d3e1c9803a9b70d95a4dd4ceaee5aa754130a8f5387b893125e0e8449f9f2110

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/10/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prank.bat
Size 867B
Sample261018-qr76msbb84
SHA256 d3e1c9803a9b70d95a4dd4ceaee5aa754130a8f5387b893125e0e8449f9f2110
MD5 16d0939d3ba710e2c79947e51ca5b8f4
SHA1 bb5b17cb05401e4dc7666493cdfa2fb5d1e2a6b2
SHA512 fee7dd889c69f0d14310a7ebcab0c4727232cbac1eb125dc96c6153c7b2ad2e1e305fc45f1a3882b626eb3f8def0cc5cab5ad336bbe9967c21651bd5c973ae64
TLSH
T1E311298F2E0FD914664704B498BAF588B2D480134C289DF381A378BE2A142C5CB7E5FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3920	wscript.exe
4892	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	cmd.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4712	timeout.exe
6112	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
6404	taskkill.exe
6176	taskkill.exe
6316	taskkill.exe
5056	taskkill.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{F06546D5-F7FE-4343-9E35-301CB67A988F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea0709004200680067007900620062007800200076006600200070007900620066007600610074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000904100731a42dd015021cf241b42dd01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070900420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000931ea5611842dd0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5431"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5431"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8526"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336234636501975"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3920	wscript.exe
5680	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6404	taskkill.exe
Token: SeDebugPrivilege	6176	taskkill.exe
Token: SeDebugPrivilege	6316	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe
Token: SeShutdownPrivilege	5680	explorer.exe
Token: SeCreatePagefilePrivilege	5680	explorer.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe
5680	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5680	explorer.exe
4076	SearchHost.exe
6868	StartMenuExperienceHost.exe
5680	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3920	1808	cmd.exe	83
PID 1808 wrote to memory of 4712	1808	cmd.exe	84
PID 3920 wrote to memory of 4784	3920	wscript.exe	85
PID 3920 wrote to memory of 3340	3920	wscript.exe	86
PID 3920 wrote to memory of 4652	3920	wscript.exe	87
PID 3920 wrote to memory of 4324	3920	wscript.exe	88
PID 3920 wrote to memory of 3348	3920	wscript.exe	89
PID 3920 wrote to memory of 2364	3920	wscript.exe	90
PID 3920 wrote to memory of 480	3920	wscript.exe	91
PID 3920 wrote to memory of 4772	3920	wscript.exe	92
PID 3920 wrote to memory of 3136	3920	wscript.exe	93
PID 3920 wrote to memory of 32	3920	wscript.exe	95
PID 3920 wrote to memory of 1032	3920	wscript.exe	96
PID 3920 wrote to memory of 1260	3920	wscript.exe	97
PID 3920 wrote to memory of 4244	3920	wscript.exe	98
PID 3920 wrote to memory of 3800	3920	wscript.exe	99
PID 3920 wrote to memory of 2856	3920	wscript.exe	100
PID 3920 wrote to memory of 1160	3920	wscript.exe	101
PID 3920 wrote to memory of 3160	3920	wscript.exe	102
PID 3920 wrote to memory of 2828	3920	wscript.exe	103
PID 3920 wrote to memory of 2472	3920	wscript.exe	104
PID 3920 wrote to memory of 4292	3920	wscript.exe	105
PID 3920 wrote to memory of 5016	3920	wscript.exe	116
PID 3920 wrote to memory of 4000	3920	wscript.exe	107
PID 3920 wrote to memory of 2232	3920	wscript.exe	108
PID 3920 wrote to memory of 2988	3920	wscript.exe	109
PID 3920 wrote to memory of 1448	3920	wscript.exe	110
PID 3920 wrote to memory of 4052	3920	wscript.exe	111
PID 3920 wrote to memory of 4756	3920	wscript.exe	112
PID 3920 wrote to memory of 2044	3920	wscript.exe	113
PID 3920 wrote to memory of 2100	3920	wscript.exe	114
PID 3920 wrote to memory of 1248	3920	wscript.exe	115
PID 3920 wrote to memory of 5016	3920	wscript.exe	116
PID 3920 wrote to memory of 2292	3920	wscript.exe	117
PID 3920 wrote to memory of 4840	3920	wscript.exe	134
PID 3920 wrote to memory of 5152	3920	wscript.exe	119
PID 3920 wrote to memory of 5172	3920	wscript.exe	120
PID 3920 wrote to memory of 5208	3920	wscript.exe	121
PID 3920 wrote to memory of 5360	3920	wscript.exe	122
PID 3920 wrote to memory of 5384	3920	wscript.exe	123
PID 3920 wrote to memory of 5440	3920	wscript.exe	124
PID 3920 wrote to memory of 5560	3920	wscript.exe	125
PID 3920 wrote to memory of 5584	3920	wscript.exe	126
PID 3920 wrote to memory of 5656	3920	wscript.exe	127
PID 3920 wrote to memory of 5784	3920	wscript.exe	128
PID 3920 wrote to memory of 5828	3920	wscript.exe	129
PID 3920 wrote to memory of 5872	3920	wscript.exe	130
PID 3920 wrote to memory of 6012	3920	wscript.exe	131
PID 3920 wrote to memory of 6036	3920	wscript.exe	132
PID 3920 wrote to memory of 6060	3920	wscript.exe	133
PID 3920 wrote to memory of 4840	3920	wscript.exe	134
PID 3920 wrote to memory of 5332	3920	wscript.exe	135
PID 3920 wrote to memory of 5428	3920	wscript.exe	136
PID 3920 wrote to memory of 5716	3920	wscript.exe	137
PID 3920 wrote to memory of 5948	3920	wscript.exe	138
PID 3920 wrote to memory of 6064	3920	wscript.exe	139
PID 3920 wrote to memory of 5540	3920	wscript.exe	140
PID 3920 wrote to memory of 5924	3920	wscript.exe	141
PID 3920 wrote to memory of 5212	3920	wscript.exe	142
PID 3920 wrote to memory of 6188	3920	wscript.exe	143
PID 3920 wrote to memory of 6228	3920	wscript.exe	144
PID 3920 wrote to memory of 6316	3920	wscript.exe	158
PID 1808 wrote to memory of 6404	1808	cmd.exe	146
PID 3920 wrote to memory of 6452	3920	wscript.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\prank.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\wscript.exe
  wscript //nologo "C:\Users\Admin\AppData\Local\Temp\sp.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:4784
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3340
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:4652
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:4324
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3348
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:2364
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:480
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4772
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:3136
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:32
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1032
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:1260
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:4244
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3800
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:2856
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:1160
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3160
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:2828
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:2472
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4292
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5016
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:4000
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2232
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:2988
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:1448
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4052
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:4756
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:2044
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2100
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:1248
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5016
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2292
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:4840
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5152
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5172
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5208
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5360
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5440
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5560
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5584
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5656
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5784
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5828
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5872
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:6012
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6036
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6060
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:4840
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5332
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5428
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5716
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5948
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6064
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:5540
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5924
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5212
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:6188
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6228
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6316
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:6452
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6492
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6532
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:6776
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6804
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6916
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscript:msgbox(chr(101)^&chr(122)^&chr(32)^&chr(64)^&chr(110)^&chr(49)^&chr(107)^&chr(118)^&chr(122),0,chr(101)^&chr(122)):close
    3⤵
    PID:7072
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:7088
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:7112
- C:\Windows\system32\timeout.exe
  timeout /t 15 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mshta.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im notepad.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5680
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6112
- C:\Windows\system32\wscript.exe
  wscript //nologo "C:\Users\Admin\AppData\Local\Temp\sp2.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4892

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

error[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ZIDJ8DT\error[1]
Size 1KB
SHA256 b0abe318200dcde42e2125df1f0239ae1efa648c742dbf9a5b0d3397b903c21d
MD5 b9bec45642ff7a2588dc6cb4131ea833
SHA1 4d150a53276c9b72457ae35320187a3c45f2f021
SHA512 c119f5625f1fc2bcdb20ee87e51fc73b31f130094947ac728636451c46dced7b30954a059b24fef99e1db434581fd9e830abceb30d013404aac4a7bb1186ad3a
TLSH
T1DD31D06CB103BBB58EDB3C59B31A70C4ACA846301D244996B5BCC4D2F5ABC178BA275D
MD5 SHA1 SHA512 TLSH

Submit Download

error[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OP4E8YQH\error[1]
Size 3KB
SHA256 7990e703ae060c241eba6257d963af2ecf9c6f3fbdb57264c1d48dda8171e754
MD5 16aa7c3bebf9c1b84c9ee07666e3207f
SHA1 bf0afa2f8066eb7ee98216d70a160a6b58ec4aa1
SHA512 245559f757bab9f3d63fb664ab8f2d51b9369e2b671cf785a6c9fb4723f014f5ec0d60f1f8555d870855cf9eb49f3951d98c62cbdf9e0dc1d28544966d4e70f1
TLSH
T1FB614203C3547C8A61238DB27903FBEAA58104801309A1B87EB194AB7BCD9BD1BE37D5
MD5 SHA1 SHA512 TLSH

Submit Download

warning[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V356QJ2N\warning[1]
Size 1KB
SHA256 5f95eff2bcaaea82d0ae34a007de3595c0d830ac4810ea4854e6526e261108e9
MD5 124a9e7b6976f7570134b7034ee28d2b
SHA1 e889bfc2a2e57491016b05db966fc6297a174f55
SHA512 ea1b3cc56bd41fc534aac00f186180345cb2c06705b57c88c8a6953e6ce8b9a2e3809ddb01daac66fa9c424d517d2d14fa45fbef9d74fef8a809b71550c7c145
TLSH
T17F1198025F23C861C1961AB44294E9D602880802F766A65B72FDB297E2F5AD1F7FB341
MD5 SHA1 SHA512 TLSH

Submit Download

sp.vbs

Path C:\Users\Admin\AppData\Local\Temp\sp.vbs
Size 278B
SHA256 5d9928901d143ee2ded8c6fc46cbd8b600fdc72ec37c976bc8b8db6af565f0ca
MD5 10f9b20569e6432151d0308e70c57c1d
SHA1 8e87a81880386920e1222a4ccae81ff4cbd2d2ab
SHA512 d7736707986387ef8fcdc6cbc5ef8273f97996cf219bfd272330a5b4cc82f6c598f028e950487490bb7866e5131780f833cde533c105656d4112d8a60099d27a
TLSH
T1D4D02BEF5B0DEB52B261220D48F272841BC01813173B48400390A88F23545511747D36
MD5 SHA1 SHA512 TLSH

Submit Download

sp2.vbs

Path C:\Users\Admin\AppData\Local\Temp\sp2.vbs
Size 41B
SHA256 6bc80ee033f94bcddf52273f1198497314307a6fea7271c96c7d8a9f24026ff3
MD5 b131fb002172ec792f3d8e8b247c274b
SHA1 252a2f300f050f104457af5aedfe41682210d8f3
SHA512 4b6f6b94f9b59b467f5d63d0e6e8052190758896884c7e374588111c9da4de85a0ca2e00d1ccf19883fd0232bef0b6af0e91e4e4d411ad1af40432e950ac1fba
MD5 SHA1 SHA512

Submit Download

memory/4076-119-0x000002A131DB0000-0x000002A131EB0000-memory.dmp

Download

memory/4076-127-0x000002A143B40000-0x000002A143C40000-memory.dmp

Download

memory/4076-173-0x000002A143B40000-0x000002A143C40000-memory.dmp

Download

memory/4076-175-0x000002A265EE0000-0x000002A265F00000-memory.dmp

Download

memory/4076-176-0x000002A165920000-0x000002A165940000-memory.dmp

Download

memory/4076-231-0x000002A267440000-0x000002A267540000-memory.dmp

Download