xworm | 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981

Analysis

user interaction
yes
max time kernel
81s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SECURE BYTE GUI.exe
Size 9.7MB
Sample261016-w5thasbb48
SHA256 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981
MD5 7d422cc9f11fb105ee11dd00ff43b8ad
SHA1 688b78961d938249531980af04a02781d6ea6fa0
SHA512 69170cc57af4b0490bee8e72ee588a5c25debb42b450b12e041a41028314b755e786722fc17057b8cac700986e6d55464a89a0c24e64d3eb29c5ca8a9112a8f1
SSDEEP 98304:2mzLl2SADPtxo/DEkMx/HUYDGSXr5Y3BPyU2WQ:yDVe/D7MFBGSbO3L2
TLSH
T1B3A6877951CF7227CB6121F2FE03A8EDDA5B75CAA372810876851C96C5CF9C2A478CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware bootkit collection crypter defense_evasion discovery execution xworm hacktool packer persistence privilege_escalation rat spyware trojan

Malware Config

Extracted

Family

xworm

Version

m7mnga-38338.portmap.host:38338

Mutex

JigXrL7925vRQAGo

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2516-108-0x000000001BBF0000-0x000000001BBFE000-memory.dmp	family_xworm

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3416	powershell.exe
2196	powershell.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\winlogon.exe	winlogon.exe

Executes dropped EXE 5 IoCs

pid	Process
3356	SECURE BYTE GUI.exe
5792	window.exe
2384	winlogon.exe
2516	winlogon.exe
3488	iiurfr.exe

Loads dropped DLL 2 IoCs

pid	Process
3356	SECURE BYTE GUI.exe
3356	SECURE BYTE GUI.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Packer/crypter tool: SecureByte 2 IoCs

SecureByte: an open-source packer/crypter that encrypts payloads and produces obfuscated executables.

hacktool packer crypter

resource	yara_rule
behavioral1/files/0x000d00000001c4dd-43.dat	securebyte
behavioral1/memory/3356-54-0x0000000000400000-0x0000000000652000-memory.dmp	securebyte

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	iiurfr.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x000500000001b8c3-64.dat	ConfuserEx

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winlogon.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\dwm.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\ole32.dll	iiurfr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs	Explorer.EXE
File opened for modification	C:\Windows\System32\csrss.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\smss.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\dllhost.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\user32.dll	iiurfr.exe
File opened for modification	C:\Windows\System32\gdi32.dll	iiurfr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\Desktop	Explorer.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\Desktop\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\System32\ntoskrnl.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\wininit.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\svchost.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\spoolsv.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\ntdll.dll	iiurfr.exe
File opened for modification	C:\Windows\System32\kernel32.dll	iiurfr.exe
File opened for modification	C:\Windows\System32\advapi32.dll	iiurfr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned	Explorer.EXE
File opened for modification	C:\Windows\System32\services.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\lsass.exe	iiurfr.exe
File opened for modification	C:\Windows\System32\shell32.dll	iiurfr.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	Explorer.EXE
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	Explorer.EXE
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	Explorer.EXE
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	Explorer.EXE

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe
4684	cmd.exe
1760	cmd.exe
5960	cmd.exe
4740	cmd.exe
3608	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winlogon.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SECURE BYTE GUI.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6052	timeout.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\InternetRegistry	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LinksBar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\IntelliForms	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\13	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\15	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\19	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\20	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\33	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\7	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Security	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Suggested Sites	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Zoom	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Download	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\24	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\26	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\34	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\word	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\18	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\29	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Desktop	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\31	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Document Windows	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\27	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\16	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\22	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\28	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\PageSetup	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\GPU	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\10	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\23	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\powerpoint	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Services	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\IETld	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\11	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\17	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\30	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\37	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\38	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\TypedURLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\International\Scripts\4	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry	reg.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.System.AppInitiatedDownload	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubOffSound	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\WindowsUnlock	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call6	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call8\.Default	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\Assemblies	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\MicrosoftWindows.Client.Core_cw5n1h2txyewy!Global.VoiceAccessHost	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Personalization	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Microsoft.CredDialogHost_cw5n1h2txyewy!App	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy!PackageMetadata	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\CTF\SortOrder\Language	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\MessageNudge	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUnlock\.Default	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\Schemes	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\RestoreUp\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Connection Wizard	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Accessibility\SoundSentry	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\UEV	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\MicrosoftWindows.Client.CBS_cw5n1h2txyewy!WebExperienceHost	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\CriticalBatteryAlarm	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\MisrecoSound	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Input Method\Hot Keys	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\MicrosoftWindows.Client.Core_cw5n1h2txyewy!Global.SnapLayout	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\AppGPFault	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Open\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Lock Screen	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Power	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Minimize\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.SMS\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\New Windows	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\AccessFlags	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy!App	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call9\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Accessibility\AudioDescription	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Input Method\Hot Keys\00000010	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\InputPersonalization\TrainedDataStore	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy!App	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.AudioTroubleshooter	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Maximize\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\MenuCommand\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Desktop	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\WcmSvc	reg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlm	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0083-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xsl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppsm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ttf	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0039-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wma\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ptx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0056-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0068-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\AppID\OneDrive.EXE	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wbcat	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dqy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ori	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.kci\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.onepkg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.text	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdm\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0063-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\ddeexec	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdm\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0072-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hol\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.imesx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.orf	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0055-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xbap	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tif	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vro	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0065-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdHocReportingExcelClientLib.BusinessBarActiveX	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0053-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0081-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1064	reg.exe
2760	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	window.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	powershell.exe
Token: SeSecurityPrivilege	3416	powershell.exe
Token: SeTakeOwnershipPrivilege	3416	powershell.exe
Token: SeLoadDriverPrivilege	3416	powershell.exe
Token: SeSystemProfilePrivilege	3416	powershell.exe
Token: SeSystemtimePrivilege	3416	powershell.exe
Token: SeProfSingleProcessPrivilege	3416	powershell.exe
Token: SeIncBasePriorityPrivilege	3416	powershell.exe
Token: SeCreatePagefilePrivilege	3416	powershell.exe
Token: SeBackupPrivilege	3416	powershell.exe
Token: SeRestorePrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeSystemEnvironmentPrivilege	3416	powershell.exe
Token: SeRemoteShutdownPrivilege	3416	powershell.exe
Token: SeUndockPrivilege	3416	powershell.exe
Token: SeManageVolumePrivilege	3416	powershell.exe
Token: 33	3416	powershell.exe
Token: 34	3416	powershell.exe
Token: 35	3416	powershell.exe
Token: 36	3416	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe
Token: SeUndockPrivilege	2196	powershell.exe
Token: SeManageVolumePrivilege	2196	powershell.exe
Token: 33	2196	powershell.exe
Token: 34	2196	powershell.exe
Token: 35	2196	powershell.exe
Token: 36	2196	powershell.exe
Token: SeDebugPrivilege	2384	winlogon.exe
Token: SeDebugPrivilege	2516	winlogon.exe
Token: SeDebugPrivilege	3488	iiurfr.exe
Token: 33	1308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1308	AUDIODG.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1808	OpenWith.exe
4168	OpenWith.exe
2332	OpenWith.exe
4776	OpenWith.exe
2028	OpenWith.exe
980	OpenWith.exe
6072	OpenWith.exe
5016	OpenWith.exe
1256	OpenWith.exe
4192	OpenWith.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 3356	4280	SECURE BYTE GUI.exe	94
PID 4280 wrote to memory of 5792	4280	SECURE BYTE GUI.exe	98
PID 5792 wrote to memory of 3416	5792	window.exe	99
PID 5792 wrote to memory of 2196	5792	window.exe	102
PID 5792 wrote to memory of 4972	5792	window.exe	107
PID 4972 wrote to memory of 6052	4972	cmd.exe	109
PID 2516 wrote to memory of 3488	2516	winlogon.exe	112
PID 3488 wrote to memory of 4684	3488	iiurfr.exe	114
PID 3488 wrote to memory of 1760	3488	iiurfr.exe	116
PID 3488 wrote to memory of 5960	3488	iiurfr.exe	118
PID 3488 wrote to memory of 4740	3488	iiurfr.exe	120
PID 3488 wrote to memory of 3608	3488	iiurfr.exe	122
PID 4684 wrote to memory of 1376	4684	cmd.exe	124
PID 1760 wrote to memory of 1064	1760	cmd.exe	125
PID 5960 wrote to memory of 2760	5960	cmd.exe	126
PID 4740 wrote to memory of 2472	4740	cmd.exe	127
PID 3608 wrote to memory of 5840	3608	cmd.exe	128
PID 4844 wrote to memory of 2980	4844	userinit.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Users\Admin\AppData\Local\Temp\SECURE BYTE GUI.exe
"C:\Users\Admin\AppData\Local\Temp\SECURE BYTE GUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\ProgramData\SECURE BYTE GUI.exe
  "C:\ProgramData\SECURE BYTE GUI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\ProgramData\window.exe
  "C:\ProgramData\window.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEE6D.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:6052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Users\Admin\AppData\Roaming\winlogon.exe
C:\Users\Admin\AppData\Roaming\winlogon.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Users\Admin\AppData\Roaming\winlogon.exe
"C:\Users\Admin\AppData\Roaming\winlogon.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\iiurfr.exe
  "C:\Users\Admin\AppData\Local\Temp\iiurfr.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\System32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies registry class
      PID:1376
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCU /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\System32\reg.exe
      reg delete HKCU /f
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Manipulates Digital Signatures
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      Modifies Internet Explorer settings
      Modifies registry class
      Modifies registry key
      outlook_office_path
      PID:1064
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKLM /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\System32\reg.exe
      reg delete HKLM /f
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Modifies registry key
      PID:2760
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKU /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\System32\reg.exe
      reg delete HKU /f
      4⤵
      Manipulates Digital Signatures
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:2472
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCC /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\reg.exe
      reg delete HKCC /f
      4⤵
      PID:5840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer Protected Mode
  - Suspicious use of AdjustPrivilegeToken
  PID:2980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1164

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4136

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CodeEncryption.pdb

Path C:\ProgramData\CodeEncryption.pdb
Size 23KB
SHA256 fef212db5ccfea74a5c7a9024922cd6fce142edd0dd6e342413655d07496591f
MD5 71b270a5eddb1061f2de1ccbe0db999d
SHA1 2d3a820cf601e3b8203502b935875c6131628e14
SHA512 18a5569cc2820963d30a1c83c0a1c23006a98642343fac25eec3633a1c3f07716724a035100da065ae58e9a1a3dc258b7cca792fa5be0aada588abc7a097ba0e
SSDEEP 192:NAPaAP/APU56AP/APIvwWDH8eOa0BtR749rkJycXKSIKwWi/WiRgKwWHN/W:m10gV0bhbt4KKLG2ex
TLSH
T13AB2FE92B290CC32CD8543766DE28F9C5370FD46CF62538B7B95B71D7CB222C0856588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Core.dll.config

Path C:\ProgramData\Core.dll.config
Size 420B
SHA256 4cfa2763c40c898330415a35407ec494bd139422f9b01bd0045ba787d149e40a
MD5 e3d2741928e80b1c896e9cd0c89eb905
SHA1 2e47a6ab3ec84d7b7ccfa52f4da45df456e421fe
SHA512 1a442ad424d5e258414ab4b8e4e223d54f356f786ae12e4ccdbe4acdade72bb4f33a6e26bb2e77584ab4dbc71e0c116865f33f99f676b43d9ea1247c30685924
TLSH
T112E06111A4C46E928B334EF37E67641CDB7D43B7244C014DB4BE69A74F15A554107032
MD5 SHA1 SHA512 TLSH

Submit Download

Core.pdb

Path C:\ProgramData\Core.pdb
Size 103KB
SHA256 4449ad53e2cb3e7434ae23dd9b2d57b272af61541c7c340961fe58ec99b1c5ab
MD5 cc15038114a102ab2a2d077d1a45db13
SHA1 25686d01a62806c8c916f0aac8cefa0c8f480ee2
SHA512 36f1edf47daf9a62967265f46f388911c5aa88f995bfd78d5f10f1f8f09347dfeea938a69594a5e97259dd2adc1c9d140e30f253816517c4eb9f5dc97eb5b4e5
SSDEEP 1536:UwaSSE1vDNffGCM+DTDaOnnDRVVVuVB67QR0RZBajhp8ghn:KSFGCGqahhn
TLSH
T1FDA38553BB91C832C88687BCA6D74F2D5238DD859B93978FABA8B01C7DF33291D45214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\ProgramData\Guna.UI2.dll
Size 3.8MB
SHA256 040b166676f61ceca68a3282b2dc77de9b90b5351e77808fd52b03f9870586fc
MD5 faece6fabb59a0f659a1f79f2b73d663
SHA1 e73e7d99547fdbf61ecf4b282902bbbde7da588a
SHA512 36ad18f495491e2d5b902acf9e16f672f607c701244e8f7b5431e20e86169b9c65c2a388f4167f13bc04a88af80084ca9a2d1ad2593627a6b074b886436eab2e
SSDEEP 24576:91ZtInJ42jeNjFRUMusmC5bI/Bw+xFdkHZQhHNh0kBU+AvsTmE+LHQ/jz4Au3K:9wMNjFOgmUI/Bw+xFdC1kBUgr+PA
TLSH
T1C9065A023B919817D16EFF77A463101C87F1F951EAABF74E3685F2AC1A9B35058423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardening.dll.config

Path C:\ProgramData\Hardening.dll.config
Size 693B
SHA256 04a8623c12ab0ed3704d8bf59adf492e7eef4e1848a3cbf76ea33ef866e1bc37
MD5 7cffc162b332913310f09a9c3691f42b
SHA1 1dd4c4ade0e15ed4e64ca978a988f44718cc2eec
SHA512 6d1721f771f6374f2e9ed820a53f1904e8c79bfa4c817bab1f6626fc1995d17c114cc891a0d18bf13dce03386373e98544230d8b36bfdf9fbea53d0c6d567f8f
TLSH
T1FC017D1251C86FA10B725AB33F7FA418CB7D03B72C8C058DB5EE6E9B8F259990203072
MD5 SHA1 SHA512 TLSH

Submit Download

Hardening.pdb

Path C:\ProgramData\Hardening.pdb
Size 79KB
SHA256 a2f5643abdb6d59f1bf2cac4aaf457a9190a43fa903df7c3708868344dff7d4b
MD5 8326433cf9482c495204026f40417536
SHA1 5e5612d1eac2e8b10906875f6ed5b75f289fa2f7
SHA512 ef2264cc391a9fd8614d6fcbc6fd8b4409df53591b9aace714327d00bd3408d2d91c92343251ae1b01351d1f926b0dc11a9cdb477488d645127fe9187ab94e4b
SSDEEP 768:kuJWltJWLnzImis5TBCWcuXpm+S6Ts/+BEeCnn/bde2XhHSvsDwYGE2nzImisJo6:1Tzmn6vohHSvyw/1S0vywM
TLSH
T1BC839397FB40C932C84A86B9A6EB8F1C5374ED85CB47578F67A8B12C3DB23291D45348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runtime.pdb

Path C:\ProgramData\Runtime.pdb
Size 103KB
SHA256 28cbc5e4bdffa313ab593fe1ebceed67eaf608f05bce1d4bd55183a714033bff
MD5 97e152d2d511bd63cedbe1b3d4cbd31a
SHA1 00c9901409d31fdfde1d0ae6c961b63023211540
SHA512 43fd0cab71f90f8dd30d7d520f4bb1dbd21b9fe55be8961bec4b5247788a6711577426c943a6b989228a06dd0ab44129d0c4f88bfa0185625055f5d0cd32b59e
SSDEEP 768:VrVlo+rK1+oGtIXfCDhY3m66lNt9sQ0fAlniney5goTjMjNqFoUXg+1fvI/eMlMy:edT0NqRXg83I2cGUM2aX5
TLSH
T1A5A361A2BA81D936DD49477AB6E34F4C4374DD06CB63039FAB957018ACB736E0D90388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURE BYTE GUI.exe

Path C:\ProgramData\SECURE BYTE GUI.exe
Size 2.3MB
SHA256 68ddb91f213689bf335a3f7140ac8d3992c6cb1b9e6821bfa9a251a365c32468
MD5 0ef95374a9d2a9585f2480ee0f997126
SHA1 ef4bba9de74f562390d601eb3482fa4610cbf708
SHA512 d599789d1019b0163e1022b81e17329b7cbd2518efe711d16ea70ccab0d9a5d75c6b59ea3b93c576aa8ac6058edf52abb3bb0f4a821b6eb31d2fd7fd01bfb8b4
SSDEEP 12288:LJRPtG12TodQXQHnoK+TN0IJIoI7vFR2rubhkfJIT+I:HPtVodQmsQYfG
TLSH
T142B51865EB54B40DECB927F48521970A87FBEC068A4ECB4BFE5534FA4F567818E10283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURE BYTE GUI.exe.config

Path C:\ProgramData\SECURE BYTE GUI.exe.config
Size 532B
SHA256 9c57e0aa56a2e086a674c39080765b349c7ffbccd8ec77c4e30c8cc8e3588260
MD5 9fca48d74c2f1f8ae46c270c7a9fb5dc
SHA1 91b4d72dba8e0e1ee533c56b6962b5a9acdc02cc
SHA512 5d09fec5ad0e64b1e95ba61c666eea4ab05f062fef2922ffb48764a71d584f7aa19a9ccec9b1f4901315f18930022545270cd214fd4330e74396d4ea3ce931e8
TLSH
T123F02E1094C4BE96DF334EA37A539468DFB943B7344C014DB06E6A974F35A594107277
MD5 SHA1 SHA512 TLSH

Submit Download

SECURE BYTE GUI.pdb

Path C:\ProgramData\SECURE BYTE GUI.pdb
Size 1.1MB
SHA256 18cda2400769952a4ce0f8bfb68b36d8da114c6f94adb34ca018337df3b41756
MD5 a81e3391fbad7a3265890b2c9e5575f8
SHA1 7f240e43169de9db11487c8f1c1ce901b6627fed
SHA512 6a32536ca2a8c6d3d5487a8fa724777ac17927a52c0dd7d0653ad40cb0953384d65d2c5b8200c212fbb81aa7d09c0be84ba1203854d91f1f169ade9d91029885
SSDEEP 6144:mdk9QgJ+hEzO21bmDYeSmyoIF0pLTKg7dGXeHGez8AwhWTIbHIwQqttIDTzvPY2Z:mtGzAkrEhGYdzsHWPM
TLSH
T15735C593B790C932C986C3BEA2A78F2C9338D141CB5797CF7BA4A51C6DD235D1E46248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VMUtils.pdb

Path C:\ProgramData\VMUtils.pdb
Size 19KB
SHA256 765b41259896e2a73058dbd32b5b2522118edb198873c82c8908b9975aad8e46
MD5 b2b0636696353a6c8f24d849a67246f6
SHA1 a801aac9f6b6c63ba7db1a33c7bf0f8c8ae37f2d
SHA512 dc13cea8c5462bb79be277d372b28f584f506b0c28da56bc018e687c722a154e9e7a5a542fad1548228adf84952e4e3760a214c3d2ac2dd6cb439adc24ca24d7
SSDEEP 192:kAP/APVdAPO56APVdAPE5jQIPW0jI0mFdjIo:L0seVsAS
TLSH
T15D92DD92B100DC72DE8917B3BDD187D8A3E0FE02CE6226AFB665B70ED4355AC44106DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window.exe

Path C:\ProgramData\window.exe
Size 223KB
SHA256 feb1ca4bc92051b3b536fc0d3821db56874d73658d01e552212ce1e3ae5a6e4b
MD5 57e5ca802207296595be786b41542bd9
SHA1 339484154e94141759fb8af92e99780ebca491b6
SHA512 6dbae206946176b7cb4d9ca132afc0fb46e8665eaa754bccc395019290a574cc515c42c544910d802c07c443bd95f658484af8c732cf0f8576220dda14ab5b46
SSDEEP 3072:Xr2VF0kz0lZ4x4ilDjn2szgjm4EHBAnpK37nXS8J0uAQ7KvPsd74tyJhIGKl13vG:b0ulCxZPn2BjmA83IvPYA1TQre2
TLSH
T1FC244A4127E4CA2AEABE57B5F4B112106775F10B9121EBCA7C8C19F95B2334099633BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5d1xuujo.xku.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5d1xuujo.xku.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

iiurfr.exe

Path C:\Users\Admin\AppData\Local\Temp\iiurfr.exe
Size 11KB
SHA256 6b70cd691064767a7b9fc04062e1b793d5539452b4f4a3b2d95bcdbab5678ce1
MD5 b83afbd30615e22ab6bbec866e736146
SHA1 c6854993be595d46c66177a713b27bc17be5a00b
SHA512 9fcd3b425c6567ef6a830eb2a27b4e09f6fd2743d235f18cc5c780adc93cda0725199bf8e7d5c89f45ac3eff22a2411ff28f84b938a187b21270edeb8ffe6afe
SSDEEP 192:/UdqFTGoWELrakCkmx5F7X0n0E49w67G7Q3j3y0e:8roWEivRxfX+0j93qi+
TLSH
T1DF32F95CB3E88624D5BD4B3628B7D210C7B0F0138E27CB4E1CE9A8FD2D277146666B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpEE6D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEE6D.tmp.bat
Size 139B
SHA256 998a2ad519d3a2754595ed5e70684e82a7adaa82958ad89a26994006dd6a528e
MD5 99b26ef9c159b90ca8fc1de66c661854
SHA1 c61d4518d06fa52a14c93a4aa8132f90f08d86b5
SHA512 fb019648b8fdfb1f5fa9fdf370bcc87e91e1a3d0a1ecac3eb79898bf347dd4473079494aa772ef094e46a7d2f15d07e41b7aaa71c82e8e360d09dd7f057ff3a6
TLSH
T1E4C02B0114C7B38535023401036FC099E313DC0B29885B20A38C0108B880559F47C344
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Contacts\desktop.ini
Size 412B
SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
MD5 449f2e76e519890a212814d96ce67d64
SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
TLSH
T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Documents\desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
MD5 3b960da228cc489b622697659c885d64
SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
TLSH
T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Music\desktop.ini
Size 504B
SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
MD5 06e8f7e6ddd666dbd323f7d9210f91ae
SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
TLSH
T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Pictures\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Saved Games\desktop.ini
Size 282B
SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
MD5 b441cf59b5a64f74ac3bed45be9fadfc
SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
TLSH
T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Searches\desktop.ini
Size 524B
SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
MD5 089d48a11bff0df720f1079f5dc58a83
SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
TLSH
T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\desktop.ini
Size 504B
SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
MD5 50a956778107a4272aae83c86ece77cb
SHA1 10bce7ea45077c0baab055e0602eef787dba735e
SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
TLSH
T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\AccountPictures\desktop.ini
Size 196B
SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
MD5 2971c89bfb3b06e591694b9a78e467b9
SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
TLSH
T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
Size 174B
SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
MD5 8f91870452433a5555c9d453f714698c
SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
TLSH
T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
Size 174B
SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
MD5 e0fd7e6b4853592ac9ac73df9d83783f
SHA1 2834e77dfa1269ddad948b87d88887e84179594a
SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
TLSH
T17FC0801892E9311041718D12FC749001DBB1B8216C17CF5E07C0518B04A0605E631747
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_48.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 a4aacbaf13e1abf780fd7ddde9aca99190f191cd5ed766c96e130a329d2bfe6d
MD5 b3e54e947462d8749709e0a729e6f8f6
SHA1 4a65f3520262cfb1f7cfea16654d0da3afeeee12
SHA512 349b883f98d5432f81242ba83dd245b55b3f8ba4407ff42330892d6d9a679742dba76bb5aa6dc9c00f745f7d0fcda00b92d87403b05321654f142a9dcd59df12
SSDEEP 192:+UTqgVU1Bud//K1uwuyYaIlmaLwvLEfWoYkG4rFyD4:+zgm1Bud//KeQvwfWorx
TLSH
T1D7258B2677F22E78FDDCD9BA7B82D1761A137C7206C2011622DE779705608F8AAF152C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 057518e6fa38d2364c98e6b2ae567d3c7ffd4c3805eaa280f64437da3c05aa2a
MD5 06e98bc6228735f1462ec860d3056fc5
SHA1 aba5a2e394c44982de9cece804190aca0a07cea7
SHA512 212208e360dbdd58d51b6e25a745fa22c5d1df1bfe9850254090984323be369bf3096f9dd9a94097ace45a1bcf052b00b3c30d5d96849d8001014f4b62db52c4
SSDEEP 3:tnplFnl9sYm/HRZSRd//yJ6ePRJ/AaRd//2+gPURC/Ld//:9M/xZ0dXyJ6e5JxdX27GC/LdX
TLSH
T167E148033081CE19CC0D49306EACC4DA1A093F048D60020B3080F36E0BF20C04110004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
Size 196B
SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
MD5 08e1b7b2fd872cdcc42af67707dc2a98
SHA1 512644da4aa90a3919bc29f65e878e9870874f67
SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
TLSH
T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Size 302B
SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
MD5 99d72adf4e683fa1e6f1a435ff5be9b3
SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
TLSH
T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
Size 432B
SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
MD5 f107d0270e21a2fe91099fdc15918d44
SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
TLSH
T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 174B
SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
MD5 548b310fbc7a26d0b9da3a9f2d604a0c
SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
TLSH
T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

TranscodedWallpaper

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
Size 176KB
SHA256 6ea25d299adb39df40212749727988f5f4bd1daba2b02fafb970fa2d1dbec7a7
MD5 90e4cfb342009eaaae50e1e7ccfd6729
SHA1 a92ec924cc7e55f7ced198b3c3406935f7c90e62
SHA512 3bc4c4aa96b72c6a5ecafed98f7c679866ba09f99a71683d13f1205e809700199b3150197477bcefc8f6a65c663073b61b7a27c59748b1721b82f58b210f7e6c
SSDEEP 3072:bxsJvlkwIJFCaup/yNOas8WY1hKKbfef8zob71T57kLq+Crt3CaEBqwbDpxp:1sJvGwIJ8N/yjs8WY1hKKbmf8e6LVCr8
TLSH
T151041263157FEE51B31B6E199B4B12FFA081B546362B391E74C7E9B32D23108A2C41B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
Size 418B
SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
MD5 93c8b5c191bdcf8aca86d7463d77e6c8
SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
TLSH
T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
Size 298B
SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
MD5 819c27ae07898f1a5efda4e146dbb174
SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
TLSH
T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
TLSH
T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
Size 520B
SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
MD5 af5909700768a888173cbd32998cf3da
SHA1 194ed60ed8923749078816fc2c69614d975ba325
SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
TLSH
T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
Size 520B
SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
MD5 7a985a80859ee46e35031543cf0d142f
SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
TLSH
T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
Size 520B
SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
MD5 a882cf89da04eb72950e65080a5cf857
SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
TLSH
T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

RGIE485.tmp

Path C:\Windows\Temp\RGIE485.tmp
Size 24KB
SHA256 04a0fbd0b5c3e4f7e3558a3871fe3f3cce5013a330941c3e72b4cdb19c81f2ad
MD5 033649d7b623b2f8cd29854ccb6d6a4b
SHA1 9772f7b7b11625fc3dea7598cdf5b6d0fc511ae6
SHA512 90df8c97c8d8062970d76af2235c3ab78208c95c332bbc04e72e2782cb926ab12dbb1098914f453eb7b095ee7dc50f80d4cb96c5931a51a25efb5d91a3c50989
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
TLSH
T1CAB2BF295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-109-0x000000001E910000-0x000000001E91C000-memory.dmp

Download

memory/2516-108-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

Download

memory/2980-448-0x00000000083B0000-0x00000000083B1000-memory.dmp

Download

memory/3356-67-0x00000000069F0000-0x0000000006DC6000-memory.dmp

Download

memory/3356-54-0x0000000000400000-0x0000000000652000-memory.dmp

Download

memory/3356-55-0x0000000004F60000-0x0000000004F72000-memory.dmp

Download

memory/3356-61-0x0000000005650000-0x0000000005C0A000-memory.dmp

Download

memory/3356-62-0x0000000005090000-0x0000000005122000-memory.dmp

Download

memory/3356-63-0x0000000005070000-0x000000000507A000-memory.dmp

Download

memory/3416-90-0x0000022B6AA40000-0x0000022B6AA5E000-memory.dmp

Download

memory/3416-91-0x0000022B6AA60000-0x0000022B6AB12000-memory.dmp

Download

memory/3416-87-0x0000022B52300000-0x0000022B52322000-memory.dmp

Download

memory/3416-92-0x0000022B6A820000-0x0000022B6A82A000-memory.dmp

Download

memory/3488-118-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

Download

memory/3928-604-0x000001CD14890000-0x000001CD148B0000-memory.dmp

Download

memory/3928-543-0x000001CD001E0000-0x000001CD002E0000-memory.dmp

Download

memory/3928-573-0x000001CD14470000-0x000001CD14570000-memory.dmp

Download

memory/3928-590-0x000001CD04370000-0x000001CD04390000-memory.dmp

Download

memory/3928-571-0x000001CD01E80000-0x000001CD01EA0000-memory.dmp

Download

memory/4280-0-0x00007FFFF3D4F000-0x00007FFFF3D50000-memory.dmp

Download

memory/4280-84-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4280-5-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4280-4-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4280-2-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4280-1-0x0000000000EB0000-0x000000000185E000-memory.dmp

Download

memory/5792-83-0x0000000000EC0000-0x0000000000EFE000-memory.dmp

Download