Analysis
- max time kernel
300s - max time network
300s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system - submitted
20/02/2024, 05:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/cFVxFBaZ#T5JSBZWBHPyNehpK-ftW0Pl6ORYvqYbgG6i1JaMT6Ac
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://mega.nz/file/cFVxFBaZ#T5JSBZWBHPyNehpK-ftW0Pl6ORYvqYbgG6i1JaMT6Ac
Resource
win11-20240214-en
windows11-21h2-x64
32 signatures
1800 seconds
General
- Target https://mega.nz/file/cFVxFBaZ#T5JSBZWBHPyNehpK-ftW0Pl6ORYvqYbgG6i1JaMT6Ac
- Sample240220-gb33bacf75
Score
9/10
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Downloads MZ/PE file
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET69C7.tmp NPFInstall.exe File created C:\Windows\system32\DRIVERS\SET69C7.tmp NPFInstall.exe File opened for modification C:\Windows\system32\DRIVERS\npcap.sys NPFInstall.exe - Manipulates Digital Signatures 1 TTPs 8 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480 certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52 certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53 certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987 certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL" certutil.exe - Executes dropped EXE 14 IoCs
pid Process 3252 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 2408 chromedriver.exe 3636 Snowx Checker 1.4.exe 2300 Snowx Checker 1.4.exe 4564 Wireshark-4.2.3-x64.exe 3680 vc_redist.x64.exe 3404 vc_redist.x64.exe 1168 VC_redist.x64.exe 3116 npcap-1.78.exe 5280 NPFInstall.exe 5368 NPFInstall.exe 5528 NPFInstall.exe 5812 NPFInstall.exe - Loads dropped DLL 64 IoCs
pid Process 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe 4408 Snowx Checker 1.4.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\npcap.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\npcap.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\npcap.PNF NPFInstall.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6860.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF NPFInstall.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File created C:\Windows\SysWOW64\Npcap\WlanHelper.exe npcap-1.78.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_72f156a5ee3f59e8\netrass.PNF NPFInstall.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_56c163d21e8c2b62\netserv.PNF NPFInstall.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\Npcap\wpcap.dll npcap-1.78.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_0525128a3d54207e\netnwifi.PNF NPFInstall.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\ndiscap.PNF NPFInstall.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_10acfa4b924dd181\netnb.PNF NPFInstall.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\Npcap\NpcapHelper.exe npcap-1.78.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6861.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6862.tmp DrvInst.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6861.tmp DrvInst.exe File created C:\Windows\system32\Npcap\WlanHelper.exe npcap-1.78.exe File created C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6860.tmp DrvInst.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\SysWOW64\Npcap\wpcap.dll npcap-1.78.exe File created C:\Windows\SysWOW64\Npcap\Packet.dll npcap-1.78.exe File created C:\Windows\system32\Npcap\Packet.dll npcap-1.78.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\NPCAP.inf DrvInst.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\npcap.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_3debe5e78bab1bca\netbrdg.PNF NPFInstall.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF NPFInstall.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Wireshark\radius\dictionary.networkphysics Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libspeexdsp.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.merit Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libiconv-2.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\diameter\Metaswitch.xml Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.altiga Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.arbor Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.bskyb Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.freeradius Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\uninstall-wireshark.exe Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libwiretap.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ruggedcom Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.nokia.conflict Wireshark-4.2.3-x64.exe File created C:\Program Files\Npcap\npcap.sys npcap-1.78.exe File created C:\Program Files\Wireshark\nghttp2.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libxml2.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.alvarion.wimax.v2_2 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.garderos Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.prosoft Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc5607 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libintl-8.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\minizip.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc7155 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc7930 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ericsson.ab Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.kineto Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.quiconnect Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.sofaware Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\tpncp\tpncp.dat Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\COPYING.txt Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.dellemc Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.travelping Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.tropos Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.unix Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.cisco.asa Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.terena Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.3gpp2 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.redcreek Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.citrix Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.foundry Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.jradius Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc6911 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.wispr Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\zlib1.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\diameter\sunping.xml Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.purewave Wireshark-4.2.3-x64.exe File created C:\Program Files\Npcap\DiagReport.ps1 npcap-1.78.exe File created C:\Program Files\Wireshark\radius\dictionary.compatible Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.netscreen Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.nexans Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\libwinpthread-1.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\wireshark-filter.html Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.chillispot Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.fortinet Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.nortel Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.roaringpenguin Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\npcap-1.78.exe Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\lua52.dll Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.azaire Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\README.radius_dictionary Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.alcatel.sr Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.hp Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc2867 Wireshark-4.2.3-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc5904 Wireshark-4.2.3-x64.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_1 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\wasm\index-dir\temp-index chrome.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFBA2F012FB2252524.TMP msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Local Storage\leveldb\MANIFEST-000001 chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\index chrome.exe File created C:\Windows\SystemTemp\~DF869AA9A16C9BEED4.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\CrashpadMetrics-active.pma chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_0 chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_3 chrome.exe File opened for modification C:\Windows\Installer\e5a1273.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Local State chromedriver.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Local Storage\leveldb\LOCK chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_2 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_3 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_0 chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_2 chrome.exe File created C:\Windows\Installer\e5a1260.msi msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\DevToolsActivePort chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\index chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_1 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\js\index chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\js\index-dir\the-real-index chrome.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050} msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_0 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_2 chrome.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e5a1272.msi msiexec.exe File created C:\Windows\SystemTemp\~DF35B44113F73D4647.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\SystemTemp chromedriver.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\chrome_debug.log chrome.exe File created C:\Windows\SystemTemp\~DFC0D256BB2CD21362.TMP msiexec.exe File created C:\Windows\Installer\e5a1288.msi msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Local Storage\leveldb\000001.dbtmp chrome.exe File opened for modification C:\Windows\Installer\e5a1260.msi msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_2 chrome.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Crashpad\metadata chrome.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\First Run chromedriver.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Crashpad\settings.dat chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Local Storage\leveldb\LOG chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Local Storage\leveldb\MANIFEST-000001 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\js\index-dir\temp-index chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\wasm\index-dir\the-real-index chrome.exe File opened for modification C:\Windows\Installer\MSI1474.tmp msiexec.exe File created C:\Windows\Installer\e5a1273.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI18CB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI156F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1AC0.tmp msiexec.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Preferences chromedriver.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_1 chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_1 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\Code Cache\wasm\index chrome.exe File created C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2} msiexec.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\CrashpadMetrics.pma chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Crashpad\settings.dat chrome.exe File opened for modification C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\GPUCache\data_3 chrome.exe File created C:\Windows\SystemTemp\scoped_dir2408_117461902\Default\DawnCache\data_3 chrome.exe File created C:\Windows\SystemTemp\~DF7800F8FED3EFE8BF.TMP msiexec.exe File created C:\Windows\INF\oem3.PNF NPFInstall.exe - Detects Pyinstaller 3 IoCs
resource yara_rule behavioral2/files/0x000100000002a816-291.dat pyinstaller behavioral2/files/0x000100000002a816-292.dat pyinstaller behavioral2/files/0x000100000002a816-530.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5304 5188 WerFault.exe 181 - Checks SCSI registry key(s) 3 TTPs 43 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 NPFInstall.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000080bec3d2fab6299b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000080bec3d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090080bec3d2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d80bec3d2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000080bec3d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rf5\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon\ = "\"C:\\Program Files\\Wireshark\\Wireshark.exe\",1" Wireshark-4.2.3-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ntar Wireshark-4.2.3-x64.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings OpenWith.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pkt\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1473553098-1580226532-3330220195-1000\{1DFB76C4-51A2-4DEE-8182-F78B77CF3267} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle VC_redist.x64.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.syc\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.snoop Wireshark-4.2.3-x64.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.trc\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rtp\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mplog\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tr1\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.acp Wireshark-4.2.3-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ipfix\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lcap Wireshark-4.2.3-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rf5 Wireshark-4.2.3-x64.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg OpenWith.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.36.32532" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Provider msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon Wireshark-4.2.3-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng Wireshark-4.2.3-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fdc Wireshark-4.2.3-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.enc\ = "wireshark-capture-file" Wireshark-4.2.3-x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Clients = 3a0000000000 msiexec.exe - NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Snowx Checker 1.4.rar:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 528075.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Wireshark-4.2.3-x64.exe:Zone.Identifier msedge.exe - Opens file in notepad (likely ransom note) 2 IoCs
pid Process 5768 NOTEPAD.EXE 4300 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4408 Snowx Checker 1.4.exe 2300 Snowx Checker 1.4.exe 5640 vlc.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 4652 msedge.exe 4652 msedge.exe 4376 msedge.exe 4376 msedge.exe 952 identity_helper.exe 952 identity_helper.exe 1532 msedge.exe 1532 msedge.exe 3356 msedge.exe 3356 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 4324 msedge.exe 4324 msedge.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 4976 msiexec.exe 5280 NPFInstall.exe 5280 NPFInstall.exe 5584 powershell.exe 5584 powershell.exe 5584 powershell.exe 5864 powershell.exe 5864 powershell.exe 5864 powershell.exe 4624 powershell.exe 4624 powershell.exe 4624 powershell.exe 2856 powershell.exe 2856 powershell.exe 2856 powershell.exe 2732 powershell.exe 2732 powershell.exe 2732 powershell.exe 5188 powershell.exe 5188 powershell.exe 5188 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 5 IoCs
pid Process 3832 7zFM.exe 4408 Snowx Checker 1.4.exe 2300 Snowx Checker 1.4.exe 5640 vlc.exe 1988 OpenWith.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2456 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2456 AUDIODG.EXE Token: SeRestorePrivilege 3832 7zFM.exe Token: 35 3832 7zFM.exe Token: SeSecurityPrivilege 3832 7zFM.exe Token: SeBackupPrivilege 4080 vssvc.exe Token: SeRestorePrivilege 4080 vssvc.exe Token: SeAuditPrivilege 4080 vssvc.exe Token: SeShutdownPrivilege 1168 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 1168 VC_redist.x64.exe Token: SeSecurityPrivilege 4976 msiexec.exe Token: SeCreateTokenPrivilege 1168 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 1168 VC_redist.x64.exe Token: SeLockMemoryPrivilege 1168 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 1168 VC_redist.x64.exe Token: SeMachineAccountPrivilege 1168 VC_redist.x64.exe Token: SeTcbPrivilege 1168 VC_redist.x64.exe Token: SeSecurityPrivilege 1168 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 1168 VC_redist.x64.exe Token: SeLoadDriverPrivilege 1168 VC_redist.x64.exe Token: SeSystemProfilePrivilege 1168 VC_redist.x64.exe Token: SeSystemtimePrivilege 1168 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 1168 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 1168 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 1168 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 1168 VC_redist.x64.exe Token: SeBackupPrivilege 1168 VC_redist.x64.exe Token: SeRestorePrivilege 1168 VC_redist.x64.exe Token: SeShutdownPrivilege 1168 VC_redist.x64.exe Token: SeDebugPrivilege 1168 VC_redist.x64.exe Token: SeAuditPrivilege 1168 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 1168 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 1168 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 1168 VC_redist.x64.exe Token: SeUndockPrivilege 1168 VC_redist.x64.exe Token: SeSyncAgentPrivilege 1168 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 1168 VC_redist.x64.exe Token: SeManageVolumePrivilege 1168 VC_redist.x64.exe Token: SeImpersonatePrivilege 1168 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 1168 VC_redist.x64.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 3832 7zFM.exe 3832 7zFM.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe 5640 vlc.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 4408 Snowx Checker 1.4.exe 2300 Snowx Checker 1.4.exe 4564 Wireshark-4.2.3-x64.exe 3680 vc_redist.x64.exe 3404 vc_redist.x64.exe 1168 VC_redist.x64.exe 3052 VC_redist.x64.exe 3136 VC_redist.x64.exe 2428 VC_redist.x64.exe 3116 npcap-1.78.exe 5280 NPFInstall.exe 5368 NPFInstall.exe 5528 NPFInstall.exe 5812 NPFInstall.exe 5640 vlc.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe 1988 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 856 4652 msedge.exe 37 PID 4652 wrote to memory of 856 4652 msedge.exe 37 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 3144 4652 msedge.exe 79 PID 4652 wrote to memory of 1476 4652 msedge.exe 80 PID 4652 wrote to memory of 1476 4652 msedge.exe 80 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 PID 4652 wrote to memory of 1116 4652 msedge.exe 81 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/cFVxFBaZ#T5JSBZWBHPyNehpK-ftW0Pl6ORYvqYbgG6i1JaMT6Ac1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffac2363cb8,0x7ffac2363cc8,0x7ffac2363cd82⤵PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5836 /prefetch:82⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Snowx Checker 1.4.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5604 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:12⤵PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5456 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,12492068437025491018,13183092481479081724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2620 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4324
-
-
C:\Users\Admin\Downloads\Wireshark-4.2.3-x64.exe"C:\Users\Admin\Downloads\Wireshark-4.2.3-x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\Program Files\Wireshark\vc_redist.x64.exe"C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3680 -
C:\Windows\Temp\{D8BF98DB-B239-401D-B2E3-02B1E11053EE}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{D8BF98DB-B239-401D-B2E3-02B1E11053EE}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=596 /install /quiet /norestart4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3404 -
C:\Windows\Temp\{3C436F2F-AE93-4381-9326-51DE3AC12041}\.be\VC_redist.x64.exe"C:\Windows\Temp\{3C436F2F-AE93-4381-9326-51DE3AC12041}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FF578132-12C7-4D15-BD1A-F507B1BD5C92} {E02C4BAB-27EB-4F23-BEF2-A2166A447C3E} 34045⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{F0008360-015E-485D-9FBC-9985FCD36E23} {DE2C6E7A-4D50-4F2A-8071-D303D34CD5BB} 11686⤵
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{F0008360-015E-485D-9FBC-9985FCD36E23} {DE2C6E7A-4D50-4F2A-8071-D303D34CD5BB} 11687⤵
- Suspicious use of SetWindowsHookEx
PID:3136 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{12CE5955-659F-48CC-862A-D0EBB674A3BC} {09DE5EDA-ABA5-4972-8114-3FA9410E3E0A} 31368⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2428
-
-
-
-
-
-
-
C:\Program Files\Wireshark\npcap-1.78.exe"C:\Program Files\Wireshark\npcap-1.78.exe" /winpcap_mode=no /loopback_support=no3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\NPFInstall.exe"C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\NPFInstall.exe" -n -check_dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5280
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5584
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43){certutil.exe -verifystore 'Root' '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43}}"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5864 -
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -verifystore Root 0563b8630d62d75abbc8ab1e4bdfb5a899b24d435⤵
- Manipulates Digital Signatures
PID:6020
-
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -verifystore "Root" "0563b8630d62d75abbc8ab1e4bdfb5a899b24d43"4⤵PID:6072
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst"4⤵PID:6140
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25){certutil.exe -verifystore 'Root' '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25}}"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856 -
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -verifystore Root 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc255⤵PID:5140
-
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -verifystore "Root" "5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25"4⤵PID:2872
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst"4⤵PID:2252
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\signing.p7b"4⤵
- Manipulates Digital Signatures
PID:5260
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -c4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5368 -
C:\Windows\SYSTEM32\pnputil.exepnputil.exe -e5⤵PID:4992
-
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -iw4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5528
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -i4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5812
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 21685⤵
- Program crash
PID:5304
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3092
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"1⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4408 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:2164
-
-
C:\Users\Admin\Desktop\config\chromedriver.exe./config/chromedriver.exe --port=507323⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-blink-features=AutomationControlled --disable-browser-side-navigation --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-gpu --disable-hang-monitor --disable-infobars --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --headless=new --log-level=0 --no-first-run --no-sandbox --no-service-autorun --password-store=basic --remote-debugging-port=0 --start-maximized --test-type=webdriver --use-mock-keychain --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36" --user-data-dir="C:\Windows\SystemTemp\scoped_dir2408_117461902" data:,4⤵
- Drops file in Windows directory
PID:3676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir2408_117461902 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir2408_117461902\Crashpad --metrics-dir=C:\Windows\SystemTemp\scoped_dir2408_117461902 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaafb29758,0x7ffaafb29768,0x7ffaafb297785⤵
- Drops file in Windows directory
PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --log-level=0 --use-angle=swiftshader-webgl --headless --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-level=0 --mojo-platform-channel-handle=1348 --field-trial-handle=1364,i,13269264624696576691,16443878352872701407,131072 --disable-features=PaintHolding /prefetch:25⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-level=0 --use-angle=swiftshader-webgl --use-gl=angle --headless --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36" --log-level=0 --mojo-platform-channel-handle=1540 --field-trial-handle=1364,i,13269264624696576691,16443878352872701407,131072 --disable-features=PaintHolding /prefetch:85⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36" --lang=en-US --first-renderer-process --no-sandbox --enable-automation --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1900 --field-trial-handle=1364,i,13269264624696576691,16443878352872701407,131072 --disable-features=PaintHolding /prefetch:15⤵PID:2864
-
-
-
-
-
C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"1⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"C:\Users\Admin\Desktop\Snowx Checker 1.4.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3288
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{77c68a29-2630-cf4c-aa2e-27c6218ec6da}\NPCAP.inf" "9" "405306be3" "0000000000000154" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Npcap"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5188 -ip 51881⤵PID:5224
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5652
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\config\UTILIDADES.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5768
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\config\check.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5640
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\config\CCS.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4300
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1988
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a1265.rbs
- Size 19KB
- SHA256 f726cbdf16345040cf1d2298a050bfa8fe3ed8c9b12cf6edcd59c70085733cb0
- MD5 0b14d053b4042b67cb29561047996fa0
- SHA1 ee85aab4f1c3e6d4f1b0741ca3aa6a31f3bdb046
- SHA512 04721e0b77755979c93ce32c8ed8637bb080f3b8f52b81de330b636bc0597c9ce3f742170fb3af7a0be3285e32c7a622ed91413cf3b0f86f27462355fdb89737
- SSDEEP 192:SYRb1kRS15dXcFUADIc1f+W+y4+ogP5p7:SYRb6RSTeC81f/cqp7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5a1271.rbs
- Size 19KB
- SHA256 169987b49dd10c6235b49aa476df39fed760768fa6f125475d2f9d65f0ce95a5
- MD5 0ffb6776ed9c1b810c21035e2623b49e
- SHA1 0c4350f0100ccbe26689865c771221d6983e3558
- SHA512 0179b1850e26ef4d3cfae7e84935babbb754bea0c4a60f84e148eacf5ee1b5d14b3af106934c45c47f42483448f2251267f25605b9e7810f5d78097952d9e41b
- SSDEEP 192:SoQG23o3l3H3V3e3+03X3h3W3n3Y3v3r3ZXGFbFwbgmoCms1SvM4In91SvM4CneV:ST4xXhitn1a3o/DOWjRjv+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5a1278.rbs
- Size 21KB
- SHA256 efc735fdb4193f5926a129d74d06262ec31afd8c7da889fef610833f6d1fca93
- MD5 1c9ac996d183f8d86b96848690239bf3
- SHA1 66a7ce6eb7c449f1df7ae3dd9bfb691ae962546d
- SHA512 6b252edd24e65d61f94ab1721d5b7e9331529ebd5b99dc3e210c605472dc7d416cf1272d35344fdd86aa49c7b7f2a3a7485fd690c97850e57c019424c3958388
- SSDEEP 384:JlRHGRTnAKxNAUhUC7xJjrMNYPzIbSfmck/OOdOLgtjkP:JLmrAKhkmv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5a1287.rbs
- Size 21KB
- SHA256 b0fae9c8a5de2475d8413255acc11da8a71b9e2f85697c172f93cf154c2c8104
- MD5 e10c9dc3016e52aed7655039ebd40c67
- SHA1 9fcc6224c2c654529483ff1c0f48078b8322c710
- SHA512 6075496eda1c1a86c5aa5fc9d50d15568a5527d8a8a5c083a842ead0ff197a1b04663176f32cbd4e66583f4613d7615d9a0c875d0c3a365df0b6c5943f6456f0
- SSDEEP 384:JVc7zuGf62Qp2pLjh4lUe5salckU72eC6Y9DlVOVGSC6o4:JVc7zuGf62Qp2pLd8Uez9h0gSCn4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 191B
- SHA256 0d6e140b5f905e448f28b684ca81ee3980e9f77c72cb136531b2bddbb2cc06d8
- MD5 bfe004c551bf14311c89563359af2977
- SHA1 dc1f93c7c8f8054515e2785bd8b553f81bd780da
- SHA512 736d00e369fe6e4bbf10f404b8a9688b71a60e43c595fc10d5b99cc6df44dbe41fdefc0d97d669064a54e77e7ae4bf3ce6541c19d0fe60cc1d908107f451afe5
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 393B
- SHA256 f9b4cde5ba7d8eddcc57edc65333bd4e406a4f373e023743b7eac3d8f05ae45b
- MD5 85dfb56ebd6d07a90114b9101c5396a9
- SHA1 dd4a82a28c14bcdf236fbdcaf6948de47ccc7c07
- SHA512 46d097ec8997af0ce0a1b93c39a9fdcdbfa00c53e3ba95ab6992d8d18738ee7188cdf1aaee59b1c484cf6022fd8d8cbe3d3a3370ed6c2963560c8277525701f1
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 1KB
- SHA256 7a45f8974fdecc98f868631bcba1157ba732e14af9da88ef348125ce572ca96f
- MD5 f5e008b00ac54f2c0d9287d3b2533173
- SHA1 b48dcd7f24ec603612e67280e408e301887d5140
- SHA512 69b3e6ea1d722702a1f4acda9726ac3e3d74584bd13bc5fffe6703c157d920730340f755a61f3578ecf17648b7f5a9b4ea189884d3cbf1c5b2a4135b9036d72b
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 1KB
- SHA256 204d1f6fb417d041760a1f5296339e225783de9cbd4cac4ef4eb30f1a125d69d
- MD5 07a83d87af021a5721665019c6d95ea2
- SHA1 c8a5fdea3947f159612beb4ad22792da1d3768fc
- SHA512 1ec58229fab7314872a5edefb273524700164c2238ba64a1e1511ed9eeb02aca6164955c963f46e481393eade23e2c62e5a213d65b5a77651218262802c9e50f
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 3KB
- SHA256 e3edd378f5057e2dbe46cde75b694be9cb5f8b7e7da93683d667a6c3e50eba17
- MD5 b621bdfd516eea7dfd48b3be8324f28f
- SHA1 05bde5efd73d7d3bfafe8906bbf013747e759427
- SHA512 4f5379a97f8b68cd310e97c943a70e3ff884da545bc480502f7e6fed6bcf3630de57bcf1de18d067017e1625527b086381839b7a53235fb864f889d52414f837
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 3KB
- SHA256 63215f136bbc6cd642f7ffe228aef7d899f25189f078b4eb07c0a15e83e2c047
- MD5 f07fadc2f3bf04c3359f7c3b87257c3b
- SHA1 a05d9f547e13e06cc298d83cc1e56beeb2b610b6
- SHA512 94acfa3da740233d5038b9d1e338016c3b7a7fd185f19b840bfc7acb4afac9d0372f0ce2d883797baf9659916e7d7d1c04cb02b9da61ee9e6e1e99a0dead8ff8
- MD5 SHA1 SHA512
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 4KB
- SHA256 ba811dae57246bbd22d9831c4c2ee1ffb66ac308206857ed258ef1ff3830b615
- MD5 2cfa8c3f28f5b819699953de077b5cbe
- SHA1 cb4dfb724e261e83bad4f5dc76424ebb0b178003
- SHA512 026abbb96e4ad1e15c144cb393eb435e337fe952bdcee0fedcc63752d24c7526fc8fbce4ed3bf14d6ec408323d9475418cd4fa60a065448824fed9e76f141c04
- SSDEEP 96:oIx4xmAx1xzxxxIxTxmx7Q9iyQuUo4oTRA/4oTuUo4Kwj/m:jWNv1PGxQTQXC/wXv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ae1f95fd0cac26454941f0578d73b695849ce52ab2ef95eccbb63853cf9103ce
- MD5 7d4bdd41d7150644a9fecac756bd5298
- SHA1 cc6bd77ecef146f18a526ab6a1167649b2bf526d
- SHA512 ba873b94e850c6fa0de096961380265ec833778854612e938ace2c4c1772423793d0d22a585533180328478cc23aef6971be56eee2256405636f80076ed2c796
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f626db1-ce9e-4943-b2aa-4ebe8e0a9d11.tmp
- Size 5KB
- SHA256 c3a6e59cba070833764d1967a4821709696a84ac7f38cf881e471a56a20c4e8f
- MD5 a4913da7547cace473818404c3b03fc4
- SHA1 eff06a7f281fec95062fee0617d61725e27659de
- SHA512 1075cf9ef3019270ed7092942a6696fe2572b28a4a2a7094bf6bb90a137cde5e066d45b0613b8c7618a54b1423695b871def954fff31f9d2fb47d8029747e549
- SSDEEP 96:nok3qYgm/IQYmqILFk6gSwSv0MoiVmdHIIz0WQyV+VuiiX3:nok33NXLFkOv0MAI2Ld3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 7fab07e4f77ca19737a4349c0d91fa687b7543d48a84e490e9fcef29b9986c58
- MD5 abe87e136e63d433e76e433f7d78a009
- SHA1 94f73c63a80a71ec84ddbbaadf2e0c6754a688d6
- SHA512 bca5f60cf7545a6d8e122b574b3b521273f7ce8d888acf490e494a720abd0751a1ee3b61283df8ef01509433ccd4367b7d43853d172af1b44c78d7bf8fa9f084
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 2e023f49c80b822fa11e11daefebe13e332ff3d3d8d0247c2637ab63072afbea
- MD5 985009785af9864d9dfb9b00de911a23
- SHA1 338671363def37f8d8a4b46fd56b2bbf97997d5c
- SHA512 c4652bc3de9614db69eb93383a5bcaf1ba34d58adec0052aa9119bc8411ba6a9f3a1d931f108eb7c67948f9a4e862fc7c5575c7576e1412710b3e74777806ac7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 405B
- SHA256 51a76806a9d8d58b73213b737b83f2ff23f739ed23a1828a5f188e215b74ae3a
- MD5 9b721261c790262ba10d2a85a904bc4d
- SHA1 58f0d264899babe6c2998e4f451d2b97b21b9168
- SHA512 b54331c25b461e6503306c3842e0ab819f4213888ee4abd95c69e8e71111399c1b2077cbdf415edfa3c093af58d5a3d43327ac2a81f28ac59d5f0671beefc42d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 f10e1338a8728ca0ae0e03e00f84231023499ab16c12b7121b24cc55d4dc2c62
- MD5 6d1c6dbd2fdb1b7d6c9a22c4ae1e511f
- SHA1 60a248018526850fea93f736e373b79ed1cd1ca7
- SHA512 32686b3d555095dff9d6451a0027520f38f7fb1d735f5fc48e9148f343c2888859dd0b47fed8936537274e6ef2f1ea70c13fc69a98d2e69f4050afaebd4de41f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 14005af0e0457c01a675500ddd78ecabbe8c7f11df09c721267de6c495670d03
- MD5 d17baea7c3ab9cc542203a9d45ac0e47
- SHA1 d71a6e0152cf00e5b5e47025f30b7bd643675fde
- SHA512 e1a550fbcf3cb69c9ee4ba08a1993c4fd605be63ea7a83e3d376104873bd1bbdb817196d894cc135d2ab267ed86fbcfa88a9ebe0f7fc00a452ac0a8d0308e4e9
- SSDEEP 96:nsk3qYgm/IimqILFk6gSwSv0MoiVmdOQu71jIIsJj0WQyV+VpAiX3wI3:nsk33cXLFkOv0Mcu7hIBjLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f683595cbb7675d87fb8dbcbb7dc944726059852d5988073fc869cb87dc068ec
- MD5 44ac0945e880b034399b7de7dc6f9ed4
- SHA1 bc3de9b348dc734e556a5814631ba42e1445b683
- SHA512 598b674f5c0eabf466a1d267f35e22d2f017380664c4499dddeefc9793359584f1cd3a9a105b7e92b803fd9ca17d3560ca48499e25fd0552a34a91f8c983088f
- SSDEEP 96:nsk31Ygm/IamqILFkjgSwS6qo0Moi3R5mdOcwXjsuA1jIIVJW0WQyV+VpAiX3wI3:nsk36aXLFk76qo0M3mwXouAhI0WLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 bebf60a1b66b41bf58f43bed715aae22760cb1fea4d9f0f66dba12db3e43feeb
- MD5 5a01a9244e51cb8005e89cabae65f16b
- SHA1 b07f2ec6f3f0333f8994ac4bb19e61de471d4f56
- SHA512 c3ae3416c0e52f58855abfb859f6a63d4394150e5a9505579c758e21cfae54994fcc5850122beabc6307d21bcd23aadae12727685cff293136708fd6bcfc4081
- SSDEEP 96:nsk3qYgm/IamqILFkjgSwS6qo0Moi3R5mdOcwXjsuA1jIIVJW0WQyV+VpAiX3wI3:nsk33aXLFk76qo0M3mwXouAhI0WLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c8a54cf04c88d0f004ecca95c28941ff8af30ef8e0c8f99a419b4ab3d8a0aab5
- MD5 33a77845df157bac551de2a1d141dd6c
- SHA1 f3aeb548c98d0d75273c531ef29311fef82bfa3b
- SHA512 f6abf240f6df1757a7b6b1d3e98a7f11ea703e99ac598ecef2d5419cf22a5152c15ee113a5d036afaeeb2686806674a38152c45fc2266904b81fed4d3f8d0e47
- SSDEEP 96:nsk31Ygm/IimqILFk6gSwSv0MoiVmdOcwXjNII8JW0WQyV+VpAiX3wI3:nsk36cXLFkOv0MgwXpIdWLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 5d277369c3351144d85e497b43d1224e0bd1a8e71cd591b5daefa5a45252b058
- MD5 fda5125cd6704afec5925c184261e033
- SHA1 e70838e34ff87230761724a34992130bada26841
- SHA512 1eac39a58b6544453b9e326529d9c69c595188b03e84650bf2d2b9bd6b7d31fd211f833621e8d67949f6121a6e30f6ebbddcbab915761257e33d488c381dcc6a
- SSDEEP 96:nsk3WYgm/I4mqILFk6gSwSv0MoiVmdOcwXjNII8JW0WQyV+VpAiX3wI3:nsk3zoXLFkOv0MgwXpIdWLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 a2165e63fccb6d621f4c488cfe255c8e9899a35068eacec377ba9a6e1ac60835
- MD5 5ead9d3e9c3a768e0c0c75f11cda6abc
- SHA1 12ba4f285964db6525611b33f5ce1810da1b08f0
- SHA512 776a3145a1e9016f1fc6ab82fe4854461839d2614b6f33d0fdca4c8dbc13f6301fdc6fcbb725559b3b291081488ac9eab88d0071c2bc04858466d40e175d3fa9
- SSDEEP 96:nsk3qYgm/IimqILFk6gSwSv0MoiVmdOcwXjNII8Jj0WQyV+VpAiX3wI3:nsk33cXLFkOv0MgwXpIdjLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 25KB
- SHA256 3ca68414527ece019ac110954726207b8a46bebe6180c2615158f7aebf6e6b1b
- MD5 00042df6368289238bc60caef1baa46d
- SHA1 981c49ac7b10bd2a9d159daf00844110629837a9
- SHA512 8f549ecc6a1ac0cc153fe39759b8fe093af520dd94e37b8c32e7fc7e87263cc5b2bf404bff31a5960ad9fcf82dabb5a534fa07cc441ce646de2a8b532c28ff51
- SSDEEP 768:nq38h2xWRVQw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RLl/+0EbrUp6h:nq38h2xWRVQwu1jaKRLpHEUpA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 c0547f88683e8e19693701071df0145b5fb130ce6ff06c00d9d8d360cfa8944a
- MD5 d2ae8c06b2c7be49274d34606f96012d
- SHA1 2df601426fe030f8c169eaec17c37c5df94f53ae
- SHA512 1a06e17af5e2f2ce0291cacdd64cfbd74deeab1ba989506eb79452326232a7e3479ec55b73b91ff4cb98169ac351973170ad9d00c87d56a73b008faeba240000
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 9344989c29398cd1685350f72357cb60243a0a319af04ee7421aabaa11f5d497
- MD5 b7a27c86a9d6adf27f9001ff428e4689
- SHA1 af44a7836e7d1b624d23db073f5b8cd546c2b8cc
- SHA512 89fc80e8c584b21077f42a4dae9615c58f13047a26b65eb1137b64d36b421d1f04873a66e0dbed89726253c57d29fc5e7aad6d9b1bdf3ff2c2b0ff0cd5e2f33a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cbeb.TMP
- Size 48B
- SHA256 4555157484b5db3f926f19d3d7370e9b9905e15a59167b4de2d8a72ca8ce8fc3
- MD5 5cdd562fabba14d88731267aa774e4a4
- SHA1 363ed4218ac70b13eeb5c8ed92586cc7481cd9a0
- SHA512 3af4116aa0fc9d281eadf91833f66f77c06275b3f4a97f3fad54327c9bcc50dfc807056a0a263cc771c74747b2218183066977dd99a6a7b4ff3fbc67c43ff4a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 a50e508f12de01f7068bc57c98991140c22cf35da4598201d1cda08319fdf378
- MD5 8a392b6e1dce55466d3dc7a627b9a71e
- SHA1 40238f7ab943f4e94eccdbcc9f1d40c85eeacd5a
- SHA512 0df5e3428ea31c8764dcfcaf63cc789df055c67463f948116be05e138788552cee118257ed4d256af5362393093f3d35798622a5017f97e65025f5e59f0d1e04
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58772f.TMP
- Size 203B
- SHA256 3a6cadcddfa2a69581b68ff8b55bf6ec64f0e4dc015a90a5ba5372664a133c49
- MD5 6f6b1ede860505b1853a32e224851139
- SHA1 9b5a7699b1407e3cef24a80379caaeea071550b6
- SHA512 dc65f2c3179230366b73a3f236881a47c5502178ca52a8c5e3fae891cc4f69c3f71f4253719cc11244528b0649ed048ef109d05c5eadeed2debfd741aa44f29b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 d1373495ffe863a3db41be5fedba8d52cad2b274fa93c8f58ad149644b870cce
- MD5 686d4970c3f5c9c987c6a3faeeca0bbf
- SHA1 216a36a08a9ead9bd16d00b0bb7e5474633f7484
- SHA512 110c2692fc64fcfd506a7fd91379ff77cb1925332fc70fe7053058218e2fb9542ef2c59b6805f69bc34f11eb48b4ca4634d2359b73c253d5ace4652b9ca5cfaf
- SSDEEP 192:3oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG5e2RUBLeoQeE7Eu/PgQyMTvc:P9iIxuERzA83h09RZxASGtkineE7ZPId
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 8993600adbf99974c34df228bc5ae9fefd3a83012788feffc80e38519a6cbf04
- MD5 522189acd34297cfdb31164bb364d553
- SHA1 5e0b60b730cff91bb8fde1047dc9ae491042cb6a
- SHA512 d56fa478bd7d34d69a72e1117c1aae509bd7bc1c5b14c6015407b35ce22f97e60a95903954b0bebcdbdecc08e0bb0d77fe92f9e189e66ae8dd76128006ed5091
- SSDEEP 192:goCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG/e2RUBTSZoQbE7Eu/PgQyMTk:Y9iIxuERzA83h09RZxASGHkTynbE7ZPK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 e90c6ce38addd2e0f9b164cc507920094a3722dc0e4c792234934ba2cc8a2f97
- MD5 2e8418a93604bc712850e5fbd9b57a93
- SHA1 49372e18d8510e9f0477ca0d37e4238c09d7be88
- SHA512 2456652c55d8b36845fff0dab89092d3b8e982eb600b9a3be3c8eb8e4a4931dd75e5897a05bef58dca0ea549e57ec8b235a9bc123a6c9666348244be2ecf36d2
- SSDEEP 192:joCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG5e2RUBLeoQ3E7Eu/PgQyMTvc:D9iIxuERzA83h09RZxASGtkin3E7ZPId
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 bfc356e984d2ac62c8e7efcf350d96d02c30e8bd1bbb8fd0290ffe7851262718
- MD5 2393837e93f06f2140f17f4264d2213b
- SHA1 6a672babbd8963c9fbbfa5f0288bb46982c71385
- SHA512 27dac42ac3d6bc565b91237c70f073b893eb78e4146f03d6b174d6cc159eea72a7a8e7a4667688be1fc7b00bd1a7a268667237bd66f7981d67de75eb4c097c9a
- SSDEEP 192:HoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG/e2RUBJjoIQxE7Eu/PgQyMTk:f9iIxuERzA83h09RZxASGHkWHxE7ZPId
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\SDL2.dll
- Size 2.4MB
- SHA256 2e4e823b46e95a29ad4ce4e7134417b0cd60145fefe606920ef6dc0ebcfb0021
- MD5 0293f98e4ae63f376f293c95f197b9ce
- SHA1 6e6ae66a791001399d7dde625de50799decfbe9c
- SHA512 0f5f7537e414fbf04e54e744bd2c0d587c920e93ac8dcca58a15fbe041e53383b66bd7b2c1cd75f3584cab435e9ddb38354cfd7d4676dcf515642de601f3ed46
- SSDEEP 49152:ll37G6cDL//PXojzXZLQ+poaL3hjRUdVT662Zd5W9CiS:DLG6cv/cXPkTTyVwCiS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\SDL2_image.dll
- Size 122KB
- SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
- MD5 b8d249a5e394b4e6a954c557af1b80e6
- SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
- SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
- SSDEEP 3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\SDL2_mixer.dll
- Size 285KB
- SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
- MD5 201aa86dc9349396b83eed4c15abe764
- SHA1 1a239c479e275aa7be93c5372b2d35e98d8d8cec
- SHA512 bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7
- SSDEEP 3072:uHT3KS12sljkvy5jXabgwdIFwix1Cvmm1xXLLPAgx+3BfZrzJ9qYdt2mTdIssFor:E3Kdy5eb+wix1Cv/7MBJJ95IssFo2p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\SDL2_ttf.dll
- Size 1.5MB
- SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
- MD5 f187dfdccc102436e27704dc572a2c16
- SHA1 be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
- SHA512 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb
- SSDEEP 24576:jS8/9uHym3+c6zXD75JqzkiTPxk6saGjhn7+DNvY1vDe9tnYP05pi8ZpFUcjt:n/9ub3+c6zXDrqzkZ1vjhiDNvY98W2UQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\VCRUNTIME140.dll
- Size 106KB
- SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
- MD5 870fea4e961e2fbd00110d3783e529be
- SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
- SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
- SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
- MD5 bba9680bc310d8d25e97b12463196c92
- SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
- SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
- SSDEEP 768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_asyncio.pyd
- Size 62KB
- SHA256 d667822030ba160cd8770569afec2c029b5247ceaa401d9268fe98bbea9e4c11
- MD5 47de17275c73cfcdce18ace16cd4f355
- SHA1 5d6b9b1d4534eeae0a3b72bfa359bb4818e4c86e
- SHA512 e11637808ddaf14d0abdb88a389e6947b16f272d97642312c99ec38bbcaf43e3594d8f89bc8699d769368704a81bc1f01edffa69ab736665c1c192aeed780c8f
- SSDEEP 1536:n2eoB+WKE4+0Ib1Qxh4XNnEapxIg5ni87SyjPxt:n2eo4pg0IpQxh4XBEapxIg5ndJxt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_bz2.pyd
- Size 81KB
- SHA256 8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14
- MD5 10d42efac304861ad19821b4594fa959
- SHA1 1a65f60bba991bc7e9322af1e19f193dae76d77a
- SHA512 3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae
- SSDEEP 1536:KouLz7p5TcaWlZkKWVa5cP6T8MsAUxZIgtVt7SyKrPxji2:JuLz9tVaDQMslxZIgtVtozxj/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_cffi_backend.cp311-win_amd64.pyd
- Size 177KB
- SHA256 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf
- MD5 210def84bb2c35115a2b2ac25e3ffd8f
- SHA1 0376b275c81c25d4df2be4789c875b31f106bd09
- SHA512 cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f
- SSDEEP 3072:nmHfhrWGYV6sewRdFRId6PBNKcqDn/C1j/UyS7viSTLkKxalPu//ay/i:nmprWX6sPRNPBAn/0/dCiSTLL0P2/ay
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_ctypes.pyd
- Size 120KB
- SHA256 af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
- MD5 df6be515e183a0e4dbe9cdda17836664
- SHA1 a5e8796189631c1aaca6b1c40bc5a23eb20b85db
- SHA512 b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253
- SSDEEP 3072:aBxSn2prY3+52vWqw9RQfLIgRr5kNIgQPUZxhT:acuY3+uWHQfLIIkFT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_decimal.pyd
- Size 245KB
- SHA256 b8409829dc4fde70f38754de55d3090a1cd52c78ffece2a08572a58de3af294d
- MD5 a1ffc2a156e9266932c351a88e5e7fab
- SHA1 ebfc901c28035264fbb5b0f30e68ab3b45410d13
- SHA512 74fecaac362deff5139ea8553142ba7e8a7740b757a06edf16cf4a9320a20e7a1567380bfe2f40a3b7e8508f9715efedf27c6c23d2b2fb3ed7664cb81f6d58d9
- SSDEEP 6144:3Zu25e1itIj95vlqyhw+H8DOdKd2vk6LhKwwI9qWM53pLW1AxzwhtTYW3iQ:Jhe1oIj7vlpN8D0KA3swwJ/wzTYWf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_elementtree.pyd
- Size 123KB
- SHA256 b7ec9604084fa090135032633a38b0564f3f5f37fe1446197d008b78975e0418
- MD5 f12b69df1e983913e7f870eb8e79bc29
- SHA1 4bb016037a7bf638835599c20c075c6a0d75356a
- SHA512 012d337b4c8bbc892ff0eb9ca13d859d16794269be44ced71e8a0ab2a744090b74b8f626b468668572f4f8dfe332f0fce46c18d3b45eea796598be5aebe991f2
- SSDEEP 3072:7hGlNy/CPxvpewUjYk2f2/4YkWQN4kUVr4m54hhJIg1fOMx:e4/CPxvpTFk2fNKQuy04hh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_hashlib.pyd
- Size 62KB
- SHA256 441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2
- MD5 f419ac6e11b4138eea1fe8c86689076a
- SHA1 886cda33fa3a4c232caa0fa048a08380971e8939
- SHA512 6b5aa5f5fbc00fb48f49b441801ee3f3214bd07382444569f089efb02a93ce907f6f4e0df281bda81c80f2d6a247b0adc7c2384a2e484bc7ef43b43c84756d2b
- SSDEEP 1536:aS8njpHxGkYjEbEJkn8cw6TxIg5Iyv7SyKPxk:InjpHxYJ8w6TxIg5IyvMxk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_lzma.pyd
- Size 153KB
- SHA256 33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903
- MD5 3230404a7191c6228a8772d3610e49e5
- SHA1 4e8e36c89b4ff440ddff9a5b084b262c9b2394ec
- SHA512 6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b
- SSDEEP 3072:jlirS97HrdVmEkGCm5heznf49mNo2OOvJ72ZIge1z7axC:jlirG0EkT7AYO2OQSE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_multiprocessing.pyd
- Size 32KB
- SHA256 871937b23a6c7a1e0745697aae7c8e886be3c493c978f88f620c74f411325d73
- MD5 2bdbe61a28c820f65a914d163c1d8cd4
- SHA1 1ae583088a92579865948f09c486faa4d912b6b1
- SHA512 0540de87252ab20f4cb048c50e453e8c07a0d572629b2bd1ba3087bf2633ac4b9c0fb3f4d1db322fda2c3972b6f3e0c214681315e1a45ed7e7046b980699d496
- SSDEEP 768:GmHI6RwgJ5xebOc88hnJ8hIgRtWRYiSyvWTPxWEpt:BIoJ5UbOc88hJ8hIgRtWR7Sy+TPx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_overlapped.pyd
- Size 48KB
- SHA256 6f79a76094f43c55899fe804cdd5d44ba6ff920c651436a7effa30e7c01b96ec
- MD5 f7a6519fd517ad2426b05ef9dccd31f6
- SHA1 32b8df120ca2cfeb8349c1675c0907fd2132c76b
- SHA512 2de7f8302743f36c21a6e3442960976a63396b93201f63579aa507274571fab801e228edc67a83d7729b6473d4b2899f0a9ae1b0a8b4e278d3b802eb896432dd
- SSDEEP 768:TFMCcP4W1vqJiR5RMqlDX+Jupr2FIgstPYiSyvwPxWEpuI:TFMiJifiJuUFIgstP7Sy4PxT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_queue.pyd
- Size 30KB
- SHA256 39bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582
- MD5 045ef55136b1e580582199b3399267a2
- SHA1 de54519c67a996d0a8b4164417058f4610a57376
- SHA512 7b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c
- SSDEEP 768:o+yFs6rXkmk5sNIg7UOYiSyvqdPxWEpnl:o+wNXkP5sNIg7UO7SySdPx7l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_socket.pyd
- Size 76KB
- SHA256 360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c
- MD5 0fc65ec300553d8070e6b44b9b23b8c0
- SHA1 f8db6af578cf417cfcddb2ed798c571c1abd878f
- SHA512 cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8
- SSDEEP 1536:/2JlcAdpEVuji9/s+S+pmGQRivVia3iNIgQw97Sy2Pxe:/27ce+uji9/sT+pmGdvVp3iNIgQw9cxe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\base_library.zip
- Size 832KB
- SHA256 724af064ff55426e6d1e5f5775023bfbbd257c345b1f6cfef6fd39e70edd0c1e
- MD5 14f725f8ec27a170843f8f0b4f5e8917
- SHA1 12371c2151218b86b876db4ef64c75f7e25a4edf
- SHA512 ddb465f86926ca29fc5b79a8fdaec4595bf9b0536b0c49a6b5245b7d30c155009e631cbd9c6f3f792fc1cb1827a67d88056ef36a65fec33c170355dc22ada869
- SSDEEP 12288:mFQR5pATtzXyykfscrsRFFYJfSecGF/u0Ql2yFrbQXfhD5W:mQR5pATt7xm4lUKdcubgAnyfbW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\freetype.dll
- Size 639KB
- SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
- MD5 236f879a5dd26dc7c118d43396444b1c
- SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
- SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
- SSDEEP 12288:9rVLid+Cjymyr99WvoHkeFP+MppfEWmHa:9x4+799HkPlZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
- MD5 6f4b8eb45a965372156086201207c81f
- SHA1 8278f9539463f0a45009287f0516098cb7a15406
- SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
- SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libffi-8.dll
- Size 37KB
- SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
- MD5 d86a9d75380fab7640bb950aeb05e50e
- SHA1 1c61aaf9022cd1f09a959f7b2a65fb1372d187d7
- SHA512 18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
- SSDEEP 768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libjpeg-9.dll
- Size 238KB
- SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
- MD5 c540308d4a8e6289c40753fdd3e1c960
- SHA1 1b84170212ca51970f794c967465ca7e84000d0e
- SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
- SSDEEP 6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libmodplug-1.dll
- Size 259KB
- SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
- MD5 ead020db018b03e63a64ebff14c77909
- SHA1 89bb59ae2b3b8ec56416440642076ae7b977080e
- SHA512 c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5
- SSDEEP 6144:AT91DT7fIooHEx09YvFTAPMH3eqSy9eNdUAK0l:ATPDnIKxWm2MXeqD3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libogg-0.dll
- Size 25KB
- SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
- MD5 307ef797fc1af567101afba8f6ce6a8c
- SHA1 0023f520f874a0c3eb3dc1fe8df73e71bde5f228
- SHA512 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e
- SSDEEP 384:OJJhN0Zr3dtX7q96ZSd/Y7AulE5P1P/X7WCRsS7TP:Ork3dVnSW7AMEp1PPaCqS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libopus-0.dll
- Size 359KB
- SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
- MD5 e1adac219ec78b7b2ac9999d8c2e1c94
- SHA1 6910ec9351bee5c355587e42bbb2d75a65ffc0cf
- SHA512 da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67
- SSDEEP 6144:giqhiJwDR6q7f4jNOSO7lMv1EzSvwz4LhPqu7c6m1OOzzih22:5yDRpf4jXO72IcLNqHtzzi0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libopusfile-0.dll
- Size 45KB
- SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
- MD5 245498839af5a75cd034190fe805d478
- SHA1 d164c38fd9690b8649afaef7c048f4aabb51dba8
- SHA512 4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e
- SSDEEP 768:fjSfWfmLgQ4sKxsyEZtUeM3xZaGYWJajk0qgm/v/40:uufmF2zEZtUdxZaW4q1n/4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libpng16-16.dll
- Size 206KB
- SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
- MD5 3a26cd3f92436747d2285dcef1fae67f
- SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
- SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
- SSDEEP 3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libssl-1_1.dll
- Size 686KB
- SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
- MD5 8769adafca3a6fc6ef26f01fd31afa84
- SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
- SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
- SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libtiff-5.dll
- Size 422KB
- SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
- MD5 7d40a697ca6f21a8f09468b9fce565ad
- SHA1 dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
- SHA512 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a
- SSDEEP 6144:d8x4RKXHtEOtiYFJEn9RX9kgr+6Dr1Xu1ih/QpGJylW:qx4RK3tvKRH3Dt4ih9Ji
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libwebp-7.dll
- Size 437KB
- SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
- MD5 2c5aca898ff88eb2c9028bbeefebbd1e
- SHA1 7a0048674ef614bebe6cc83b1228d670372076c9
- SHA512 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13
- SSDEEP 6144:t2lROjMXfhVy+tEZzshykv2SxgQceWni1UC2JCsJ5zIGWexIaZOovMPVt9ACB/1O:JMtVykiiiCsJdpxIaZOokPVtW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\portmidi.dll
- Size 41KB
- SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
- MD5 df538704b8cd0b40096f009fd5d1b767
- SHA1 d2399fbb69d237d43624e987445694ec7e0b8615
- SHA512 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4
- SSDEEP 384:GZBiKpE2uNn13biY3zlwbRk5pDrXdJx+CxY0IF5ETUhYF3STo0Mte4TxL1e1/s7e:MrbELdnDrtJzghYF494Zp0Vr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\pyexpat.pyd
- Size 193KB
- SHA256 867012edb8a6acd2131c4698b69bb94e6ba07607035e7c621aaa24262817e55b
- MD5 4378685011241d01248dd60fc9cb5436
- SHA1 d754286af98f5ae2ee82883669d509e105413ed1
- SHA512 f9ed5957de5846b97cd8dc8ef8cf876b3192c03afd148541053b31d1237ead67ca287dc95e109b70305a3eb1422d32d6bec1cd7598c79c718469d88ac2e82575
- SSDEEP 3072:69QGIY+LymqoJZTA4ZilSWNK+/7phqUypW6x9VWHeCOjUQZNIgQhOXx:KQGuzTJa1lSWNK+/nK9YHfK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python3.dll
- Size 64KB
- SHA256 ddd2c77222e2c693ef73d142422d6bf37d6a37deead17e70741b0ac5c9fe095b
- MD5 7feb3da304a2fead0bb07d06c6c6a151
- SHA1 ee4122563d9309926ba32be201895d4905d686ce
- SHA512 325568bcf1835dd3f454a74012f5d7c6877496068ad0c2421bf65e0640910ae43b06e920f4d0024277eee1683f0ce27959843526d0070683da0c02f1eac0e7d2
- SSDEEP 768:xw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS7:O/5k8cnzeJ4NIgQ0D7SyVPx5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python311.dll
- Size 1.1MB
- SHA256 1b4cc22528577acbe29c8da9f4ac609cf77309276895aa95a5c7fa45b34f0aff
- MD5 fd9a6d6de4e22e68cb4ec914e6d74841
- SHA1 8f665c3f8a03d89661a6f16287d3aa2e89b7a117
- SHA512 ceb679bd597ead3aad7625b65bbe8fc96c9402d06d41c63d0e946a11f07d713ba18cc3a8e94b2d8037d68698d9192443c1d5c8dc8f9704c51bc27ea20d220cca
- SSDEEP 24576:uXmtDPs3IDCuJkgut9Sk4xuz1+dK29DcrShmQfAyDHqU:uX6qkCuJkgut9Skuup+db9ZmQfnDHqU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\select.pyd
- Size 28KB
- SHA256 813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4
- MD5 116335ebc419dd5224dd9a4f2a765467
- SHA1 482ef3d79bfd6b6b737f8d546cd9f1812bd1663d
- SHA512 41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3
- SSDEEP 384:Ag1ecReJK4HquuI7A70RUZNIg7GXIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AseUeJRHqgbGNIg7GYYiSyvwMfPxWEo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\unicodedata.pyd
- Size 1.1MB
- SHA256 175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9
- MD5 cdb5f373d24adceb4dc4fa1677757f0c
- SHA1 af6b381eed65d244c57129346008ec8532ba336b
- SHA512 429a326648c761bf068ca7735094644f532d631cf9355c9f1a5743a5791837a36cd6aa2efe2265c7541feb06310d0c07b634dd04438d8eddbdf1c4147938a868
- SSDEEP 12288:g32YbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ub:gGYbM00IDJcjEwPgPOG6Xyd461ub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\zlib1.dll
- Size 106KB
- SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
- MD5 5eac41b641e813f2a887c25e7c87a02e
- SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
- SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
- SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36362\PyQt5\Qt5\translations\qt_help_en.qm
- Size 16B
- SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
- MD5 bcebcf42735c6849bdecbb77451021dd
- SHA1 4884fd9af6890647b7af1aefa57f38cca49ad899
- SHA512 f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uovejt53.iyn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjB241.tmp\DonatePage.ini
- Size 904B
- SHA256 e0f775ff3740334da3924a6537b87d8fc1211942e42d4565f9edd26cf50e7b3f
- MD5 a7503cc175535989650d0749c18c8881
- SHA1 1f4d8aed9a2677e9a2f0467c022fc98b732ce81a
- SHA512 3495eee44dd3756b180e50a6f59e3b5fb41707bd243e9f2631e8f23e8f2cc1f668e449a0f905d8876e997c341adbc234ca4a0b7a6f9857d77ee7fd2f689face5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjB241.tmp\InstallOptions.dll
- Size 15KB
- SHA256 b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
- MD5 d095b082b7c5ba4665d40d9c5042af6d
- SHA1 2220277304af105ca6c56219f56f04e894b28d27
- SHA512 61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
- SSDEEP 192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsjB241.tmp\NpcapPage.ini
- Size 2KB
- SHA256 2b7efb04961b5bbed99fc068c1eacadcc475bea455f00a544994c786aca71429
- MD5 8d42361b8a453f611da5c16f79d1b536
- SHA1 3095c1d15fb43cbab45dd7ec354a4edbf12fa0ce
- SHA512 c4a66dc71f34574e9de1dce9a3630d94bcd22e7a7356bbe60799d803b3724ba853dcafaffd540b957dc2ed1317e0224ef58af7b48e38b6c5933fceb3212c3ce4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjB241.tmp\USBPcapPage.ini
- Size 2KB
- SHA256 b4c5e164a7dc968941eab553a3c0f53f3aae8209b8eef74d4be9838b78b51503
- MD5 e99e395d6bfc37663626c4a01c732692
- SHA1 75813eb6682b97de44dafdd6f98afae7e4d3868b
- SHA512 e13cf96693c5d3971fdb5b14ee25e629b7016b045719f59d451789651127323b0a260f6c085f0b746b64d04a06a4d408aafc20eb71635d6064d8584af20973f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjB241.tmp\USBPcapPage.ini
- Size 2KB
- SHA256 30a72a412a7da861a1cb4ecd978b1e982a8a1423e5b4b8728ed893d613bce585
- MD5 8f6d2ecd038783e6df61a180c2897936
- SHA1 037c941159bd4e86fa00491524aeaec6c36e1f21
- SHA512 8d861003d82867daf275c72f0aee87541903fe69a7536ecfa70705944d27f80b65429fa59c6e4fbd7f82a40f2f2d203a240fc3028b2948638c1ad320c755c386
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\InstallOptions.dll
- Size 22KB
- SHA256 61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d
- MD5 170c17ac80215d0a377b42557252ae10
- SHA1 4cbab6cc189d02170dd3ba7c25aa492031679411
- SHA512 0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f
- SSDEEP 384:E0C43tPegZ3eBaRwCPOYY7nNYXCA/YosaWqZmZsHLA+KhHgt:EBTgZ3eBTCmrnNAEQ1hKhHgt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\nsExec.dll
- Size 14KB
- SHA256 274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d
- MD5 f9e61a25016dcb49867477c1e71a704e
- SHA1 c01dc1fa7475e4812d158d6c00533410c597b5d9
- SHA512 b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8
- SSDEEP 192:JDkDr/HA5v6G2IElFernNQZGdHskJw7YUXmZscF8Bd1LOtNBZHld3Mu:aDrvAxnJGernNQZGdHVqZmZsHLOtLhHH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\options.ini
- Size 2KB
- SHA256 2155409d54f70ff56f6313d6e4e053498d2a7cd5728b653d849f1a386c223d4f
- MD5 dc67ff99f761e1d93c7d38e0a1531f1c
- SHA1 1a1ac6ff16f274c9f3e208d2a309aa6c126262a6
- SHA512 75455f6c785f0f81b7fe494c76fad96ba66a13be9a3af59fee9d4a2217b435f6e25fc672c6ba8b46dd503491da888f10e3c912c8df15bc2ea8aeabe5097d9892
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nst24C1.tmp\options.ini
- Size 2KB
- SHA256 32a6cf61c0672e0cc71a4e39df401b90000ef3ae7886b5a41b37b6098a80edaf
- MD5 fbe3f527c111da5f722a0ce2e0618ef3
- SHA1 2ca2f6bbf523b3cfacd156859b87636133932286
- SHA512 abf9d8211773622b0fbfaa02bc1a99e62aa7d8c238b38d4185bd19524994ce5a87ccc22c7c820b0c1b08e676733c4172404281f7696fdfa09af173e62fc7bf09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\Snowx Checker 1.4.exe
- Size 4.1MB
- SHA256 02cc880c15e14ad8588b1e535e95aadda721618427ad42c128380dc5c6117161
- MD5 7ec7af77aaadcefeac4f0b70c62d96d2
- SHA1 f4a1ed38be0bb4bbd46b6c92fad095d9e6dcf899
- SHA512 59dfc9ef6d4a458d12b3d44cf107f2a2dc16b169fcd5e06e638929c713d9a2e6a2d5079be03eeb9999642cac6c29f71ef3cfb419c13bd44245cbf0b48e6a22e0
- SSDEEP 98304:gRHRYIWr+J65zE0WsVggQG2u0za8BZdgBNFFsFiX9RbPA1QoPgj0:ghRYIK+J6XWsVggb028BnWNFFsFWdPA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\Snowx Checker 1.4.exe
- Size 5.4MB
- SHA256 155af382c7a1ebd82b020d69d64633b1712f2877551a9342ddec977bc1dfd3b5
- MD5 780a32f2112165c0cba0471cad556185
- SHA1 2bcbe45cc093277830715bec5831b16fb1a1cb0a
- SHA512 fa824cb522a14d2dc1a425b4d39d05a878bf0d840ed6b262fbd80bea810b867d0d52d3274701f158bc30f846226dad53451c27c659bd176fedaa56b6fec04602
- SSDEEP 98304:gRHRYIWr+J65zE0WsVggQG2u0za8BZdgBNFFsFiX9RbPA1QoPgjnjUVpZAVB774P:ghRYIK+J6XWsVggb028BnWNFFsFWdPAr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\Snowx Checker 1.4.exe
- Size 1.1MB
- SHA256 754d3f39527459180191cec4d9e2365df76557705eac66eb7dd2b33b36476e7e
- MD5 70b4e6db8f593a32d0714cca11c65b88
- SHA1 19e01c9632c0d19e144e99ab99a2e95f0df0360b
- SHA512 5c1aa849b6e87e2963e9f59fb8477322bef3b00893ea987660a8ca5317694339d569b30f2e62d5dafc72f443347ad1d01dfa0b0cd3e65476edd2f49832d68802
- SSDEEP 24576:5u7Zg+HxEC8F635vMJz6EeWdRJjwWrC/5j6yHx+1zrghX:5eRDA63RYdeWdHV+J6eEzrgd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\config\CCS.txt
- Size 300B
- SHA256 25e060a31101d92e53a826ee289fef7bde65f517410f2fcca004387972686a0f
- MD5 a27f5295d36b22f546c3bf24df7ad59b
- SHA1 277ef266a2fb941ac6580bcccfecde234e7be0ff
- SHA512 9c5c14543031004df3901b971c20789bfbdfc8c78614cc1a3d8c12cc5c3301d93d53e5fc955f4d579a423bea6568643428446576f8b687ba12c8b030edacc939
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Snowx Checker 1.4.rar
- Size 11.0MB
- SHA256 338b4352109f386aaf31d9b54417593765c71d8deb803a96f1f95aac7622d360
- MD5 20ebd31436e14827d808a818bc0b34f0
- SHA1 663a4e2dac7aa41bcce4db55b1a01bebf7832f57
- SHA512 cb06ba59b5e6aedfa0593e1e6782237e327a16c301d34d479d4a87ea94b44eb994a7294d87e1748c674a117a930bf93ee7694fdc422c0ec872b551f01e0cea16
- SSDEEP 196608:SUr1ihgpef5d1sbe5xPo0EwO0vF3gt8PW5b3PN+ZKdgBfnGb/3WMvUHe:SUZaL1sq7Po0EwlW+PW5b3PN+ZXBer3r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Snowx Checker 1.4.rar:Zone.Identifier
- Size 26B
- SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
- MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
- SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
- SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Wireshark-4.2.3-x64.exe
- Size 3.8MB
- SHA256 794dbbaf48944c60bd0010ce0a98949687530d57fe403a6878c27258c0769417
- MD5 062574be702da964948b2b94eb03be64
- SHA1 488b7e8a99b31edf7941a99ef60136abcd4974ef
- SHA512 06963fee947587a138437ca731311bd12886523fb1b300a2d4db79943c37c2cb8866389621205fa3a5c016271501c1d4d9c125c1098f13305f12ddd3c6dadc9e
- SSDEEP 98304:v1m2ztynCHdxfEPXRW3uBtm4iA7wC7eeO8rXfdh:vJzeRAEwC6eOqvdh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e5a1272.msi
- Size 188KB
- SHA256 ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93
- MD5 a4075b745d8e506c48581c4a99ec78aa
- SHA1 389e8b1dbeebdff749834b63ae06644c30feac84
- SHA512 0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada
- SSDEEP 3072:pviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdZJe:pvipBaTDo1j//SZh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6860.tmp
- Size 12KB
- SHA256 168e04bc04da8cc8fcd8e796682346efd5dc3a1fe7aeb6292b88b004405a25de
- MD5 de72efb03052c07948619b29a991097f
- SHA1 734b1c18a3f1d6367b274aca6aaa1c7af05c570f
- SHA512 11b16cd1e93b65a64c3ab03f15fdf789ee9b89cd2e04688238ad1584e8cdda49749b5ae772a54836cda05bba45097ca3863ece75a8ab3cb6a662541360040c24
- SSDEEP 192:qOuGVp60gRcJCERNy8XKEwV+zGh8phYC32QTb8o+X01k9z3AyDElw7e:zHFRk8vzGh8ph3mI+R9zZDp7e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6861.tmp
- Size 8KB
- SHA256 41c067a985f2770b9f1f38f0558d3661b333154e09022831de8a5acaf56c5b87
- MD5 16db6977ce750fa6cd3f9f7be93cc087
- SHA1 b899075de2c186ec0fed298af470791025ab8fbc
- SHA512 b0941daba49451644293530a0a567d5621cab8b8e6a3a981da2a3079df21242529d3118fa9d2b956405e15319a0d690a4f37e9a6b8242ebe2b009a2d88ca63e6
- SSDEEP 192:X3ZO71HTe4BMNaiyOpW0O3lv5YMN7YyOpW0O3lU7Gb2L9dpnG5YV0q/4vOOgS:AJTe4BMNTyOXO3lv5YMNsyOXO3lU7E2M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{783dde47-33df-6245-8f11-9b5ab523085b}\SET6862.tmp
- Size 75KB
- SHA256 98abb948f100c7d47c80141a058c869eeca59c357e42c1fedd4cd44140617ca6
- MD5 56fc763587dae7a34a6c39ebfa44a58f
- SHA1 ca5a73a1d59526e73809e13f2dc95a7738c36ad0
- SHA512 7bcd793d8b05b0c60c49a4cea34b7b885a0340f9ebee16f96051238306974bbdeed36d08bf83d88d64ae4fc7f37e8f7f7dbcae335bc5722269f8ea26954d7cfd
- SSDEEP 1536:YGlM1phTkCaQT5yi+6DUsGHY3E007P+1xtsv+zq:Y9bTkZQVnDUfHY3E00UDW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{3C436F2F-AE93-4381-9326-51DE3AC12041}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\{3C436F2F-AE93-4381-9326-51DE3AC12041}\.be\VC_redist.x64.exe
- Size 635KB
- SHA256 9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
- MD5 35e545dac78234e4040a99cbb53000ac
- SHA1 ae674cc167601bd94e12d7ae190156e2c8913dc5
- SHA512 bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3
- SSDEEP 12288:ZnMwHskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNL:dMysZgjS1hqgSC/izkfFjymk4HM5yJL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{41ABF805-660C-4D52-8B34-C610706FC2A4}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- MD5 SHA1 SHA512 SSDEEP