Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system - submitted
17/12/2025, 21:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe
Resource
win11-20251223-en
windows11-21h2-x64
35 signatures
150 seconds
General
- Target JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe
- Size 655KB
- Sample251217-1a5pasdr9x
- SHA256 2584dbf5b6b45df163b1b2d698ecf35adc9dd1fe6e3a4e84fed31d00c9b8ddb0
- MD5 35cba1516a6b57238b8f4e7590f83f53
- SHA1 836de17925c118dc53b29648e04d96d7fbbd5755
- SHA512 512f3bb7dd4ab4696f2b92a4f12b94d87cf8611e800b30ef9ae8ce0ee46622eb0c12a4c396011b66cd1d6f7269dae73c4e0950c0a57dcfdccece132eebe43f71
- SSDEEP 12288:/ESqJwbBEE+tOi7c2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+j7c21lz/VnxgAJxuOCciZzE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cycbot
C2
-
http://logstoreonline.com
-
http://jumptomoon.com
-
http://simplexstored.com
-
http://pdasoftstoreonline.com
-
http://speedhddrecovery.com
-
http://infobookbase.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
Attributes
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
Signatures
- Cycbot family
- Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral2/memory/3840-110-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4888-114-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4644-119-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/5636-186-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4644-191-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4644-276-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4644-546-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot - Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" R07924.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" juayae.exe - Pony family
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Disables taskbar notifications via registry modification
- Executes dropped EXE 11 IoCs
pid Process 1556 R07924.exe 1692 juayae.exe 6008 aehost.exe 4568 aehost.exe 4644 behost.exe 560 cehost.exe 5916 dehost.exe 3840 behost.exe 4888 F4D.exe 5636 behost.exe 4344 5DEA.tmp - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /p" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /P" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /Z" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /X" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /t" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /E" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /Y" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /V" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /L" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /D" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /m" R07924.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /j" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /v" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /H" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /n" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /o" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /w" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /Q" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /G" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /l" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /B" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /u" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /q" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /M" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /k" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /N" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /d" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /F" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /I" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /z" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /K" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /y" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /s" juayae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F4D.exe = "C:\\Program Files (x86)\\LP\\D350\\F4D.exe" behost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /b" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /i" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /f" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /c" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /a" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /e" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /C" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /O" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /U" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /x" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /J" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /r" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /R" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /m" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /T" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /S" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /h" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /g" juayae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000\Software\Microsoft\Windows\CurrentVersion\Run\juayae = "C:\\Users\\Admin\\juayae.exe /A" juayae.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3832 tasklist.exe 1048 tasklist.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5500 set thread context of 3748 5500 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 78 PID 6008 set thread context of 4568 6008 aehost.exe 96 PID 560 set thread context of 5680 560 cehost.exe 103 -
resource yara_rule behavioral2/memory/3748-0-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-2-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-7-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-5-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-9-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-8-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3748-55-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3840-110-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4888-114-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4644-119-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/5636-186-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4644-191-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4644-276-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/3748-448-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4644-546-0x0000000000400000-0x0000000000469000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\D350\F4D.exe behost.exe File created C:\Program Files (x86)\LP\D350\F4D.exe behost.exe File opened for modification C:\Program Files (x86)\LP\D350\5DEA.tmp behost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 2548 560 WerFault.exe 102 - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R07924.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language juayae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aehost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language behost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cehost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dehost.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe - Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400540010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2767153255-1464007854-4269153626-1000\{4A5A1ED1-4B02-423B-BE35-FC80601EA439} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3275" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8848" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134109975785567263" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5629" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5629" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3242" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e9070c00420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000e582c74f5074dc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2767153255-1464007854-4269153626-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1556 R07924.exe 1556 R07924.exe 1556 R07924.exe 1556 R07924.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 4568 aehost.exe 4568 aehost.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 4644 behost.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 4568 aehost.exe 4568 aehost.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 1692 juayae.exe 4568 aehost.exe 4568 aehost.exe 1692 juayae.exe 1692 juayae.exe 4568 aehost.exe 4568 aehost.exe 4568 aehost.exe 4568 aehost.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 3832 tasklist.exe Token: SeSecurityPrivilege 5872 msiexec.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeDebugPrivilege 1048 tasklist.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe Token: SeShutdownPrivilege 1448 explorer.exe Token: SeCreatePagefilePrivilege 1448 explorer.exe - Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 1556 R07924.exe 1692 juayae.exe 5916 dehost.exe 1448 explorer.exe 1804 SearchHost.exe 604 StartMenuExperienceHost.exe 1448 explorer.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 5500 wrote to memory of 3748 5500 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 78 PID 5500 wrote to memory of 3748 5500 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 78 PID 5500 wrote to memory of 3748 5500 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 78 PID 5500 wrote to memory of 3748 5500 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 78 PID 3748 wrote to memory of 1556 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 79 PID 1556 wrote to memory of 1692 1556 R07924.exe 80 PID 1556 wrote to memory of 3108 1556 R07924.exe 81 PID 3108 wrote to memory of 3832 3108 cmd.exe 83 PID 3748 wrote to memory of 6008 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 85 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 6008 wrote to memory of 4568 6008 aehost.exe 96 PID 3748 wrote to memory of 4644 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 97 PID 3748 wrote to memory of 560 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 102 PID 560 wrote to memory of 5680 560 cehost.exe 103 PID 560 wrote to memory of 5680 560 cehost.exe 103 PID 3748 wrote to memory of 5916 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 109 PID 4644 wrote to memory of 3840 4644 behost.exe 112 PID 4644 wrote to memory of 5636 4644 behost.exe 124 PID 4644 wrote to memory of 4344 4644 behost.exe 133 PID 3748 wrote to memory of 944 3748 JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe 140 PID 944 wrote to memory of 1048 944 cmd.exe 142 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer behost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" behost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exeJaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\R07924.exeC:\Users\Admin\R07924.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\juayae.exe"C:\Users\Admin\juayae.exe"4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
-
-
C:\Users\Admin\aehost.exeC:\Users\Admin\aehost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\aehost.exeaehost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
-
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4644 -
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\0F213\4AED3.exe%C:\Users\Admin\AppData\Roaming\0F2134⤵
- Executes dropped EXE
PID:3840
-
-
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe startC:\Program Files (x86)\13304\lvvm.exe%C:\Program Files (x86)\133044⤵
- Executes dropped EXE
PID:5636
-
-
C:\Program Files (x86)\LP\D350\5DEA.tmp"C:\Program Files (x86)\LP\D350\5DEA.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4344
-
-
-
C:\Users\Admin\cehost.exeC:\Users\Admin\cehost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\explorer.exe00000220*4⤵PID:5680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 5724⤵
- Program crash
PID:2548
-
-
-
C:\Users\Admin\dehost.exeC:\Users\Admin\dehost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5916
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_35cba1516a6b57238b8f4e7590f83f53.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 560 -ip 5601⤵PID:580
-
C:\Program Files (x86)\LP\D350\F4D.exe"C:\Program Files (x86)\LP\D350\F4D.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4888
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1448
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:604
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1804
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\D350\5DEA.tmp
- Size 104KB
- SHA256 50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a
- MD5 0cb09d0443d2eda312058ae1a2fa83c2
- SHA1 1888844fcab4269a5c08b5cf122b100e8abb3cb0
- SHA512 93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c
- SSDEEP 1536:aiNoPz/GlMJZBe1E+OOYBw6IyIuI+KVHt7+Rw/uCH9zvw8WoEWMARz4cYNOO:4zFBIEVJa6IyIbr37+ROuBtoRT1u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UKX90RJN\www.bing[1].xml
- Size 97B
- SHA256 4bdb01a2b4071da31e72c5a5c89f672333f6b1975c5f590a590d77ef0195ce5d
- MD5 882a5721c7d2c6ae1a9c4ccf95c75c46
- SHA1 4c717e15d203722d0b06af6278da7709aea49792
- SHA512 c94e957bbf415fbe6534a523da907d0223dfc74981c63ec6ab83f8fd75d32a76e8c89a02ca9cfcb58542ae702e0f5c93b21d0d29ccb62182e0014fe18a93d4b3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\0F213\3304.F21
- Size 600B
- SHA256 ce0d829d9a95ce7d190821745b72abc32294d5e0cd5f5dcda5d2bfac86fc20ec
- MD5 c2347f981c2b5734744979f7971a1e17
- SHA1 c7d70af2c8960b46028a9508fecb74049d0575f1
- SHA512 950e38c059cbff32e1574b988a3a3e704e12c1797245aea956138f3772896e2315af23d0a01a0d4ee31661e1dca341c02d762afc272c8d9da8581659bcba1ff5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\0F213\3304.F21
- Size 996B
- SHA256 def0b03c212bc85a858f42d3db766724059ae1e57e39ec7d9dfa4a2498e35185
- MD5 5d6878d6d3e4b487415743a80b745b15
- SHA1 baf959dc0a7f34d26502cf4b4a59872e991b836d
- SHA512 7312f16adfc0f545ea743890da5ac4f62d734fe9ba7f0980ab8dabd2f9927918525f2f6b43c18edd67a801b0693261441411dfa36b7d557944703fb692aefbcf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\0F213\3304.F21
- Size 1KB
- SHA256 92c77252a232ee08cbec96c606a168efa358ab24f49be0562bd2886eba81322f
- MD5 49c58f54e1e7a6a0d2b63b7cca1e38b2
- SHA1 e4955447bbd182f4c7201728cb4d2bc09632dc2b
- SHA512 76e58a869e533e132a8ec8e56d547657c62fa55e4945b061d7438f1d4d87bb1c7a2df21b2545f18cc1ce21ce31ac8453d5817084def905d96c2554f3b86cc874
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\0F213\3304.F21
- Size 1KB
- SHA256 723db33dd5e07183557af8d88427bd733702447c4108ea0da8dea07757dc0cac
- MD5 a73cee5ca5aba349628c2fa5a21e9d1a
- SHA1 f03249f38fe57ff65c622edcd2f95cb29845d992
- SHA512 01fc4c2dea1ef736d6384e8478af816f5f09634824774d15703910b9236d1baae70d51a6a4c91452111dbaf45960e2b94d60cf9cd5f08f623a9f42c779d5f198
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\0F213\3304.F21
- Size 300B
- SHA256 5a393bef245e51dbdd6b131407b21e21367161606558a3e534346a595f4d1421
- MD5 b766df6e801c40ab6eb5e69d088dc96a
- SHA1 ae4e5d264a0e6acbd035257884d33768e6794ddf
- SHA512 27654b3d836fba92d2c953258a489276a144bda1f7dda58d607693e28db4f48c98b52025117ba5d9e3f2fef30ff675ef23e5cdd3118ad62de6bf7df8fdb4367c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\R07924.exe
- Size 188KB
- SHA256 e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf
- MD5 4f9c5823c5d1255ded151b01c0a58e15
- SHA1 2f7018a9211472ddfa5d2f09629bf90adce4676c
- SHA512 b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca
- SSDEEP 3072:Q4oXAKunUbD4LdWKnvmb7/D26105nFeziUq6fNMUoZEA6YMSiWo7TI5Oa+EhFVjc:QzA9n0xKnvmb7/D261CnFeziUq6fNoZ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\aehost.exe
- Size 129KB
- SHA256 8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5
- MD5 e2b1704acdf48221cd9be91bae3546c5
- SHA1 f53a59b62276f58cf8689768f747e16f53dbd341
- SHA512 1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53
- SSDEEP 3072:pGAvz74nYfRSa5o3Zw7nyN2E+49Tj1p6of1tOjO/9ZcF:XvzcnSq3ZwbBEE+tOikF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\behost.exe
- Size 279KB
- SHA256 b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02
- MD5 2a583120a51178ee5f8bc2727faaa73e
- SHA1 91296d42eeddb285aeea28f5139cadda10f21df7
- SHA512 003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b
- SSDEEP 6144:pVErFNRuFTSKNdxy7T7BQaCnSVFNIiLxNqG1f/oKt:p2PRUuKUT6JSB1xdJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\cehost.exe
- Size 145KB
- SHA256 8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257
- MD5 56be9270582de0986c72139ea218e121
- SHA1 d33b8a2127ccf6b6f42a0c0f266136a376def18c
- SHA512 dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023
- SSDEEP 3072:ijEkv6J2sdFWZ3Il67O7CX1hC1oKIhZ5F/b++xzTN4e53Eyfs6sM:jl2sTWSU7O7CPcGZrbtxzT153E8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\dehost.exe
- Size 24KB
- SHA256 400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216
- MD5 7cda5863b933988b7bd1d0c8035dafd9
- SHA1 68c64d655d0df1c9974587d12b3b88f5ce1f4cac
- SHA512 978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea
- SSDEEP 384:Ltr4DQARiay4it6nlfua2r8IxXD94REj:Zr4hrKt6hI/yRE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\juayae.exe
- Size 188KB
- SHA256 2563bd814b193bbbd61e9e642d9e0ce40b209bbbac485f338a1326255fd1fd22
- MD5 3e231572f674e4a66f6b07f15b6caa11
- SHA1 4cddb3c4fc48b3ed06a2d31d006cff2ef953cd68
- SHA512 de55b3cae8ae24621263bf0741ef19ffe458d0cf561d2612efcb3b0a8db1fce94921d40437548288eee16330840474af0d1a090561039468e30a5f7625c6bb84
- SSDEEP 3072:QhpXAKunUbD4LdWKnvmb7/D26105nFeziUq6fNMUoZEA6YMSiWo7TI5Oa+EhFVjz:QLA9n0xKnvmb7/D261CnFeziUq6fNoZF
- MD5 SHA1 SHA512 SSDEEP