Overview
overview
8Static
static
5latest.zip
windows10-2004-x64
1latest.zip
windows11-ltsc_2024-x64
1Content Manager.exe
windows10-2004-x64
7Content Manager.exe
windows11-ltsc_2024-x64
8acmanager.acsound.dll
windows10-2004-x64
3acmanager.acsound.dll
windows11-ltsc_2024-x64
3acmanager....ir.dll
windows10-2004-x64
3acmanager....ir.dll
windows11-ltsc_2024-x64
3acmanager....ls.dll
windows10-2004-x64
3acmanager....ls.dll
windows11-ltsc_2024-x64
3acmanager....pc.dll
windows10-2004-x64
3acmanager....pc.dll
windows11-ltsc_2024-x64
8acmanager....al.dll
windows10-2004-x64
3acmanager....al.dll
windows11-ltsc_2024-x64
3acmanager....ng.dll
windows10-2004-x64
3acmanager....ng.dll
windows11-ltsc_2024-x64
3acmanager.tools.dll
windows10-2004-x64
3acmanager.tools.dll
windows11-ltsc_2024-x64
3actools.ac...on.dll
windows10-2004-x64
3actools.ac...on.dll
windows11-ltsc_2024-x64
3actools.dll
windows10-2004-x64
3actools.dll
windows11-ltsc_2024-x64
3actools.ex...ls.dll
windows10-2004-x64
3actools.ex...ls.dll
windows11-ltsc_2024-x64
3actools.ge...ds.dll
windows10-2004-x64
3actools.ge...ds.dll
windows11-ltsc_2024-x64
8actools.kn5tools.dll
windows10-2004-x64
3actools.kn5tools.dll
windows11-ltsc_2024-x64
3actools.laptimes.dll
windows10-2004-x64
3actools.laptimes.dll
windows11-ltsc_2024-x64
8actools.ne...es.dll
windows10-2004-x64
3actools.ne...es.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
109s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 17:16
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
latest.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
latest.zip
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Content Manager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Content Manager.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral5
Sample
acmanager.acsound.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
acmanager.acsound.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
acmanager.contentrepair.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
acmanager.contentrepair.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
acmanager.controls.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
acmanager.controls.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
acmanager.discordrpc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
acmanager.discordrpc.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral13
Sample
acmanager.internal.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
acmanager.internal.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
acmanager.largefilessharing.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
acmanager.largefilessharing.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
acmanager.tools.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
acmanager.tools.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
actools.acdencryption.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
actools.acdencryption.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
actools.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
actools.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
actools.extrakn5utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
actools.extrakn5utils.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
actools.genericmods.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
actools.genericmods.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral27
Sample
actools.kn5tools.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
actools.kn5tools.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
actools.laptimes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
actools.laptimes.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
actools.neuraltyres.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
actools.neuraltyres.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Content Manager.exe
- Size 10.8MB
- Sample260707-vs9hbaav2v
- SHA256 2367612db7c754bf4f07a0f71188c0cc7ed0e39bef12b7dc3f4af3d0b3ec5bd4
- MD5 60ed4bfbd48a0d1c161d123749ba6586
- SHA1 f21f2d4b038602ebf923fadcb4cbe07cd3b4979a
- SHA512 3e11841e4c1c65ec8d19ff125c515d4ba1f3afc61a92ae18aa8466ae50dbeba4b9ee179211ff3b7b47f31675f761e02bd6cc00fdb373d979b7d10c2d297540db
- SSDEEP 196608:frtCBAX8r+YmyLN1cLu481HQSMj2f/ZaZR97IB/Nv1:DtCBi8yY5b4+wS+8GLi51
- TLSH T199B6E04863FCC92CE4BF4FB1B97150514B797E4A5F82D39F1904786C2A723828BA6367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Loads dropped DLL 6 IoCs
pid Process 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral4/memory/3772-38-0x0000000006510000-0x000000000653E000-memory.dmp ConfuserEx behavioral4/memory/3772-46-0x00000000037E0000-0x0000000003814000-memory.dmp ConfuserEx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Content Manager.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Content Manager.exe = "11999" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL Content Manager.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\Content Manager.exe = "1" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\shell\open\command Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\shell\open Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\shell\open Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\URL Protocol Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\shell Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\shell\open\command Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5 Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\DefaultIcon Content Manager.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe\" \"%1\"" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\DefaultIcon Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\shell\open Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe,2" Content Manager.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{099678CD-9DFD-4BAF-888A-FC8697332C6B} explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\ = "AcTools Content Manager" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\shell Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe\" \"%1\"" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\DefaultIcon Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\shell\open\command Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\shell Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay Content Manager.exe Set value (data) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\shell\open Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe\" \"%1\"" Content Manager.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{E15B16F9-AE34-472B-9005-A5D9A538D057} explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\ = "KN5 model" Content Manager.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe\" \"%1\"" Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\ = "CM preset" Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.cmpreset\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe,3" Content Manager.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.kn5\shell\open\command Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager.acreplay\ = "AC replay" Content Manager.exe Set value (data) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\DefaultIcon Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\acmanager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Content Manager.exe,0" Content Manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3772 Content Manager.exe 3936 explorer.exe 3936 explorer.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 3772 Content Manager.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe Token: SeShutdownPrivilege 3936 explorer.exe Token: SeCreatePagefilePrivilege 3936 explorer.exe - Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 4492 sihost.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3772 Content Manager.exe 3772 Content Manager.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3772 Content Manager.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3772 Content Manager.exe 3772 Content Manager.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe 3936 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6012 StartMenuExperienceHost.exe 2656 SearchHost.exe 3936 explorer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4492 wrote to memory of 3936 4492 sihost.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Content Manager.exe"C:\Users\Admin\AppData\Local\Temp\Content Manager.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3772
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3936
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2656
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\AcTools Content Manager\Data\License Plates\Europe (Kunos)\common.ttf
- Size 18KB
- SHA256 2256148f42a64effedffd122993c52ac5389e52bfc5b299811952e5e848a043d
- MD5 4f4bddb1873e2da16584a17929ed6eaf
- SHA1 1019888f9d7b0cebbadb0da2a2b9764398fa28e6
- SHA512 4ee73b89b43f99201a43640855690dc430da53004db569b034712d624aae8ff3a1fb53dae23ae6886383a94ef28500c707390b2d7687b071f4da85f039a45b34
- SSDEEP 192:8oaXyvmL4p6OTlL1AIRwaULwyXpAPjt6ChyDu+6T56ChRDudhq/Tuul/gUURhvfZ:B2yvmLMjAIRzKjpAWq1qDqbl/gbhnlmS
- TLSH T10F82B44877604A31E2F249F6DF75876923EEF5CF2597D31BA5851A430C3C0B089E8AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AcTools Content Manager\Data\Track Categories\Fuzo.png
- Size 21KB
- SHA256 eea599c26a2a3c3c8f598a1c2c06c1b25e3dc86cacd47ae77785138713af35a6
- MD5 200a4e8b3b0369244d7ae13ba6786573
- SHA1 05fa411bdce9638be811d5ac2fcd3b2afde4b4ab
- SHA512 3631c7a5a4b26ec262c8d385e40133e3fa4ac3a33a52ae79c4e5423bb9eb4d2dab94d63400533af0d1dbc52c4912c440ba8355e61ec9c150cbf0b4cdd4a62579
- SSDEEP 384:JG+rOnj+v+32uQMNJsGmch/EuWKT1D6z/hBSPN2+WMV:JNmmvYDnh/ws1D6zOPo+f
- TLSH T12AA2E0C3AB3E6C7FD40174E3688562C1D8B8AB4D166BFF9EFE4D7C69884D8B41414049
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AcTools Content Manager\Data\Track Categories\macedosti.png
- Size 4KB
- SHA256 d88ffc7ce6eceb4e9477ee25d4055ad94dacc73aed9c6adf27787a4024bbe1bf
- MD5 75de95f52f1d4449a49dfe277eef01f8
- SHA1 5c6061831e2bdf2ba26545048c05eea2295e6f38
- SHA512 bdc231207c05bf20e1ff3c50b51ff9516f8be5390c8970216f6e6c43eac163d872ae568ae481bffdf265e08c0eba85690bef3c742bf03fa88e44a442b91f52a5
- SSDEEP 96:WDFSOm36Wp/szl4hytV44dqVB92uqvhfrLqKNWw:ANnWg7tbsB92um9rGq3
- TLSH T1AA814B3C2429E856CCAF1675C62FC0838A75BE811E441DB3AAF6397F4A74508A8155C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AcTools Content Manager\Data\Track Categories\remjzx.png
- Size 7KB
- SHA256 76eea205ea9736bc5d58e0486b797698ab6c71f954f7423921bab0d772f2ea25
- MD5 9e13022ef45c6cb17c62b1059ac4189f
- SHA1 8639212fd2c435d1c194a78d6c764eec03351ac3
- SHA512 38cf7b5e572654916d9b84b73fc252e47e0163866b500e5fa80aace0a210f9717a7e557b67517ffd5bb50c27c3b6206b59d9c9e08653d855d3b9ae4fe6f92fce
- SSDEEP 192:gkp3ZLiKtYlfjECrM8ifYvzvMNtUv10wdLmVBdNNy5uJzg2:Rp3kKmY8ifyzvStU+oqdNNywJzg2
- TLSH T11AF1BF7896AEA2D5D602480FAEC925D7C42E170B32DBF782905332D6007163C86BE4CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Costura\80020E73785608EBC4CC66D86D9D69C2\32\interop.d3dimageex.dll
- Size 69KB
- SHA256 d9eab44547374b7a7ac21fe4a36bf79049b3373865fa319c371578368e716ab5
- MD5 d924c109da0f7a9e1debc63cb6d9b30b
- SHA1 12d448adec917d57e5209f0eacd9a6d97d1fb9b7
- SHA512 3054841853e8f4e8aad20b64d973e6eec2b81c04a81296b471e365513433fa9d8f5dca63e855fd3379e87c30fe6c066f5374e3d0f42873e16d83557f075fdb8f
- SSDEEP 768:MVElV/fknCwEPONchPwBqX0mqpVzaaS0GfHkLfuWcptQY8lyQoHd1:MWlVHknhEqchPqq+zaaSiLfu7tQ6Hd
- TLSH T1F063B32633635B66E798C53A7822F140619CFC8E4B92D3076D8557CE8A372A21DC5BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Costura\80020E73785608EBC4CC66D86D9D69C2\32\nvidia.texturetools.compress.dll
- Size 540KB
- SHA256 d8ed3a09e150d8608940497267ab6bcbd3cdc9d59fe4b50b849e1ff8344141ba
- MD5 74654ed00f7e89f80dd1bbbf4d02c402
- SHA1 49f0236f29e4bd87ce459d120aa57c9ad10971c1
- SHA512 16824ca19188ab61020928927bec1fd1541cfe69da70caeedfb120538bc31f2cbd05bf7fd7b246d93dc0eed3e14623a739317dc40ff3ed846022c85b03ef21ee
- SSDEEP 12288:DVMaX8WFFMlX4CigXRJnZ+jga4Lj4A8SuuRmp:DVMaXiVVhJnZ+jga4GSuu6
- TLSH T1ECC40502ABEAB9D2D579107037BA33CBD738DD900711C9EB92E558968D781D239F23D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Costura\80020E73785608EBC4CC66D86D9D69C2\32\slimdx.dll
- Size 2.0MB
- SHA256 c54dba6b35525be2d1a7dff11954423daca65ebb3f7022a9f58389f899956205
- MD5 ba01667f0579aec6e0f9c702431a23b5
- SHA1 5c4f4ec1e21a6e04dbcdf6f2dca589f2ee01ce09
- SHA512 4249afd3219083075a584cc7d30e4b281baa1e34724a8af845db4414d07b9208bc731f65542c2115042dfa22426f9cba4a5f01aa4eb4572e65e0ae82c8b3ee87
- SSDEEP 49152:Q20IDxaQZIy6RBmo1LkYqmR8Hs0FKVn+eSO4Z1Ku/lAAM2ZUT50U/0IwUo006nR2:ZDx
- TLSH T147A54A0173D9842AE2AF77F1EEE28A6DC325E1D49353E30B2151513B18A97C5AB172F3
- MD5 SHA1 SHA512 SSDEEP TLSH