lampion | e06b212b0c26d4f385a3623c64820b3ea4bbd83065646a38d1f3e0cfdfbb0898

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2023 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-611br.msi
Size

4.5MB
MD5

68ba045e1427d63d03660ef2d88584d0
SHA1

a3e9bd9adddf1aaaaff03cd69a7128e6fc774977
SHA256

e06b212b0c26d4f385a3623c64820b3ea4bbd83065646a38d1f3e0cfdfbb0898
SHA512

d677806a4c4ed419995b0ead65db4081c3e4b002e400fafb8d042d6695e7e17cc476a0ccc8df9c1caed164254ba2536c73891f89f6f9f57aea7a5421a6d964e8
SSDEEP

98304:MYGKdAHTgvV1OsKnG5vgzfTVkdRTpRjbrvC7gEjT7A3:i81OsKG6zfTVkddpdTCRj

Score

10^/10

lampion banker persistence trojan

Malware Config

Signatures

Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
trojan banker lampion
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

38 4792 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

Hw2dom.exewinrar.exe

pid process

4924 Hw2dom.exe
1468 winrar.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exe

pid process

972 MsiExec.exe
972 MsiExec.exe
972 MsiExec.exe
972 MsiExec.exe
972 MsiExec.exe

flow	pid	process
38	4792	powershell.exe

pid	process
4924	Hw2dom.exe
1468	winrar.exe

pid	process
972	MsiExec.exe
972	MsiExec.exe
972	MsiExec.exe
972	MsiExec.exe
972	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Hw2dom.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\Run	Hw2dom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aBaaobuu = "C:\\brado\\intrínseco\\Hw2dom.exe"	Hw2dom.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIF6F9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D4BC40EB-CE6B-4E7E-8C9A-599259C9F613}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8FF.tmp	msiexec.exe
File created	C:\Windows\Installer\e56f3bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56f3bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF64C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e56f3be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF438.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF70A.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9d6c693febb2fce0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9d6c6930000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900f9d6c693000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000c1ee0c05134be5aa038cb7b7d5dfc722f6516a29442e055c2377dcc355377f60000000000e800000000200002000000049f1ebeca3593d3e45c0148b3e7abab11c8d81f79858cab909ff69b1d695fe03200000002cbff0ce3a25bf484ea5c0974348d68bb963bbb6ae6f520038e7e825214072a440000000b0fe31d98ccbaa64dec1c70f15b83c846b7f3fad0ef0e4a940a83b3b1e0165e92873703ab2be8c668ab4480c8bf395bfdb7cdcc237e97fe6cd563f8eeab526ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "55"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "10398"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{12816C3A-B6F8-11ED-9F77-D660CAC54930} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384306186"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "29"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "10398"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "10398"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c248f1044bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31017732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "47"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "55"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3886962388"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000291210cd630c321de7d0fc42b972045c657922d11b5a81851653605cf8622850000000000e8000000002000020000000955136b37eff48902db958d23b328dccd2b693d7c3918ffc64fe16229109251820000000774ada517b5672d6f784f5bc54cd4a200bda48c420d619415cd27074562b758740000000b508a3a09aad18ff2cd0c45156b08df10788c373cf966a75d977bcbb6aa1acd7ff77567c8ead9232f2eb6deb39ac11ebe51a58db3b90a89dc9557eefab7944da	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "55"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3886943053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "87"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31017732"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09b51f1044bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "47"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "47"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\BE04CB4DB6ECE7E4C8A99529959C6F31	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{358E87EB-EC63-427D-B379-EEF4E2B46296}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE04CB4DB6ECE7E4C8A99529959C6F31	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\ProductName = "Winrar"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\PackageCode = "94EDD224D2A9E134DBED2B44DF521151"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\PackageName = "winrar-611br.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE04CB4DB6ECE7E4C8A99529959C6F31\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\Language = "1046"	msiexec.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	49	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	57	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exeHw2dom.exe

pid	process
2172	msiexec.exe
2172	msiexec.exe
4792	powershell.exe
4792	powershell.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe
4924	Hw2dom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	560	msiexec.exe
Token: SeSecurityPrivilege	2172	msiexec.exe
Token: SeCreateTokenPrivilege	560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	560	msiexec.exe
Token: SeLockMemoryPrivilege	560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	560	msiexec.exe
Token: SeMachineAccountPrivilege	560	msiexec.exe
Token: SeTcbPrivilege	560	msiexec.exe
Token: SeSecurityPrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeLoadDriverPrivilege	560	msiexec.exe
Token: SeSystemProfilePrivilege	560	msiexec.exe
Token: SeSystemtimePrivilege	560	msiexec.exe
Token: SeProfSingleProcessPrivilege	560	msiexec.exe
Token: SeIncBasePriorityPrivilege	560	msiexec.exe
Token: SeCreatePagefilePrivilege	560	msiexec.exe
Token: SeCreatePermanentPrivilege	560	msiexec.exe
Token: SeBackupPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeShutdownPrivilege	560	msiexec.exe
Token: SeDebugPrivilege	560	msiexec.exe
Token: SeAuditPrivilege	560	msiexec.exe
Token: SeSystemEnvironmentPrivilege	560	msiexec.exe
Token: SeChangeNotifyPrivilege	560	msiexec.exe
Token: SeRemoteShutdownPrivilege	560	msiexec.exe
Token: SeUndockPrivilege	560	msiexec.exe
Token: SeSyncAgentPrivilege	560	msiexec.exe
Token: SeEnableDelegationPrivilege	560	msiexec.exe
Token: SeManageVolumePrivilege	560	msiexec.exe
Token: SeImpersonatePrivilege	560	msiexec.exe
Token: SeCreateGlobalPrivilege	560	msiexec.exe
Token: SeBackupPrivilege	4020	vssvc.exe
Token: SeRestorePrivilege	4020	vssvc.exe
Token: SeAuditPrivilege	4020	vssvc.exe
Token: SeBackupPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exepowershell.exeiexplore.exe

pid process

560 msiexec.exe
4792 powershell.exe
4792 powershell.exe
3556 iexplore.exe
560 msiexec.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEwinrar.exeHw2dom.exe

pid process

3556 iexplore.exe
3556 iexplore.exe
4612 IEXPLORE.EXE
4612 IEXPLORE.EXE
1468 winrar.exe
1468 winrar.exe
4924 Hw2dom.exe
4924 Hw2dom.exe

pid	process
560	msiexec.exe
4792	powershell.exe
4792	powershell.exe
3556	iexplore.exe
560	msiexec.exe

pid	process
3556	iexplore.exe
3556	iexplore.exe
4612	IEXPLORE.EXE
4612	IEXPLORE.EXE
1468	winrar.exe
1468	winrar.exe
4924	Hw2dom.exe
4924	Hw2dom.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exeiexplore.exe

description	pid	process	target process
PID 2172 wrote to memory of 4600	2172	msiexec.exe	srtasks.exe
PID 2172 wrote to memory of 4600	2172	msiexec.exe	srtasks.exe
PID 2172 wrote to memory of 972	2172	msiexec.exe	MsiExec.exe
PID 2172 wrote to memory of 972	2172	msiexec.exe	MsiExec.exe
PID 2172 wrote to memory of 972	2172	msiexec.exe	MsiExec.exe
PID 972 wrote to memory of 4792	972	MsiExec.exe	powershell.exe
PID 972 wrote to memory of 4792	972	MsiExec.exe	powershell.exe
PID 972 wrote to memory of 4792	972	MsiExec.exe	powershell.exe
PID 4792 wrote to memory of 4924	4792	powershell.exe	Hw2dom.exe
PID 4792 wrote to memory of 4924	4792	powershell.exe	Hw2dom.exe
PID 4792 wrote to memory of 4924	4792	powershell.exe	Hw2dom.exe
PID 3556 wrote to memory of 4612	3556	iexplore.exe	IEXPLORE.EXE
PID 3556 wrote to memory of 4612	3556	iexplore.exe	IEXPLORE.EXE
PID 3556 wrote to memory of 4612	3556	iexplore.exe	IEXPLORE.EXE
PID 4792 wrote to memory of 1468	4792	powershell.exe	winrar.exe
PID 4792 wrote to memory of 1468	4792	powershell.exe	winrar.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\winrar-611br.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4600

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 45EC67E3B614F2DC771E8289A20DAA87
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFB6F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiFAFF.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrFB00.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrFB10.txt" -propSep " :<->: " -testPrefix "_testValue."
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4792

C:\brado\intrínseco\Hw2dom.exe
"C:\brado\intrínseco\Hw2dom.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Users\Public\Documents\AnyDesk\winrar.exe
"C:\Users\Public\Documents\AnyDesk\winrar.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3556 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e56f3bd.rbs
Filesize
607KB

MD5
b5785644f8ec8912a025c4e40d3895dc

SHA1
c06e44f13947b416dd84100f251a2d56d1174a79

SHA256
f32b0455737858c5e651b63aedfd033eda5df65b82ef9c096ef3dba1ebaacd6c

SHA512
aca75013fdb5730fae0943d75cd9b48fce06724819d8a3709bab840d4c889f713574f9af08cc261432dfcd0e1df38cf78ab5c9698b74829d066b5c733dc913e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_F4007F33BFDFD6A958C2A17D8DEC3C00
Filesize
406B

MD5
0df9971d6f39e25922a1efad454700a7

SHA1
95a4b3b8efd53cf3a5494457e5da588526930356

SHA256
1cf53c4dac61e35f674305472574e320a30f12a453b03b653261de5dc328830e

SHA512
72bc662de7d9b25670af0ff1e7abe141da3dd5fc2dcb35edfdf7a96c7860f07f0f7ea69e062c86eda9523e930fa62bc982c62c65ca1d2c2d3d77bb6096913a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\7TU9U1MB\www.winrarbrasil.com[1].xml
Filesize
261B

MD5
fcdb7e6d3a6a1e7d222ec6c974f94ca1

SHA1
e3396d904230076dbb8c4d13bbf3e09939758903

SHA256
778679500f606c6b5f8e68b5268310235d379e34d71e1d539e5893494c7a3e2d

SHA512
082c4bfdc5333747f227fd0d95b951a8de999a73855a71ad5e7af101f4b59d5165f3efe4a1afbaf563ed9874c00688e50337dffeb5257ba5c6f1f46ccf18b8fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFE26.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat
Filesize
34KB

MD5
327a27380c4567dde151d69f566028a4

SHA1
318b87d67da0d4c8146f4b0bd4617f48a25cfef7

SHA256
d86dc6a1077ef1d7182b6bddfca92728e57d511f0324cbc3b07eec9db88c5313

SHA512
1f061ffb0973f00e38f080cb97fb44c48c3fc515eae14925f8efe5e3dad4dc03fc83c4437bf36c2dae8ddbb100148a4975f3e8d7a4763eb0e222472048d5d633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\favicon[2].ico
Filesize
33KB

MD5
984e9972d3255788b83feb97e1637699

SHA1
4e3ea948abc13299ff124dccdf4b6ac620f7af72

SHA256
19833a52f3a24049c123edf49ac201e3b6cb563dfded6d2a92f9c1377ff26122

SHA512
5e5fa0537eaac8a5dd0f77442064f1af620f7bb1614152b0ca477bd252b64c7495901ba8ac72fe9cc2f26f2e11fa90d1a481e92ff04925ebc84a8eb3eff9fbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omm44s4c.c4w.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssFB6F.ps1
Filesize
5KB

MD5
fc1bb6c87fd1f08b534e52546561c53c

SHA1
db402c5c1025cf8d3e79df7b868fd186243aa9d1

SHA256
a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b

SHA512
5495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\scrFB00.ps1
Filesize
17KB

MD5
d815da347cf3c1a260840649beb56ff7

SHA1
4da95ffed10e7369b685a390fe4e99a6a1e1f416

SHA256
d6f001aeb36cdb8e6bbcb0d35ffe55c86ad5f942f9d0d15a089706801fdad931

SHA512
ca2cd68cf615db854c7ccc6cc5c84da4a8b5f6913229c856fc343ba3e7af8563b0afcd29e9d14ca75eb4cf833102a2ea8b802629f284819bfb2630a82d61b170

Download Submit
C:\Users\Public\Documents\AnyDesk\winrar.exe
Filesize
3.3MB

MD5
8a6217d94e1bcbabdd1dfcdcaa83d1b3

SHA1
99b81b01f277540f38ea3e96c9c6dc2a57dfeb92

SHA256
3023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684

SHA512
a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54

Download Submit
C:\Users\Public\Documents\AnyDesk\winrar.exe
Filesize
3.3MB

MD5
8a6217d94e1bcbabdd1dfcdcaa83d1b3

SHA1
99b81b01f277540f38ea3e96c9c6dc2a57dfeb92

SHA256
3023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684

SHA512
a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54

Download Submit
C:\Windows\Installer\MSIF438.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF438.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF64C.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF64C.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF6F9.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF6F9.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF6F9.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF70A.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF70A.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFAE4.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\Windows\Installer\MSIFAE4.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\Windows\Installer\e56f3bb.msi
Filesize
4.5MB

MD5
68ba045e1427d63d03660ef2d88584d0

SHA1
a3e9bd9adddf1aaaaff03cd69a7128e6fc774977

SHA256
e06b212b0c26d4f385a3623c64820b3ea4bbd83065646a38d1f3e0cfdfbb0898

SHA512
d677806a4c4ed419995b0ead65db4081c3e4b002e400fafb8d042d6695e7e17cc476a0ccc8df9c1caed164254ba2536c73891f89f6f9f57aea7a5421a6d964e8

Download Submit
C:\brado\intrínseco\Hw2dom.exe
Filesize
9.7MB

MD5
2e47fc5675f96d63b11821b8f0395f17

SHA1
1dccc123e58d2802491602345433dcb1e723f192

SHA256
74b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4

SHA512
2ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273

Download Submit
C:\brado\intrínseco\Hw2dom.exe
Filesize
9.7MB

MD5
2e47fc5675f96d63b11821b8f0395f17

SHA1
1dccc123e58d2802491602345433dcb1e723f192

SHA256
74b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4

SHA512
2ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273

Download Submit
C:\brado\intrínseco\Hw2dom.exe
Filesize
9.7MB

MD5
2e47fc5675f96d63b11821b8f0395f17

SHA1
1dccc123e58d2802491602345433dcb1e723f192

SHA256
74b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4

SHA512
2ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273

Download Submit
C:\brado\intrínseco\Update.zip
Filesize
32.9MB

MD5
d546eff329671383fb1f934e80ea7435

SHA1
c8e7ce1bff5870397cc6a636b73d79c4a1804da7

SHA256
8a188dc28b67770cef25f9ea7312ca84f674c60c9f418eab0fedbbbffde9695c

SHA512
fb2a5851b10b3d72f3f4be90d85c0b8aab4c3fb02b99802134c0618608c9a8c17df51521c28c85f7ebd6aa032a9602a44061c06fb0eb557e34557d73f8a4098b

Download Submit
C:\brado\intrínseco\windowsdump
Filesize
89.4MB

MD5
41aa2f4db1989e641169e9ccdf38a347

SHA1
ced16950ca2e1c5d08ea87bb3034c21e6c6dd1df

SHA256
573e582a98e8190dcf3b0dbe5ed86fe6e56044e948b5d5221b18052b584d5dc0

SHA512
3423b722e89e4086f9ffd155b8039acd698775bf56181c23621269ca512e24e4a83c091c4ecbbf008edca0306b943c6e5b70170b51a17bf3f450c4d58d63f358

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
3e2501d645cd7f81776150972ee6e9c9

SHA1
ad7d0419e955faf52a9518388ad1667bc1fc737b

SHA256
b4faa400f122e1b40e7cb56335e0a3c542e0bba97196446b48fede01dc2c8c91

SHA512
d40e9b6198339574709381da5cca980a76a6bca4a9d4a35a065ade1e85c0ebaadf765f94e986ec2508310323acc30d26496db903de14d5bcb34e22664a3103f5

Download Submit
\??\Volume{93c6d6f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2cee5045-b685-4013-8ca3-8c55cc3df42f}_OnDiskSnapshotProp
Filesize
5KB

MD5
ba49d4b94012b41819fa86a0fe5b9834

SHA1
b8905615c6d874f16d061d03e645a4df3b4e6b48

SHA256
6dffe736beadefaa50421acdcaae4121e471d955de0cd12b4165c9416df26741

SHA512
b869b918b460326241f48a3cff6abcb757f2702f737bd11c774f53d2aa52d743d2ffe356e5f7ec62fbeb76a6b5a19fafbb568307a368f252114d48d3e52219e0

Download Submit
memory/1468-439-0x000002244BE80000-0x000002244D4F7000-memory.dmp

Filesize
22.5MB

Download
memory/4792-186-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/4792-199-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-198-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-197-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-193-0x0000000007F70000-0x0000000008514000-memory.dmp

Filesize
5.6MB

Download
memory/4792-170-0x00000000049C0000-0x00000000049F6000-memory.dmp

Filesize
216KB

Download
memory/4792-171-0x00000000050C0000-0x00000000056E8000-memory.dmp

Filesize
6.2MB

Download
memory/4792-192-0x0000000006560000-0x0000000006582000-memory.dmp

Filesize
136KB

Download
memory/4792-172-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-191-0x0000000007270000-0x0000000007306000-memory.dmp

Filesize
600KB

Download
memory/4792-173-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-190-0x00000000064D0000-0x00000000064EA000-memory.dmp

Filesize
104KB

Download
memory/4792-189-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Filesize
6.5MB

Download
memory/4792-188-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4792-176-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/4792-174-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Filesize
136KB

Download
memory/4792-175-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/4924-361-0x0000000010A60000-0x0000000010AF4000-memory.dmp

Filesize
592KB

Download
memory/4924-384-0x000000000F550000-0x000000000F578000-memory.dmp

Filesize
160KB

Download
memory/4924-351-0x000000000E730000-0x000000000E75C000-memory.dmp

Filesize
176KB

Download
memory/4924-354-0x000000000E990000-0x000000000E996000-memory.dmp

Filesize
24KB

Download
memory/4924-355-0x000000000EB10000-0x000000000EC81000-memory.dmp

Filesize
1.4MB

Download
memory/4924-357-0x000000000F220000-0x000000000F29A000-memory.dmp

Filesize
488KB

Download
memory/4924-358-0x000000000F2A0000-0x000000000F2B7000-memory.dmp

Filesize
92KB

Download
memory/4924-359-0x000000000F2C0000-0x000000000F2F1000-memory.dmp

Filesize
196KB

Download
memory/4924-349-0x0000000002E20000-0x0000000002E28000-memory.dmp

Filesize
32KB

Download
memory/4924-362-0x0000000010B80000-0x0000000010BD8000-memory.dmp

Filesize
352KB

Download
memory/4924-360-0x000000000F300000-0x000000000F319000-memory.dmp

Filesize
100KB

Download
memory/4924-363-0x0000000010BE0000-0x0000000010BE6000-memory.dmp

Filesize
24KB

Download
memory/4924-366-0x0000000010D30000-0x0000000010D49000-memory.dmp

Filesize
100KB

Download
memory/4924-375-0x0000000010D50000-0x0000000010DC4000-memory.dmp

Filesize
464KB

Download
memory/4924-378-0x000000000F4B0000-0x000000000F4B8000-memory.dmp

Filesize
32KB

Download
memory/4924-381-0x000000000F4C0000-0x000000000F538000-memory.dmp

Filesize
480KB

Download
memory/4924-382-0x000000000F540000-0x000000000F550000-memory.dmp

Filesize
64KB

Download
memory/4924-350-0x000000000E700000-0x000000000E728000-memory.dmp

Filesize
160KB

Download
memory/4924-386-0x000000000F580000-0x000000000F5A1000-memory.dmp

Filesize
132KB

Download
memory/4924-388-0x000000000F5B0000-0x000000000F5CF000-memory.dmp

Filesize
124KB

Download
memory/4924-390-0x000000000F720000-0x000000000F728000-memory.dmp

Filesize
32KB

Download
memory/4924-391-0x0000000011520000-0x0000000011B4F000-memory.dmp

Filesize
6.2MB

Download
memory/4924-392-0x0000000011D50000-0x0000000011D82000-memory.dmp

Filesize
200KB

Download
memory/4924-393-0x0000000011D90000-0x0000000011F70000-memory.dmp

Filesize
1.9MB

Download
memory/4924-394-0x0000000011F70000-0x00000000120D5000-memory.dmp

Filesize
1.4MB

Download
memory/4924-348-0x000000000E570000-0x000000000E6FF000-memory.dmp

Filesize
1.6MB

Download
memory/4924-419-0x00000000120E0000-0x00000000121A3000-memory.dmp

Filesize
780KB

Download
memory/4924-427-0x00000000122F0000-0x000000001247F000-memory.dmp

Filesize
1.6MB

Download
memory/4924-345-0x0000000000400000-0x0000000000DC3000-memory.dmp

Filesize
9.8MB

Download
memory/4924-257-0x000000000E8B0000-0x000000000E8B1000-memory.dmp

Filesize
4KB

Download
memory/4924-255-0x0000000008BF0000-0x000000000E567000-memory.dmp

Filesize
89.5MB

Download
memory/4924-515-0x000000000E8B0000-0x000000000E8B1000-memory.dmp

Filesize
4KB

Download
memory/4924-253-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/4924-252-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download