Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2023, 01:06
Behavioral task
behavioral1
Sample
64CO.exe
Resource
win7-20231023-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
64CO.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 64CO.exe
- Size 1.2MB
- Sample231129-bf6fcadf37
- SHA256 033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c
- MD5 a80b79de02d6881d5e54afcefa38298a
- SHA1 e0d3e2612a757ff5be818b114028a0e4bb562bc5
- SHA512 1fbe52a0086a33a98e48f501c669f3a9e82b5795550702eb61ccc281c77ba29fe217a5897b6caf55582ca1c16d062a2d3219a596d4372c70782bc49499e0ed4f
- SSDEEP 24576:FCLKd8jHzb9904e43wa2SZ6Es9S+Nm0m:4K099ReumEwS+
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4444 bcdedit.exe 4876 bcdedit.exe - Renames multiple (629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4360 wbadmin.exe 740 wbadmin.exe - Drops file in Drivers directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\networks 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\networks.keversen 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\protocol 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.keversen 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\services.keversen 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.keversen 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\services 64CO.exe File opened for modification C:\Windows\System32\drivers\etc\services.inprocess 64CO.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation 64CO.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\64CO.exe\" e" 64CO.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-3455265224-196869244-2056873367-1000\desktop.ini 64CO.exe - Enumerates connected drives 3 TTPs 39 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 64CO.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: 64CO.exe File opened (read-only) \??\K: 64CO.exe File opened (read-only) \??\L: 64CO.exe File opened (read-only) \??\N: 64CO.exe File opened (read-only) \??\Y: 64CO.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\F: 64CO.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\J: 64CO.exe File opened (read-only) \??\M: 64CO.exe File opened (read-only) \??\D: 64CO.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\U: 64CO.exe File opened (read-only) \??\X: 64CO.exe File opened (read-only) \??\Z: 64CO.exe File opened (read-only) \??\A: 64CO.exe File opened (read-only) \??\B: 64CO.exe File opened (read-only) \??\G: 64CO.exe File opened (read-only) \??\I: 64CO.exe File opened (read-only) \??\W: 64CO.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\O: 64CO.exe File opened (read-only) \??\R: 64CO.exe File opened (read-only) \??\S: 64CO.exe File opened (read-only) \??\V: 64CO.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\T: 64CO.exe File opened (read-only) \??\E: 64CO.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\Q: 64CO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\BBI 64CO.exe File created C:\Windows\system32\CatRoot2\edbtmp.log svchost.exe File opened for modification C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.jfm svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies.inprocess 64CO.exe File opened for modification C:\Windows\System32\ResPriImageListLowCost 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.keversen 64CO.exe File opened for modification C:\Windows\System32\config\DRIVERS.inprocess 64CO.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess 64CO.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\config\SYSTEM 64CO.exe File opened for modification C:\Windows\system32\CatRoot2\edb.log svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 64CO.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\SECURITY 64CO.exe File opened for modification C:\Windows\system32\CatRoot2\edbtmp.log svchost.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.keversen 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.keversen 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\ELAM 64CO.exe File created C:\Windows\system32\CatRoot2\edbres00002.jrs svchost.exe File opened for modification C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm svchost.exe File created C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb svchost.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\16843576-125f-43ea-90ea-a83e2e54d435.keversen 64CO.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.keversen 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess 64CO.exe File created C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.keversen 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.inprocess 64CO.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan.inprocess 64CO.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 64CO.exe File opened for modification C:\Windows\System32\ResPriHMImageList 64CO.exe File opened for modification C:\Windows\System32\config\BCD-Template.keversen 64CO.exe File opened for modification C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb svchost.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\654bd96f-ff2e-4668-9fcb-e8d873679815 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.keversen 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.keversen 64CO.exe File opened for modification C:\Windows\System32\config\ELAM.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess 64CO.exe File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess 64CO.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\16843576-125f-43ea-90ea-a83e2e54d435 64CO.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\654bd96f-ff2e-4668-9fcb-e8d873679815.keversen 64CO.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\87d379a3-e6c5-484a-9ef9-9428568c9b8d 64CO.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A 64CO.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 64CO.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies 64CO.exe File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess 64CO.exe File opened for modification C:\Windows\System32\config\COMPONENTS.keversen 64CO.exe File opened for modification C:\Windows\system32\CatRoot2\edb.jcp svchost.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess 64CO.exe File created C:\Windows\system32\CatRoot2\edbres00001.jrs svchost.exe - Drops file in Program Files directory 52 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\removed-files 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files.inprocess 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.keversen 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.keversen 64CO.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.keversen 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.keversen 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess 64CO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H 64CO.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences 64CO.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.keversen 64CO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete.inprocess 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile 64CO.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.keversen 64CO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050 64CO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{AE86D888-1404-47CC-A7BB-8D86C0503E58}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7} 64CO.exe File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.keversen 64CO.exe File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.keversen 64CO.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F} 64CO.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} 64CO.exe File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} 64CO.exe File opened for modification C:\Windows\Boot\DVD\PCAT\BCD 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.inprocess 64CO.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_63cc4225-b733-40b3-b5f9-0991cac33c4b.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.inprocess 64CO.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.keversen 64CO.exe File opened for modification C:\Windows\AppReadiness\S-1-5-21-3455265224-196869244-2056873367-1000 64CO.exe File opened for modification C:\Windows\AppReadiness\S-1-5-21-3455265224-196869244-2056873367-1000.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79} 64CO.exe File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79}.inprocess 64CO.exe File opened for modification C:\Windows\Boot\PCAT\bootmgr 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5} 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.keversen 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess 64CO.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess 64CO.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Panther\setupinfo.inprocess 64CO.exe File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE} 64CO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 13 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4164 vssadmin.exe 2832 vssadmin.exe 2360 vssadmin.exe 2932 vssadmin.exe 2024 vssadmin.exe 900 vssadmin.exe 1760 vssadmin.exe 3384 vssadmin.exe 3564 vssadmin.exe 4156 vssadmin.exe 1908 vssadmin.exe 4064 vssadmin.exe 3824 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe 4880 64CO.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeBackupPrivilege 3696 vssvc.exe Token: SeRestorePrivilege 3696 vssvc.exe Token: SeAuditPrivilege 3696 vssvc.exe Token: SeIncreaseQuotaPrivilege 2284 wmic.exe Token: SeSecurityPrivilege 2284 wmic.exe Token: SeTakeOwnershipPrivilege 2284 wmic.exe Token: SeLoadDriverPrivilege 2284 wmic.exe Token: SeSystemProfilePrivilege 2284 wmic.exe Token: SeSystemtimePrivilege 2284 wmic.exe Token: SeProfSingleProcessPrivilege 2284 wmic.exe Token: SeIncBasePriorityPrivilege 2284 wmic.exe Token: SeCreatePagefilePrivilege 2284 wmic.exe Token: SeBackupPrivilege 2284 wmic.exe Token: SeRestorePrivilege 2284 wmic.exe Token: SeShutdownPrivilege 2284 wmic.exe Token: SeDebugPrivilege 2284 wmic.exe Token: SeSystemEnvironmentPrivilege 2284 wmic.exe Token: SeRemoteShutdownPrivilege 2284 wmic.exe Token: SeUndockPrivilege 2284 wmic.exe Token: SeManageVolumePrivilege 2284 wmic.exe Token: 33 2284 wmic.exe Token: 34 2284 wmic.exe Token: 35 2284 wmic.exe Token: 36 2284 wmic.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4880 wrote to memory of 3564 4880 64CO.exe 87 PID 4880 wrote to memory of 3564 4880 64CO.exe 87 PID 4880 wrote to memory of 2024 4880 64CO.exe 91 PID 4880 wrote to memory of 2024 4880 64CO.exe 91 PID 4880 wrote to memory of 4156 4880 64CO.exe 93 PID 4880 wrote to memory of 4156 4880 64CO.exe 93 PID 4880 wrote to memory of 2832 4880 64CO.exe 95 PID 4880 wrote to memory of 2832 4880 64CO.exe 95 PID 4880 wrote to memory of 2360 4880 64CO.exe 97 PID 4880 wrote to memory of 2360 4880 64CO.exe 97 PID 4880 wrote to memory of 900 4880 64CO.exe 99 PID 4880 wrote to memory of 900 4880 64CO.exe 99 PID 4880 wrote to memory of 1760 4880 64CO.exe 102 PID 4880 wrote to memory of 1760 4880 64CO.exe 102 PID 4880 wrote to memory of 1908 4880 64CO.exe 104 PID 4880 wrote to memory of 1908 4880 64CO.exe 104 PID 4880 wrote to memory of 4064 4880 64CO.exe 106 PID 4880 wrote to memory of 4064 4880 64CO.exe 106 PID 4880 wrote to memory of 3824 4880 64CO.exe 109 PID 4880 wrote to memory of 3824 4880 64CO.exe 109 PID 4880 wrote to memory of 4164 4880 64CO.exe 111 PID 4880 wrote to memory of 4164 4880 64CO.exe 111 PID 4880 wrote to memory of 2932 4880 64CO.exe 113 PID 4880 wrote to memory of 2932 4880 64CO.exe 113 PID 4880 wrote to memory of 3384 4880 64CO.exe 116 PID 4880 wrote to memory of 3384 4880 64CO.exe 116 PID 4880 wrote to memory of 4444 4880 64CO.exe 118 PID 4880 wrote to memory of 4444 4880 64CO.exe 118 PID 4880 wrote to memory of 4876 4880 64CO.exe 120 PID 4880 wrote to memory of 4876 4880 64CO.exe 120 PID 4880 wrote to memory of 4360 4880 64CO.exe 122 PID 4880 wrote to memory of 4360 4880 64CO.exe 122 PID 4880 wrote to memory of 740 4880 64CO.exe 124 PID 4880 wrote to memory of 740 4880 64CO.exe 124 PID 4880 wrote to memory of 2284 4880 64CO.exe 126 PID 4880 wrote to memory of 2284 4880 64CO.exe 126 PID 4880 wrote to memory of 4404 4880 64CO.exe 135 PID 4880 wrote to memory of 4404 4880 64CO.exe 135 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 64CO.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64CO.exe"C:\Users\Admin\AppData\Local\Temp\64CO.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4880 -
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3564
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:2024
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4156
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2832
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2360
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:900
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1760
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1908
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4064
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3824
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4164
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2932
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:3384
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:4444
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:4876
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4360
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:740
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64CO.exe >> NUL2⤵PID:4404
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:64
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\398EE64D66758B5715368AA94044B13A.keversen
- Size 710B
- SHA256 ccc671deb21fdf5ee401574f6573990509b11a1c1d3dda6aa61e8f85be7816be
- MD5 31c5920536e892041123cc3552756b95
- SHA1 3537449938f8fb73a9e37e79ed973270586ddaf3
- SHA512 97deba22755862befdb5c53dee4fe0674421eae74f7608c2b394bbc4970c300cafe02e0e897b7efe27b3bb5945ff299c8fa361e9f4568242c152ba0b076609cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.keversen
- Size 850B
- SHA256 e3f71c19d7a60e2030c57e3d77183da83e7ac3e51707785d67c4a1636e25e748
- MD5 0eb6e1875269be11df9201496aff5a83
- SHA1 878dd586c9b45c1dca1a52f9df96f4466e995048
- SHA512 1b327bbec6adc3b4c91e9d2d265888110f966597605e82247d3bfb121188343ed4c4c6f154a47246d0074f157c13e8ac31583f0908511f694faad252bb3085bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.keversen
- Size 842B
- SHA256 e4799dc078e016952719338909f339b3ac38019a0a05206ce2e16393b0f5e6fc
- MD5 e5ec6c3c57a2b3872912a4a8eb1e1004
- SHA1 538204c8b668e4980477a4adefb999b108ef4f13
- SHA512 c3727fad1484fe53edfcd47ecf5024f9e08b42c7c03019ace72e24515ecd860774e77cea34f53e421676a9dd47b9560c5b429b390686c911b09f10290c74bc39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.keversen
- Size 770B
- SHA256 e5369e24eb34a96813bd9daa62fb63464640ff67cc605a4173a4a38b72709e2b
- MD5 c0ec87ea5071471b443ece8bf23e86b7
- SHA1 72600953fb557732c8d2710b0ca4d10ffb038452
- SHA512 10f04a0d8f41c4e11fbd886eb585e4e2ea1dab3e2663cbfdc1ba345072a14696670ad8032eda78851bcd46c128f294808add9551f976b5191eeaf751a39ea505
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.keversen
- Size 842B
- SHA256 0871cc581cd8610812795430819cbf48a081a7be7876674a5b7af0ea327247d8
- MD5 b00998e7184e9d4d4c79747441b2b3bb
- SHA1 e42f1d6ce9c43ed673bcb46e5282ddbfc3ed540e
- SHA512 c7b3fa71a90cc649eee9f7bcf052f59c82ba170f5aef07df59683e4c04020cef92ab0539d6d47b7a7b306e635656fe065898a001c05920c9ceb8caa28eb0ee92
- MD5 SHA1 SHA512
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 149KB
- SHA256 4f129e2ab632a5d65ac76389303df9de0e5df39ad187b49b9bdc59a985cd3dad
- MD5 23c80d155e245ba8a6ceeec50b15746f
- SHA1 144ddad37dc61843d8fe01a112d50382649fb554
- SHA512 66e956fcdd5dbce6a71a35f160cc4a0023997159ca95e5e496aa72f52790f048c67c92254997443b7902835098a3971059cad56438e55d7e25fb7d1ef3d083ca
- SSDEEP 1536:Xrr9dnaRGmLWzH7jWkNJxe+u3PqBO6GyrswsF6fyYPfAf+fLTfRJ/rzPMrHcM95h:d9GJr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\catroot2\edb.log
- Size 2.0MB
- SHA256 f1e74880a14afba83a83e5274bfc8d18d3a84f441976dcf781a9ef86de147f5d
- MD5 7ee5c1f681b959b8eff0c3e54f46976d
- SHA1 8c7e2f9ee17db5a80bbc0603baef87583a343901
- SHA512 a017e55a70e7167313dcfb17d8e435d2e0b6556d8874bb4ce55c38bd19c182aa4f4f34afb7081d6abfa25456e6adf5fc9d854c5b8c0269e3c4ce8a53335d3e1f
- SSDEEP 6:saiy0+FRUhWwhWUQmgO+FS4y312tlEkTWwhWUQmgQu/t9/vI9t1S9//vI9t1S9:sqFu1FQrOKmSl1FQrx1FvI1SNvI1S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 814B
- SHA256 598e6c630e279f3dd1ee4fcfd77bdfce374a839fdbf5941b2ebece5c337f286f
- MD5 7f34ae4b60b3da7ababa8b129cc35fa6
- SHA1 28e763c23fbdd863b41ca8ec9ee9460fb99fbfd6
- SHA512 4917502265c4057e9888ef6d2f9a8cc2afb94be37f98fafd699ddcb619dd5170772129bc9d920f704098e5101789d4a11da04cdc24f338017e31f24cd0de71a1
- MD5 SHA1 SHA512