Analysis
- max time kernel
52s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
- Size 23.5MB
- Sample260705-d2axnscx2k
- SHA256 79f48fbef1427b1e8b9cd0851a86de8d1ca8a3dc8a639078499d44e9e53408fd
- MD5 c565954a01e5de995f19c486710d4240
- SHA1 df5831467f6671de2d34cdbb82fb6756144a0d1f
- SHA512 7ad92d0545ac2e79cabe9b5b8c618971d69a95566d43350c25118793acd7f7dc554f1c4a43187335fff7cc25bf67d1a5f021f9a3c27b2c16955066613c486ea2
- SSDEEP 393216:VTSZTIMtwrbY7vdZaNFfx/S4QsFQvS2d19Poe/ytwsDpxKZI/B4p9oRkwKKIN:VzfbY7vdZ8x/SAfCP/PsDp2+KA3i
- TLSH T1CF47331DE1540898C2BBA0388203653AF335BCCF8A71528B63E576D26E73BA56D3D771
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 2 IoCs
pid Process 3384 windowsmanager.exe 1984 windowsmanager.exe - Loads dropped DLL 14 IoCs
pid Process 6052 MsiExec.exe 6052 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe 4512 MsiExec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 14 3820 msiexec.exe 15 3820 msiexec.exe 16 3820 msiexec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: windowsmanager.exe File opened (read-only) \??\K: windowsmanager.exe File opened (read-only) \??\R: windowsmanager.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\B: windowsmanager.exe File opened (read-only) \??\G: windowsmanager.exe File opened (read-only) \??\I: windowsmanager.exe File opened (read-only) \??\T: windowsmanager.exe File opened (read-only) \??\W: windowsmanager.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: windowsmanager.exe File opened (read-only) \??\O: windowsmanager.exe File opened (read-only) \??\S: windowsmanager.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: windowsmanager.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\M: windowsmanager.exe File opened (read-only) \??\N: windowsmanager.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\J: windowsmanager.exe File opened (read-only) \??\X: windowsmanager.exe File opened (read-only) \??\Y: windowsmanager.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: windowsmanager.exe File opened (read-only) \??\L: windowsmanager.exe File opened (read-only) \??\Q: windowsmanager.exe File opened (read-only) \??\U: windowsmanager.exe File opened (read-only) \??\V: windowsmanager.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: windowsmanager.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Yamicsoft\Windows Manager\DiskAnalyzer.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\PrivacyProtector.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\ThisPCManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\URLManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\FileSecurity.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\German.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WiFiManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Greek.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\MyTask.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\NavigationPaneManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\ServiceControllerEx.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\StartupManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Thailand.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\DuplicateFilesFinder.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\JumpListQuickLauncher.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Vietnamese.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\RunShortcutCreator.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WMFolderRes.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WindowsManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\TranslationHelp.rtf msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\DesktopCleaner.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\HardwareMonitor.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Arabic.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Indonesian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Italian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Polish.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\LaunchTaskCommand.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\RegistryDefrag.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\BingImages.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Bulgarian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\LiveUpdateCopy.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\RepairCenter.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\StartMenuManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\TaskSchedulerManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WindowsAppUninstaller.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Portuguese_Portugal.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\DevComponents.DotNetBar2.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Russian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Swedish.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\help.html msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Chinese_Simplified.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Hebrew.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\SecurityLock.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WinXMenuEditor.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\1-ClickFixer.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\DpiNumericUpDown.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\1-ClickKillProcesses.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\DevComponents.TreeGX.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\HotkeyManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\JunkFileCleaner.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Microsoft.Win32.TaskScheduler.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\SuperCopy.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Ukrainian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\SmartUninstaller.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\VisualCustomizer.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\MoveSystemFolders.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\1-ClickCleaner.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\CheckBoxComboBox.dll msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Croatian.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\English.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\Language\Spanish.lang msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\ServiceManager.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\SettingsSecurity.exe msiexec.exe File created C:\Program Files\Yamicsoft\Windows Manager\WindowsUtilities.exe msiexec.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID19E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID374.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID9B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDE7A.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59ce14.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID3F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID442.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID482.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFFE1FBC77AE0A4A84.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{91468D75-3686-4464-A81A-58D9173C7A73} msiexec.exe File created C:\Windows\Installer\e59ce14.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE811.tmp msiexec.exe File created C:\Windows\Installer\e59ce18.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID412.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID500.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF56E6DA29A41DA1A2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDB4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDC17.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsmanager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsmanager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5572 msedge.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000730b2d3be93fb2c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801730b2d3b0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101730b2d3b000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3730b2d3b00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6730b2d3b00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{752B5794-6D4D-4E08-BF43-64F5DC6D20E2} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{A13DF820-1D8B-4D81-AAA8-EDD3DEAEED68} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Modifies system certificate store 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E windowsmanager.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd windowsmanager.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd windowsmanager.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd windowsmanager.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd windowsmanager.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092 windowsmanager.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 5900000001000000160000005200530041002f00530048004100350031003200000019000000010000001000000015b8b4807e45c1ae49fa34daa40347e60f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d7953000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd1d000000010000001000000004321ccbc528a397f1620cb39dfc6d35030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc30926b0000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b8045c0000000100000004000000001000002000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f windowsmanager.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5808 explorer.exe 5808 explorer.exe 3820 msiexec.exe 3820 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3820 msiexec.exe Token: SeCreateTokenPrivilege 3384 windowsmanager.exe Token: SeAssignPrimaryTokenPrivilege 3384 windowsmanager.exe Token: SeLockMemoryPrivilege 3384 windowsmanager.exe Token: SeIncreaseQuotaPrivilege 3384 windowsmanager.exe Token: SeMachineAccountPrivilege 3384 windowsmanager.exe Token: SeTcbPrivilege 3384 windowsmanager.exe Token: SeSecurityPrivilege 3384 windowsmanager.exe Token: SeTakeOwnershipPrivilege 3384 windowsmanager.exe Token: SeLoadDriverPrivilege 3384 windowsmanager.exe Token: SeSystemProfilePrivilege 3384 windowsmanager.exe Token: SeSystemtimePrivilege 3384 windowsmanager.exe Token: SeProfSingleProcessPrivilege 3384 windowsmanager.exe Token: SeIncBasePriorityPrivilege 3384 windowsmanager.exe Token: SeCreatePagefilePrivilege 3384 windowsmanager.exe Token: SeCreatePermanentPrivilege 3384 windowsmanager.exe Token: SeBackupPrivilege 3384 windowsmanager.exe Token: SeRestorePrivilege 3384 windowsmanager.exe Token: SeShutdownPrivilege 3384 windowsmanager.exe Token: SeDebugPrivilege 3384 windowsmanager.exe Token: SeAuditPrivilege 3384 windowsmanager.exe Token: SeSystemEnvironmentPrivilege 3384 windowsmanager.exe Token: SeChangeNotifyPrivilege 3384 windowsmanager.exe Token: SeRemoteShutdownPrivilege 3384 windowsmanager.exe Token: SeUndockPrivilege 3384 windowsmanager.exe Token: SeSyncAgentPrivilege 3384 windowsmanager.exe Token: SeEnableDelegationPrivilege 3384 windowsmanager.exe Token: SeManageVolumePrivilege 3384 windowsmanager.exe Token: SeImpersonatePrivilege 3384 windowsmanager.exe Token: SeCreateGlobalPrivilege 3384 windowsmanager.exe Token: SeCreateTokenPrivilege 3384 windowsmanager.exe Token: SeAssignPrimaryTokenPrivilege 3384 windowsmanager.exe Token: SeLockMemoryPrivilege 3384 windowsmanager.exe Token: SeIncreaseQuotaPrivilege 3384 windowsmanager.exe Token: SeMachineAccountPrivilege 3384 windowsmanager.exe Token: SeTcbPrivilege 3384 windowsmanager.exe Token: SeSecurityPrivilege 3384 windowsmanager.exe Token: SeTakeOwnershipPrivilege 3384 windowsmanager.exe Token: SeLoadDriverPrivilege 3384 windowsmanager.exe Token: SeSystemProfilePrivilege 3384 windowsmanager.exe Token: SeSystemtimePrivilege 3384 windowsmanager.exe Token: SeProfSingleProcessPrivilege 3384 windowsmanager.exe Token: SeIncBasePriorityPrivilege 3384 windowsmanager.exe Token: SeCreatePagefilePrivilege 3384 windowsmanager.exe Token: SeCreatePermanentPrivilege 3384 windowsmanager.exe Token: SeBackupPrivilege 3384 windowsmanager.exe Token: SeRestorePrivilege 3384 windowsmanager.exe Token: SeShutdownPrivilege 3384 windowsmanager.exe Token: SeDebugPrivilege 3384 windowsmanager.exe Token: SeAuditPrivilege 3384 windowsmanager.exe Token: SeSystemEnvironmentPrivilege 3384 windowsmanager.exe Token: SeChangeNotifyPrivilege 3384 windowsmanager.exe Token: SeRemoteShutdownPrivilege 3384 windowsmanager.exe Token: SeUndockPrivilege 3384 windowsmanager.exe Token: SeSyncAgentPrivilege 3384 windowsmanager.exe Token: SeEnableDelegationPrivilege 3384 windowsmanager.exe Token: SeManageVolumePrivilege 3384 windowsmanager.exe Token: SeImpersonatePrivilege 3384 windowsmanager.exe Token: SeCreateGlobalPrivilege 3384 windowsmanager.exe Token: SeCreateTokenPrivilege 3384 windowsmanager.exe Token: SeAssignPrimaryTokenPrivilege 3384 windowsmanager.exe Token: SeLockMemoryPrivilege 3384 windowsmanager.exe Token: SeIncreaseQuotaPrivilege 3384 windowsmanager.exe Token: SeMachineAccountPrivilege 3384 windowsmanager.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 3384 windowsmanager.exe 1856 msiexec.exe 5116 sihost.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe 5808 explorer.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3820 msiexec.exe 6052 MsiExec.exe 1856 msiexec.exe 3032 StartMenuExperienceHost.exe 5496 SearchHost.exe 5808 explorer.exe 4512 MsiExec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5964 wrote to memory of 3384 5964 2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe 88 PID 3820 wrote to memory of 6052 3820 msiexec.exe 90 PID 3384 wrote to memory of 1984 3384 windowsmanager.exe 91 PID 1984 wrote to memory of 1856 1984 windowsmanager.exe 92 PID 5116 wrote to memory of 5808 5116 sihost.exe 100 PID 3820 wrote to memory of 3496 3820 msiexec.exe 109 PID 3820 wrote to memory of 4512 3820 msiexec.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_c565954a01e5de995f19c486710d4240_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe" /qb2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe /i "C:\Users\Admin\AppData\Roaming\Yamicsoft\Windows Manager 2.3.9\install\WindowsManagerSetup.x64.msi" /qb AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\RarSFX0\ "EXE_CMD_LINE=/exenoupdates /forcecleanup /wintime 1782981473 /qb " CLIENTPROCESSID=3384 CHAINERUIPROCESSID=3384Chainer "AI_UNINSTALLER=C:\Users\Admin\AppData\Local\Caphyon\Advanced Installer\{91468D75-3686-4464-A81A-58D9173C7A73}\windowsmanager.exe" AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Yamicsoft\Windows Manager 2.3.9\install\WindowsManagerSetup.x64.msi" /qb AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\RarSFX0\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1782981473 /qb " CLIENTPROCESSID=3384 CHAINERUIPROCESSID=3384Chainer AI_UNINSTALLER="C:\Users\Admin\AppData\Local\Caphyon\Advanced Installer\{91468D75-3686-4464-A81A-58D9173C7A73}\windowsmanager.exe" AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"2⤵PID:5340
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Key" /t REG_SZ /d "4RA93-ERD7F-B4E8B-W3122" /f2⤵PID:4808
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence User" /t REG_SZ /d "CyberMania" /f2⤵PID:2876
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Yamicsoft\Windows Manager" /v "Licence Email" /t REG_SZ /d "[email protected]" /f2⤵PID:4824
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" url.dll, FileProtocolHandler "https://www.cybermania.ws"2⤵PID:2828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/3⤵PID:3356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffdacc4c188,0x7ffdacc4c194,0x7ffdacc4c1a04⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17192547648944511306,8596221424396781110,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:114⤵
- System Time Discovery
PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,1847818606369687901,3037984409584771069,262144 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:24⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,5803974943829785855,1284704321553972412,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:134⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,6883565679548234454,14558946427784544961,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,3241103709107946944,9886510318863193895,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17651565936943597626,9442203681293382453,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:94⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,174095033063915596,4033720887021608834,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,7867130838218759211,17743785187235022699,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:144⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,4765284721939242004,11031991029844356393,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5640,i,13475087913122047761,2362334470369331477,2097152 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14⤵PID:576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1383666239186987445,2754599871250836384,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:144⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17031630276565207578,7252085945139421240,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:144⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11808075812265370693,13752272454352911783,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:144⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11808075812265370693,13752272454352911783,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:144⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,16492189099020916974,18024449006099826876,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:144⤵PID:6288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,1686962535779278202,18335868230001328961,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:144⤵PID:6484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,8235949763321927006,11534368406233594695,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵PID:6200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,4972297076390179354,11347393086099650639,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:144⤵PID:6204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,8168154021489069530,3689681267651207410,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:144⤵PID:6216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16537758040066899021,14429421635635659959,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:144⤵PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,12339581034643924594,14950504801277505029,524288 --field-trial-handle=2808,i,6862637170864642655,11454161094158506893,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:144⤵PID:6968
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7BD96C502DD2441F931AF0F721C361C2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6052
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3496
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28AD98ED2EDE41C4F4517660E055269D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1492
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5808
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5496
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3032
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3872
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ce17.rbs
- Size 26KB
- SHA256 84282954e24d8e69f939aa343362389990fe4dd31d72527f98e8b83a2fcdf193
- MD5 6ce59e820d82c7ed1457b6b8ddcac0e7
- SHA1 328f10785aa3a089e6a8cc7ebfdef05d9e4c913a
- SHA512 6df35576c2a1157a4a825646571f56657e02c95e839ba08c284731d8025087d673a0ffb3c3d3bda247e5769fd551eae142c896522db462fff717c57aefe730d4
- SSDEEP 384:wwmTNqRHquqWqS6KKqjC3pcvAQXSQxZKeiYAQqUbcrl1zKjSEUpXRP9pi4dOvica:wE0VNOpU/j5dCbhRMERM5hNd
- TLSH T11DC21101BD45C2C1FA363BF253276F4AAB158596DE41A61A01CB523EDFC2AB54F3B0D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Yamicsoft\Windows Manager\1-ClickCleaner.exe
- Size 805KB
- SHA256 b369442be6686a950d0fdd22ef9669ce1c921c518e0f0260f020c3678eb0d4f8
- MD5 15f51400d252706438baedb79d9c9346
- SHA1 9454be55e526222f2dcaba770f0278e63322b71d
- SHA512 306e0ab9343337cc6a22d931fafce77765bab3328d5e505cfa58f66853530e92682de1962ff555dbed22ddf2c09c41421575169c1e1c9a9c879d07d8d63e05f5
- SSDEEP 3072:2/3utpA7MDm+RUd6inBvzfWNJaJ6j8yIrx7MDm+pxWtwY:2+FK+CBvzfWWb+K+Qp
- TLSH T19A052C5AA3CEBB79C26A05F6E492756336519D133D1F8849E482FEEB36711C0732E903
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Yamicsoft\Windows Manager\1-ClickKillProcesses.exe
- Size 201KB
- SHA256 660b5337e1216d8b9adb2a2dc2f045144a82e6e81f0878c744b946fa1765fa35
- MD5 94871701efc3001a14e6c56ef1e73842
- SHA1 14dbef069d42802ae0d07dacb4c2e9198ff5fec4
- SHA512 fe7fce7643022dbe8c7342d62e07ddf07e5296d9dcb7332db33cbe8b28e11f98e65f20a93a935f104b38dd64c3b9f83e965a95834e49ac00fc3fdbba651d8fc2
- SSDEEP 3072:eoNH26UA5vOILB9s5rmC42cV5ZR5qKXPjxyYwf:1k6P9OA9sAC42cVPRoOPe
- TLSH T1BC14F7E9D550945DE93B04F9E7B4930C3FE06E61A80D5BC81FE73A8B097E6C02A4D987
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Yamicsoft\Windows Manager\WMPCL.dll
- Size 1.6MB
- SHA256 36d9a4b277a913e2a06b6a8b8a8e10f545efaacbb49571686911fc807648fb4b
- MD5 46339b1aa2383985f18a3f3dc226ed51
- SHA1 7bfa33da87faa6c99671bd2a822c1313be25bbbb
- SHA512 1e87a35bf55f0bc2f83ac01c271632c84c288bf82b19805d75ac9c7fd4b88683cd5e1e951341daa10eb409dea33e49acc6927896dd423e5cb6e76a55490254cb
- SSDEEP 49152:glbPGs34e08MGrUce16TCkcgxMuFmQGztjAqAuE7kZ:EDTEQ7
- TLSH T1BF759F10B3D88176E0B792788FBB8613F675B8550B3186DF63A0467E1E77AD04E36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Yamicsoft\Windows Manager\WindowsManager.exe
- Size 1.5MB
- SHA256 c6ff2aad6710c813c6ac315bb10e0e7d9fd0c4e4028ef0c5227d669d46d159b2
- MD5 97a16445781e7feddaddcec0fa27b7ae
- SHA1 bfcbe70f8741306fc479b6677f7d1a99f530535c
- SHA512 af7b7984367269595bbdbeeaa37343c10b44b7a1e2bad1117cab4e5d7441d130c99e018b4ffd9967dd43db17f4492d379e03c6c064f69b6ba0c148d80197f4cd
- SSDEEP 12288:oJ96KqHDkr+8EDlzoG8ulEvdroop8ulH+UxC4CGF/DL1vySglAR3f8ul7:i9EjZ8GzxEvdrVHyAkSglE3j7
- TLSH T13D75F7EB23846867C83C77315295913D13F7840EBBD7DA41AD932D880B86B8F6F29917
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
- MD5 e9af81b8f1175d007e2c699939cb3df6
- SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
- SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
- TLSH T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
- MD5 b989ec4e221bd567659492bc1ad7ab3b
- SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
- SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
- TLSH T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 76150964ce0c41e7b77a7bd5bd8c31b67871e7d4ddea1c2723a5222dc90aa9ec
- MD5 976319e7d71264eb91651beea19556e3
- SHA1 1335dd8f3f5bee5ee2f3a46ef2c3f938852ec19d
- SHA512 6659b25a855f29f0d2ca20cf3aa29cb97106b5b2ffc5b34acb017288c784e02725e4eac8462b779e58f49fe61e43bbd7037f0c2e3d730bd288e6997d821b49a6
- TLSH T17B81A5B4135F2521DB2700BB51F3E4993332F1D63113BE206B5BAF7A44163A92CAA4E1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5d35.TMP
- Size 3KB
- SHA256 048ac65cc040a69db196517fa9b526a11cbd10fe51db30295679e8087bb396df
- MD5 4891e91c92df499af7c6068bef9f1b8f
- SHA1 81aa1a8937dcf632cf75f4899b500d0345dea3e9
- SHA512 a3a924ca5f23399609d36481b9b32cd29543b945cc4389172738161e8290464fda2e817d9564f5f2d3b58d269b252266a1cdd0c54a9d34bfac390bfc4f8ffc08
- TLSH T1A671A4B8160F2625D723017B51F3F0993376F4D261137E206B6BAF7A44167691CCA4F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 8KB
- SHA256 255bdf78cc10bfc7e645c8e37c0862a0bb49ab0868f2e765507597d4bfb73dd1
- MD5 87c4c9107e671ffdc6e461671a14c647
- SHA1 3f013dcfa209036590546bd0c3a71ac8f1265517
- SHA512 83b0a656dffedd74929d7a812cf9efa2ffe16797b0ef5dd56318ea6a51c3bda011a00662ec8d1660d4891abd478d557a0fb6541db69f1b4f4230fb2699de9534
- SSDEEP 192:Dj2DSoGGxRt5UJRQ48a11DqqIN/30GfF7gqjTOzYIqVRzpkj6RgGcVg:Dj2DSoGGXt5wRQ48a11DqqIN/30Gt7gw
- TLSH T13F029DF783E5C92EDA5155F0AB68AE1BCE1D062943683C268DD9DE4BE3D3071F101A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 0aacdb7a409bf1b3bdea662bbd792a82b219e7099d916871cfc4ba89f1673696
- MD5 7f6dd0df8aead4a651e19cb7e682fd31
- SHA1 f3a95938a77fe0ea4d60acffc57ddafc7843b947
- SHA512 a5b6bc26cd95870507b8f1bdfca15c30a4d8c097a1f51ad93ab0bac27feea41520a5d977bc52a4a353f1ce3f114b4d2e8c4074e2193de9d515309517eb72a2fd
- SSDEEP 192:sxRJR9yM/jK1Ml8wck/f4eE0syQAZZ1q36ikXzoA8p9+/g6+WN8Uk/BHUtzaVIoc:sxRJDCk/f4eE0sy331G1X4/5M/PVmFOW
- TLSH T11862EA16A63469778CCBD219FB55BB67D6F41472E2900E48AAFCCE1C42E76EC211381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 ed3a04a1729b092ece5bd54d1638a8552695a689115769c6e387b1b6bc9c2f23
- MD5 4f541458548fe40dea4781d87ba45c85
- SHA1 6b02f5ab2d3b6a3b37b73ccdd31ca436be0afda5
- SHA512 c2aa8b62c4fdbd42755dc6d514e0a599730780bee2711fac339be5a7f19a7c95432d128134a740e825e2ac64d365ac41c49052229e1e223981e75aedb3d1f758
- SSDEEP 192:sxR2R9yM/jK1Ml8wck/f4eE0sqQAZZ1q36ikXzoA8p9+/g6+WN8Uk/BHUtzaVIoh:sxR2DCk/f4eE0sq331G1X4/5M/PVmFO3
- TLSH T1A262EA16A63469778CCBD219FA55BB67D6F41433E2900E48AAFCCA1C42E76EC210381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 cbf241725ec4c0217a5a6868e5121e66dd7000331d1bb0756c280b36c3c104fb
- MD5 ec1fd8b4bd3a221b418fa2fca6804b2a
- SHA1 ab795e4336c84c90379a51700f053d7a1f7d38f4
- SHA512 92fa6f2a0ab328035610d54877f697694b0a7cbdcfed3790634815cd9c1c611fc82df52c25ef8d9c6cbd2643c1d2ec95b8a38be7bc8fd78df57ab5b13194347d
- SSDEEP 768:7dUhBR7pLuL7tgWgEyfdw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKcGe0GwrodRw:7dUhBHE7tgWgEyfdwu1jaFcGRGbdRw
- TLSH T166E2FC3B680CCB7F4F404ADCE829BD9A6DA901CF9698CD5447EA880C03C6BEF55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5adb9c.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 5ce4c6647d253b80ded2759ab46f6a44bb4db75007c783a584441eb57c51834f
- MD5 b517b4987df81355a3cbee5e4c9ccdd8
- SHA1 a57f4bbbdf37286815431e4cd9dff29a26ffe53e
- SHA512 3fbfa5a639ea552ade4e29ad8dcb9f92e779ed61fd91331cef0034dcf6bdc7d7676a6795e77a279c026347f1cdc9009a94461641cae992be06a4954f8e56cb30
- SSDEEP 768:vj+9b3EO5Ug0McvnWgWWR+2SrXH78tRMub9MK:C9b3MJPWg1bSroXb+K
- TLSH T1DFF2BE30A8659EB38CE2D690B2067787BEE001A7C5895F88C4D99F0D46879ED1B17D2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 43KB
- SHA256 cc0760ef8b530f1e1afb997440c3b26fcfbdfe23920a25c12747e8d5d3602d6f
- MD5 5e987a3b678368ccf23d1ab037f4b8b1
- SHA1 30f4ce19f6d9aa7c8eea0434198606a503a7de97
- SHA512 696af61e0497819d2ad6f6475d9597477d32a8e5fbc5e6708a94fe17b53ef7dd24fba9cf30f028be99fea691bdbcb145cb4f84ec5d55088a898c524652204efc
- SSDEEP 768:4F1j+903XwgzA4geMcvnWgWWR+2SrXH78tRMub9MK:19039JPWg1bSroXb+K
- TLSH T1AB1318F198D38A72D8AE8783A33D6E469EFCC193B5885984B7C45D0CCD835BFC606819
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 8276805bb47bbced55071d8cadb7c973a6fcff9ba5be72e1f00dd350abedab38
- MD5 21a521f25a39cf19a51eb916b6bfd06b
- SHA1 e84e22e9e721a96e39fb6891ad2442d6be25b1b8
- SHA512 f4e7a9a342a91840645dd7c13b327a35c4d1e36d9f66d89966eab091ac39fd8a5073fc6251e9c370df83a21c51cb7a9b595aa2f5c8fc34d2415244329a45fb51
- SSDEEP 768:sj+9b3lO5Ug0McvnWgWWR+2SrXH78tRMub9MK:r9b3tJPWg1bSroXb+K
- TLSH T1DBF2BE30A8659EB38CE2D690B2067787BEE001A7C5895F88C4D99F0D46879ED1B17D2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 6d103832902f4314e227b0a71218304b32555b780a10d0b4d4fcf3ba7d2161b2
- MD5 ffd5a97d4845b97804cb30634ad3e71d
- SHA1 6773620abaca9718f88e2ebb6d0e98cfd6f7219e
- SHA512 195dbfe2a3926eaa10d1d1058ae89f8fbb9efeacdd72b085fb1f5c92c02467f9d388308d998f3e37963ce0ae3eb4fb077d47361ce8bb3f5a60ada874822588cd
- SSDEEP 768:Orv+4UNbdp3sE5UQMcvnWgWWR+2SrXH78tRkL+8rr6F:Obsb/3xJPWg1bSroaDr6
- TLSH T18D03BF32A8689D73DCE2D684B20B76037FF44183D6C91B88C4D91B4D839B9DE270BD66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c536a58-1000-45fd-b1dd-9d16ee252544.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI775A.tmp
- Size 391KB
- SHA256 fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04
- MD5 a32decee57c661563b038d4f324e2b42
- SHA1 3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2
- SHA512 e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9
- SSDEEP 6144:h95gAQAF0Zbd6hyEosZKE+JFiCnXxAO+VK7Gzds:hnQm0OAEosZr+KIoVLzds
- TLSH T1EF848C20B2D6C83BD17E45B03A6DD99F41297EA54BB2C4EBD3D81D2E05729C29235F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7816.tmp
- Size 864KB
- SHA256 98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392
- MD5 4e2e67fc241ab6e440ad2789f705fc69
- SHA1 bda5f46c1f51656d3cbad481fa2c76a553f03aba
- SHA512 452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c
- SSDEEP 24576:Hg+hzcrwW9QZty0+0Flvz0jGGlQ3qDwFVpxGVlxmyMB:Awq9uty0+0F1z0jdlwqDwFVpxGVlxmyo
- TLSH T1EB15381E75DE8636FF7E9238AA68D73660F97FE10BB144EB53E0556A0E244C101B2F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
- Size 1.2MB
- SHA256 78c0fbce260a95febf3172ee7aacbf7337aa91c3e2169d087ebf2c9c29553df7
- MD5 a5711fdb1754a1e531b78fb854b3c2df
- SHA1 55dbfac95d620895435d57a1f24aaf611d448096
- SHA512 1535835287f3195c09e83bd236d4ea47fad490748f9c45c1e2b945754d4b1bca39101415a0921d7e6be4e4e60954cc16219d598824e089613a6e73e9b3ae3552
- SSDEEP 24576:O5ZWs+OZVEWry8AFPK92jZLqzVqKDw/GPwlxsZP7Lr6XJ:OZB1G8YikjZmBNwleLO5
- TLSH T1F845F109F79809F8E4B7E138CD575912E77A7C1E07619A8F13A4326B2F732909D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsmanager.exe
- Size 35.1MB
- SHA256 de36d81cd46f13ef5b91a9ded70c40e8e412eb6a3d6ba9f8c8ff58584bf2e8da
- MD5 ca666cd87f9c0c5674cdc16a16cd0826
- SHA1 4c15ada2e27cf798bff74c12eb70bbda89932562
- SHA512 aa53442b83fafd60be7713f5dd7c20decc68fdbc788e3feca4be8fd41019d5d8586818e4b9a043c214cc4f8f3a4ae2d4d3714350fb9b8f77b776625d5235316e
- SSDEEP 786432:S+ij+ih7eB7ejOoc5w4b2UMfzyeoID4wNC0KHtyP45Hma:Odh7eB7epc9KUGyeND4A5KHow5T
- TLSH T11A87E019F1C78126D5AE01B28928FF3F61753DA32B3640E7ABEA7ADA14714C15235F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3356_1107064197\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{91468D75-3686-4464-A81A-58D9173C7A73}\ClickCleaner.exe
- Size 363KB
- SHA256 42ae8d573a238fe4e6c16c9b36bac7a1941b27e9e05b818965300a1888984b94
- MD5 56065f9fefd87d5efaa984eb1c72ea87
- SHA1 8e60ad364a983fd3142c7e543653174f6e02abaf
- SHA512 6e84f75b9b0c8500cf609824e2e10fdede354c47f18c268e1cbb5f99bacacff53cd552864446a349940e6e726b8208f696f6fb989f1b36e32d9246386f7d7b52
- SSDEEP 384:a5PTElOGutP4URNCt3Mo81H+3203FLCkhcx49BtnNiau8UVAnvK8k+PAQWKyYrBm:aGOvtjo8ou41hBtNiG8+BW02DIE
- TLSH T1AB84306AA3DEBB78C62A04F6E582756336119D533D1F4849E082FEEB76710C0732E947
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{91468D75-3686-4464-A81A-58D9173C7A73}\ClickKillProcesses.exe
- Size 153KB
- SHA256 d9da5c3b8cb47e554645906afbb9282f4e152df70c4b9fb3369ed78740f596a7
- MD5 1a9606656535fbc7da90efae342b5b61
- SHA1 2255ecd14d4bb8b915ba623b27435d6c1e908c4b
- SHA512 729826c9c22e3a4fe49d320d3cafc12c9e00abfc62c3ed7896d63dea050b71a11c5604bab41a7e4e7f34cfe6c35e818c5c7ce8e5091ac760f34a370604bc939e
- SSDEEP 768:HJf9xTIhbzKVVgEAjBr6ha2WIVY6TRj6Mq3l0bcQ6RV5/+F:HJfrmCVVgE4rwVWIq6TR5qVHRX/+F
- TLSH T1BDE3FDE9D560A84DEC3B04F9E774930C3FD06E65A80C1AC81FE73A8B497E6C1664D987
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{91468D75-3686-4464-A81A-58D9173C7A73}\WindowsManager.exe
- Size 126KB
- SHA256 11ef7746988501170ea938ec984d4c089b80a96e21675ec6d172a7a17ee22906
- MD5 cccb73a0b31f82b73ef413f827d0a56c
- SHA1 ff554129a79d1d0a70c938d91c38347b961b800e
- SHA512 9be94df48104ff087b47f9539357fb1111930ac1fcef9918b90fe48b8137a15eba7a50ad4a9efd3b5a08298f0869f71ec705e2b7389d49b7eafe45b412b45504
- SSDEEP 768:9DLpjLcv8m2lXdq0HeoX+gDfenz9wBbcTaQeMgW45saymy7PKEpOOOOoOOOOiOOP:oLM1H9dmzKBsDDucrE18IhS6teOs
- TLSH T1CEC3F83E98402429CA5D7871524372B5731F988FAE8B6961C7977380502CFFABE7E253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yamicsoft\1-Click Cleaner.lnk
- Size 2KB
- SHA256 83d15b0d2c170ded0a6cb971a2eeb7acb95716d62dc1883b58ba03bbd69efb76
- MD5 4dd2d515fa8ac174986ba65efb0192b2
- SHA1 5f3799f6dc28449efacd1f91a3c18b0298cefc41
- SHA512 49ed81cf38e9af51fead7c03f7f4f3aef3da7737e9153e25980a87fe181e423bee9e322dd005bbbd5660f497929cdb0cc53190fe7cc3d96c7219ef033c728fdc
- TLSH T18041BD004FE92B6EF3B3D6B56BB25911EB32FC25F604CF1A00878144043A9428DA4F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yamicsoft\Live Update.lnk
- Size 2KB
- SHA256 2ba1f55cdc19e8889a6799a9d81509f8bfbad45e6625b348833e82e5afb6bda1
- MD5 64b2309359cbd775f80d379c4edb022a
- SHA1 547707275aa71660096fb22fe347e102c3036f89
- SHA512 fc56600758c96e21f74b66dccb93c7cac2dcb1fa8984a10502ca0f1dd9a581b51a475badb18cac78812783cccd61bb664547cb3ac2fbff7bd7da419bd2983d79
- TLSH T11041CF111BE5276AF3B7A63557721911F732FC02EA05CF0E408681840826A41C8A8F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yamicsoft\Uninstall Windows Manager.lnk
- Size 1KB
- SHA256 f4a4b688c341ef9910b0072d97ca900a31593664f34d2253b064680d0c62a53e
- MD5 45fbc080db929e47a1d5b19437ac10b2
- SHA1 6bb288e220f051d7bcaa78da4cc5f7b1caaa7d6c
- SHA512 63261bcb634ed23ddb1d234ed8d69681163ced2a6f6b0dcba17deae091452e22fe207c4610592bd489e78e4aff04945f5f2b775ea09f526aa8b7c7bc26127d43
- TLSH T1C041E1100EEA2777E3B5A57593B56A11FA32B802F953CF0E400283C31827953DC60F6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yamicsoft\Windows Manager.lnk
- Size 2KB
- SHA256 b765f88c3f84481234a7667cead16dcc74240526e2e5e0f039642ab10abfc0d8
- MD5 8b3ffd6c878c6ba1c526d3bdd716c0d8
- SHA1 d36806cd02e1b6b69eb93fdc0b031296a7cc40af
- SHA512 f2cd7c647757109ba4b3ee6f6c5e5b758359000072a60f7ce0210a51dc7965e32d87f31066053a75a6661869416ad2b0d0f4c1d16e707020f664f17aad25e60a
- TLSH T11B4169004BFA172EF3B7AA36A7761A11F732FC06E645CF0A414681480827652C9A9F7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Yamicsoft\Windows Manager 2.3.9\install\WindowsManagerSetup.x64.msi
- Size 5.4MB
- SHA256 440ec0a6d79b067610705784fe7095d22cedf6ce50819a3a68ded4a64726ed61
- MD5 d525cba80bfa4b5e49ad537cac1f6f91
- SHA1 efcad751d1241ee75be4cfcbf72c4fc09c98c40d
- SHA512 6d6af29062e46234fe45ec31b5e07980dd981548ad1271a0abcf73af60b1ddd489b31270209ed0805ab88134721802de6f878ed22173d377bd80cf415c7bb7b7
- SSDEEP 98304:1Y6Aoq921z0plnqn9Dwu/HxM1QOtjF1/v5mfg27:jhSlnqRHxM1Tv5m
- TLSH T134469E1A71C49136D52E01B0D519A73735AA2DF16F7B40D783DABDAB29B00C0633EEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Yamicsoft\Windows Manager 2.3.9\install\WindowsManagerSetup1.cab
- Size 19.1MB
- SHA256 dd2762cd7494df7582dfded7a354b91fa248e7d5c99e601a9371cc125f03d279
- MD5 e595fd2696a8a942e546f2788b23e512
- SHA1 dc6092e32d77bc15d63499c8b374843a4576d396
- SHA512 f2b31724100f7f178a845c4d3717f009d8fb14bb7573baa0b3b65ad9224472aa38d58b846f1cdd3bba26d1366b413a053cf52f5431eece919903a22a85d6f505
- SSDEEP 393216:qnEPqEdp8dc5wHYUajuFO1n7gS5OVf3DE0d2Y7UdrqobEDWvrwzxC0KHw6yuSxpi:qOoc5w4b2UMfzyeoID4wNC0KHtyP45Hv
- TLSH T1CC17339EB1661434CAC68539B6F15C9CB1BA3B21A128C5A4531D0B49FAC1FF5FCB04DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\1-Click Cleaner.lnk
- Size 2KB
- SHA256 ebbd689f639edd48996bcfce5e03aaa3edf6021894cad9a20fb21ba515350623
- MD5 f8c617bf0ebd844392155667b30b6e5f
- SHA1 1f489009d0bcf37412aa767afe49368aa707f7d1
- SHA512 bda2ac6efb405970faaeb627b772c5d0d22ae1f5901a3bb1c3a35cf6b6fcf9e6a224e752458b276a0adc96af3a92fa5d0e47b939499d59e25b853b31373c4009
- TLSH T17B41CC104FE9166EF3B3D6B96BB25911EB21FC26AA00CF0E048781440832A428DA5F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\1-Click Cleaner.lnk
- Size 2KB
- SHA256 a903a74c5fafc41469de301689ea3fa2f97e8980e421ab9e1aa5be59f8a50ba1
- MD5 8c97bcefd44e6cb82f75be7ca23c9cbf
- SHA1 190cbf48cfd53d7ec1ab2a3a990fb65a7a0f9e5d
- SHA512 61ce2fec8e386bcf04f927adf2c2709a8cb7955bcf34fa7d3ed6ea7554b28404e463852f13e3918270cbc6c9dcca999742a3fe32a64b03e72c5328531c567e29
- TLSH T1F1418B004FE9166EF3B3DAB56BB25911EB22FC25E605CF1A4487814414269428DA5F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\1-Click Kill Processes.lnk
- Size 2KB
- SHA256 d86b1328ddbff8d57a2ad398578b06d574d6543eb828f1eac547c4e2a295d7e0
- MD5 8205f4a4cf34a9ab0e068c4758973f49
- SHA1 1add456830273b494ea368b5c99443df37d1380f
- SHA512 4b3c762b05c81820ed7f30b6b2df04f659a3226abb4588456bc47d6f89267a0e3fe76d2036c2065ec570bf5e6939d5f9775b894404ef10117098724c910f5a77
- TLSH T175416C114BE91A6AE3F796767B761911FF21F812AF128F0F008781441962A65CCB4F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Windows Manager.lnk
- Size 2KB
- SHA256 63d92df01c7f0cfd5c2409699bef7d471c947b090908a3239c3696214a8214c2
- MD5 20ddc236454947f975be6aec7b138d47
- SHA1 92c679e35b665923b2b2ec32deb4675d59fbd33e
- SHA512 2e7c530d59fcf4d17c28ccf81c936bb254af30207b50c21fea1c87514098e3e097a6729dcbbfef60d41f1036e805c1b99521b3561d5dca63d1f3ee1acd7d0994
- TLSH T110416B104FF9066EF3B7A63B67761A12FB31FC16AA05CF0A418681440863652CDA9B3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Windows Manager.lnk
- Size 2KB
- SHA256 eba5ce24895e92567067f4c9804b907a824bc6cba23bbc6a7c354cfabb9a0dd6
- MD5 6908d1ffea5363b3737927eafb880bdf
- SHA1 4164f2a132eb9910e0d18a25869c1913b06f4e3d
- SHA512 55f3a9a5423447e3b89ba84a7ba7e331a964c12dba38ed7c9e3d5347a39b325f41cba0ddf714a20b65ed2f325be477b1ae1f9641832f2d98aac9e247f7a4940e
- TLSH T1D7418D004FF9062EF3B7A63B67761A02F732FC16A605CF0A414681480867652CDA9F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSID412.tmp
- Size 569KB
- SHA256 41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14
- MD5 0be7cdee6c5103c740539d18a94acbd0
- SHA1 a364c342ff150f69b471b922c0d065630a0989bb
- SHA512 f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c
- SSDEEP 12288:ExMVLwCHV6PNm0lA2QH3/ORiY/u1IOTyQtx7N6SfinDlVPJ81EPH7f:ExMtw+Hvu/bOJTUVPyqPH7f
- TLSH T105C44B20325AC43AE47D45B02A6CDB6E61697FB20B7A54DBA3C85A7F15F08C24731F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIDC17.tmp
- Size 674KB
- SHA256 57ebe4a47b8abeb2a820b70425d933c0cd9eee3a2694fa937dcb7f71f862353b
- MD5 2b2f5bd201e94e6581db48ee94ab88bf
- SHA1 6809304d630bdabc4c684e20fd46f6fe2cbd65e6
- SHA512 a2ddc11b2b48774e6a17385b22facd9c1721595b5146c64fec289d311fd6d25fce4e455f91b5979279662a3611ed7ea34b6ed2aa14f8746f71a42657d3feede8
- SSDEEP 12288:mMojAdsv4WgOAsFwu4YZL//5yYAVN+NltKx:l5Wgswu/pAVN+NltKx
- TLSH T1D3E45B31354AC13AE57D4170253C9A7F60B93BB20B7254DBA7C85ABE58B49C24336F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIDDCE.tmp
- Size 269KB
- SHA256 c3b04fcf6aab702f3fd2e26728b9c5fde96c288bea5e52c4122433dd41cf48a2
- MD5 e665cf6f92685a531f9122623453f00d
- SHA1 35316d190fe0b895f8c871ff509df1b6da05d17d
- SHA512 dc8ee378dde88f74f17be171c6fbcea6a879e018d485f6147928cd1030bf77294a554045c62d6e8b4c268878a3e9e2c3b6b9daf55525e3bb14963d41b41a83d5
- SSDEEP 6144:O+U4KRwtkBq4OwBNVBdDSICAOb+q2Kl3QG6:O+LwwKBq4O7Iq2KlAG6
- TLSH T168447C207592C43BE9BF0670152CCA6A147CBB614B61C4DBA3DC1E6E8E356C39631E6B
- MD5 SHA1 SHA512 SSDEEP TLSH