b33acf0f397740574d597ff7626d8bf201fe6b5901a2b
-
Filesize
83KB
MD552ac003be690d61440966308f40a503b
SHA123954e96ed98b67d331a9de766d7780528ef6bfb
SHA25605709595df5393e57df2b4e75f43b5ee81ee5312b5b5a00cdd842542b6bcdb1c
SHA5126f5e614547ac923f8d1a4db7b0b54fcb17076015a2894dc72b5e0196f28a4366ac5320c9bde439308235c76e9f0714034715bbf5c754e6b32efeace25963c1da