Analysis
-
max time kernel
45s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 12:41
Behavioral task
behavioral1
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
-
Size
145KB
-
MD5
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
SHA1
64c89ea4b19bdc85f5f0c9b49430635c7a077d0a
-
SHA256
34f86c5d8ad41ae37d6e843f884a8261ad2c55534f5635ddf368f65323b3dbcf
-
SHA512
db0a50953b83b88f1594096ce7cad35d6bde8a562708eb016cae091eb931af614dcd9d363618223bbeadb1c929ccdf10733470502d38516fdcc1f6292e61546e
-
SSDEEP
384:beRq2+Te7vMw5Qm/w96XsIDnN7oE8INlRe0h9kVWJVXiM2+3iY:KRKyMw5QKXsYcYlhbWWJIsi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/4500-17-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/files/0x000700000002320c-12.dat acprotect behavioral2/memory/1776-29-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 2 IoCs
pid Process 4500 Process not Found 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
resource yara_rule behavioral2/memory/4500-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4456-1-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000a0000000231fa-7.dat upx behavioral2/memory/4500-17-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/4500-18-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000700000002320c-12.dat upx behavioral2/memory/1776-29-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/4456-31-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1776-32-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1472-34-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/636-35-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\R: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\R: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\M: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\M: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\M: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\M: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll Process not Found File opened for modification C:\Windows\SysWOW64\ftpdll.dll 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4456 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4456 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 4500 Process not Found 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4500 Process not Found 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4456 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 58 PID 4500 wrote to memory of 4456 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 58 PID 4500 wrote to memory of 4456 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 58 PID 4500 wrote to memory of 4008 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 70 PID 4500 wrote to memory of 4008 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 70 PID 4500 wrote to memory of 4008 4500 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 70 PID 4500 wrote to memory of 1776 4500 Process not Found 95 PID 4500 wrote to memory of 1776 4500 Process not Found 95 PID 4500 wrote to memory of 1776 4500 Process not Found 95 PID 4456 wrote to memory of 1472 4456 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 102 PID 4456 wrote to memory of 1472 4456 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 102 PID 4456 wrote to memory of 1472 4456 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 102 PID 1776 wrote to memory of 636 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 104 PID 1776 wrote to memory of 636 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 104 PID 1776 wrote to memory of 636 1776 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe"C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe3⤵
- Enumerates connected drives
PID:1472
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe3⤵
- Enumerates connected drives
PID:636
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e