troldesh | ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c

max time kernel
1195s
max time network
1011s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-04-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02e8c7af3724ff535da627197920ad14.exe
Size

1.2MB
MD5

02e8c7af3724ff535da627197920ad14
SHA1

794bd6f52a9673e1146321fa2545c580858c0d5f
SHA256

ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
SHA512

8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
SSDEEP

24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk

Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies Installed Components in the registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4892-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-13-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/4892-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

02e8c7af3724ff535da627197920ad14.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	02e8c7af3724ff535da627197920ad14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	02e8c7af3724ff535da627197920ad14.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

02e8c7af3724ff535da627197920ad14.exeexplorer.exe

description ioc process

File opened (read-only) \??\F: 02e8c7af3724ff535da627197920ad14.exe
File opened (read-only) \??\D: explorer.exe
File opened (read-only) \??\F: explorer.exe

description	ioc	process
File opened (read-only)	\??\F:	02e8c7af3724ff535da627197920ad14.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

02e8c7af3724ff535da627197920ad14.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\7E168DCF7E168DCF.bmp"	02e8c7af3724ff535da627197920ad14.exe

Drops file in Program Files directory 64 IoCs

Processes:

02e8c7af3724ff535da627197920ad14.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\yt_16x11.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\endGame_blue_up.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\King_Of_The_Hill_.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-48.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-100.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\CenterView.scale-140.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Lightning_Bolt.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\lobby_add_photos_mobile.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\sleepy.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Popup_shadow_3_2bp.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\WideTile.scale-125.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3490_48x48x32.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_11s.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Goal_7.jpg	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconEditRichCapture.contrast-high_scale-200.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\um_60x42.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-white.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-100.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-256.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-100.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\RunningLate.scale-80.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Popup\CompletedAllChallenges_2.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-48.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\WideTile.scale-125.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-400.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\dailyChallenge_bp_920.jpg	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\27.jpg	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Resources\cursorXBOX_active.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\xboxservices.config	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Goal_4.jpg	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-16.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-125.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-200.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\au_60x42.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Paint_Logo_with_Trademark_ABOUT_POPUP.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-150_contrast-white.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-100.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\bh_16x11.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-200.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-60_altform-unplated.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-32.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar310x150.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-unplated.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-256_altform-unplated.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-black_scale-125.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4665_40x40x32.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1249_20x20x32.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\Data\OilDaubNoise.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png	02e8c7af3724ff535da627197920ad14.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\WideTile.scale-100.png	02e8c7af3724ff535da627197920ad14.exe

Drops file in Windows directory 3 IoCs

Processes:

SearchUI.exeexplorer.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

SearchUI.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

2664 vssadmin.exe
1952 vssadmin.exe
2420 vssadmin.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

SearchUI.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

pid	process
2664	vssadmin.exe
1952	vssadmin.exe
2420	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies registry class 32 IoCs

Processes:

explorer.exeSearchUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065789565016"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000005c858b3e0f91da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000005c858b3e0f91da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000006b8308248a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

02e8c7af3724ff535da627197920ad14.exe

pid process

4892 02e8c7af3724ff535da627197920ad14.exe
4892 02e8c7af3724ff535da627197920ad14.exe
4892 02e8c7af3724ff535da627197920ad14.exe
4892 02e8c7af3724ff535da627197920ad14.exe

pid	process
4892	02e8c7af3724ff535da627197920ad14.exe
4892	02e8c7af3724ff535da627197920ad14.exe
4892	02e8c7af3724ff535da627197920ad14.exe
4892	02e8c7af3724ff535da627197920ad14.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

vssvc.exeexplorer.exe

description	pid	process
Token: SeBackupPrivilege	5060	vssvc.exe
Token: SeRestorePrivilege	5060	vssvc.exe
Token: SeAuditPrivilege	5060	vssvc.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeCreatePagefilePrivilege	1952	explorer.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

explorer.exe

pid	process
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

explorer.exe

pid	process
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchUI.exe

pid process

2988 SearchUI.exe

pid	process
2988	SearchUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

02e8c7af3724ff535da627197920ad14.exe

description	pid	process	target process
PID 4892 wrote to memory of 2664	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe
PID 4892 wrote to memory of 2664	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe
PID 4892 wrote to memory of 1952	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe
PID 4892 wrote to memory of 1952	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe
PID 4892 wrote to memory of 2420	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe
PID 4892 wrote to memory of 2420	4892	02e8c7af3724ff535da627197920ad14.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe
"C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe List Shadows
2⤵
- Interacts with shadow copies
PID:2664

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:1952

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe List Shadows
2⤵
- Interacts with shadow copies
PID:2420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1952

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\System32\xfs
Filesize
226KB

MD5
bfde7c38b5054d118b2ca8327eca088e

SHA1
effeb78734bc6f568f4ec77fe4b95f7d7ee6aedf

SHA256
2e3192554f6eacf64bc9555475570791379197594408aae203608c0fe7fe0480

SHA512
d143f07914b1a0d7b6f916a00a364486545c307035b18763da0532fed9a8adb1953c571222819842b303c878740857501309fe855a0cc357109a65cc41cc5e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Filesize
1024KB

MD5
eec3fe6baad1a086027cdd438077289c

SHA1
7d85f86f8447d3c16d85406bf39fb3def1a8cf82

SHA256
5b4aaee1e8e08ca9dbcb68bf922d6cac5b61b0c2c7bf00a272c65dc881d50d57

SHA512
f8ea256986ba1948104e2e72f03ebd699f6a6ecac9db0642a23115e9a48c984b7fb01026bf312e6bab494b4505033a684fa19d8955bc303e30f0739cbf664ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Filesize
1024KB

MD5
8534be545c944eecadf2756ba39c21cd

SHA1
2d46544b2e734ea991049d70d162ce1e3b6ab233

SHA256
bffa651bd3f26fdde4450be652c40db4ed7df7f8d5d821fcd014843bc9487c67

SHA512
27511a44aebc468ad559aa5fb92b41de806d959054e201f26a4cde33b2e87340cb1742a8542dfa836ce1f9651ff53b00812c8cdd203398a9a3b44c32d5851485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
7KB

MD5
5a9642d459cbf1be05ca5e52a4a9142d

SHA1
24eb0bebddff4e3e58de4583a94c7453e8f89dc6

SHA256
16bafbf0aeda01f8287aae20e90f91eb85dc0f3129510d0a1da3777232a7935a

SHA512
a24fbc22be9bb5b137266d5928ac48e0e3627d88e4608351d06a8cae732ad673d529be451d19281079617669eaa8cacc3e023e3361db3a3533728fb670b03ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
7KB

MD5
b99c180291e328206485aeb27bc83f8e

SHA1
7523f8463ca561e909ab8180e2d88e2350455a85

SHA256
7aaa6077151448909048f59f56446ed9b23956631cc5cfe320bf0e6a616452ca

SHA512
d1e69dd9101f08271f553ada1930f079d39d568b2af12e0690680057978c103631affaff485d2af4b209055bbea75dc3884173597ef8f5e9ceb2e2472aa35069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
Filesize
1024KB

MD5
eba4e0b01ffe34626b5e200d18741b66

SHA1
1b5c320a0d0df24fa823d3e7d089e25a0db6a0a5

SHA256
ff580f5b35bf1846a5250e56ee820d7fa1c7adb54784562da5907ee0d896d438

SHA512
909910ec8fd0041f61935533779c4c0dbf4848b4a1d688cb1c37139cfdcaef3b3e49f7e747fd015efa0da4446de7b9098bdb5724fc683fc52e634b6daa2f45db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
Filesize
1024KB

MD5
726a1ccf6402fbbfe19d8238fbf5a8bd

SHA1
a234e266963022b999b5c56de8075bcd12748003

SHA256
ee5f2b5452bc3442d66e92172b8571f098451e8cf6639ecb8c28ea45dccbff6f

SHA512
f6fd8725036e35c5eff695bd73e30fa2310e8b6d04affcb33308c730848702a240c044292e8fb70d272ad6d27baad86fe572c501ae7cb5f426417c54263d7886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
Filesize
24B

MD5
ae6fbded57f9f7d048b95468ddee47ca

SHA1
c4473ea845be2fb5d28a61efd72f19d74d5fc82e

SHA256
d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

SHA512
f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Filesize
7KB

MD5
834ea5b8eae0cc502fffec8ed6ff4b7c

SHA1
c5b4e9d46caa0fc37d75aefbf51dc645b5c71fd4

SHA256
8c32b3ae58dea844c66d3b1a76ea614c55f71a08bc6f223e73ceb6457855a674

SHA512
51d2604b87a39b1cb90692332d9b88ea15d4970a36c8d1c8646b1cf3ec9737bd71a12d66a27ae3087d43289969a939042bc389a4b5875ca3ddb2a087ccac80ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Filesize
7KB

MD5
c9c7c6f211bb96ed6c79070f0dbd2a03

SHA1
18ab96ef5a0021ef6367fb7f2aa780559c1de7e1

SHA256
f20c3a4558908fe62567ccc5fc4bba6b10bd8e92f208fa2f8e399fba21c855ad

SHA512
047dc78e329eefb193da55858ea104c5fc2d65f449418ff5e9b785ddb17041ba3dc544c92dfa6eeb31cda52d253ae5e47408a46429a54e48cfda71b40287676d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MOQY2KJ2\microsoft.windows[1].xml
Filesize
97B

MD5
8a95f373f3835ef65c01e1bff3c09bb0

SHA1
802406563c22abc215e435f426a12667c74d42d8

SHA256
7c1bdff822950771c93e538934054e10e257ddbadc63813a6df70284bca8535b

SHA512
980d80be5b5e380e257c2ac045c756ed53ac1207e955f0768e21b4b090e25d60b0af789090991c274a7ae09944e7f6289b0aa7d0050fbcf0dfca196ac1308847

Download Submit
C:\Users\Admin\AppData\Roaming\7E168DCF7E168DCF.bmp
Filesize
2.6MB

MD5
993cc909a89f0fb7fe90acc3703c2105

SHA1
f422cdcb426718b235a19080b0daf71c9b448768

SHA256
4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

SHA512
5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

Download Submit
memory/4892-39-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-46-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-13-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-14-0x00000000008C0000-0x0000000000995000-memory.dmp

Filesize
852KB

Download
memory/4892-15-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-16-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-17-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-18-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-19-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-22-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-23-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-24-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-25-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-26-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-27-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-28-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-29-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-30-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-31-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-32-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-33-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-34-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-35-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-36-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-37-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-38-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-11-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-40-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-41-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-42-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-43-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-44-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-45-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-12-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-47-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-48-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-49-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-50-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-51-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-52-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-53-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-54-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-55-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-56-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-57-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-58-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-59-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-60-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-61-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-62-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-63-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-64-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-65-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-66-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-67-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-8-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-5-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-4-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-3-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-2-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-1-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-0-0x00000000008C0000-0x0000000000995000-memory.dmp

Filesize
852KB

Download
memory/4892-68-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-69-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-70-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-71-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4892-72-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download