Malware Analysis Report

2025-03-14 22:51

Sample ID 240406-1jrh2abg4z
Target 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye
SHA256 4428b755338c423f4b0d8e3273b77918208171919fc3cf38b86df7565eb6bfe5
Tags
persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4428b755338c423f4b0d8e3273b77918208171919fc3cf38b86df7565eb6bfe5

Threat Level: Known bad

The file 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye was found to be: Known bad.

Malicious Activity Summary

persistence

Auto-generated rule

Auto-generated rule

Modifies Installed Components in the registry

Deletes itself

Executes dropped EXE

Drops file in Windows directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 21:41

Signatures

Auto-generated rule

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 21:41

Reported

2024-04-06 21:43

Platform

win7-20240221-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"

Signatures

Auto-generated rule

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048} C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048}\stubpath = "C:\\Windows\\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe" C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1}\stubpath = "C:\\Windows\\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe" C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4}\stubpath = "C:\\Windows\\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe" C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5} C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E} C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827}\stubpath = "C:\\Windows\\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe" C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4} C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2} C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}\stubpath = "C:\\Windows\\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe" C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}\stubpath = "C:\\Windows\\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe" C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1} C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}\stubpath = "C:\\Windows\\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe" C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A} C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056} C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056}\stubpath = "C:\\Windows\\{43936A58-A620-4de2-8776-D2F71A729056}.exe" C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827} C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7} C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED} C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}\stubpath = "C:\\Windows\\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe" C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}\stubpath = "C:\\Windows\\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe" C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E}\stubpath = "C:\\Windows\\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe" C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe N/A
File created C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe N/A
File created C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe N/A
File created C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe N/A
File created C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe N/A
File created C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe N/A
File created C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe N/A
File created C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe N/A
File created C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe N/A
File created C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe N/A
File created C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
PID 2320 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
PID 2320 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
PID 2320 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
PID 2320 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2600 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
PID 1956 wrote to memory of 2600 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
PID 1956 wrote to memory of 2600 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
PID 1956 wrote to memory of 2600 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
PID 1956 wrote to memory of 2696 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2696 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2696 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2696 N/A C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2684 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
PID 2600 wrote to memory of 2684 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
PID 2600 wrote to memory of 2684 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
PID 2600 wrote to memory of 2684 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
PID 2600 wrote to memory of 2800 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2800 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2800 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2800 N/A C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2472 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
PID 2684 wrote to memory of 2472 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
PID 2684 wrote to memory of 2472 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
PID 2684 wrote to memory of 2472 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
PID 2684 wrote to memory of 3008 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3008 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3008 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3008 N/A C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2712 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
PID 2472 wrote to memory of 2712 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
PID 2472 wrote to memory of 2712 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
PID 2472 wrote to memory of 2712 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
PID 2472 wrote to memory of 2744 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2744 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2744 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2744 N/A C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
PID 2712 wrote to memory of 2620 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2620 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2620 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2620 N/A C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1548 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
PID 2884 wrote to memory of 1548 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
PID 2884 wrote to memory of 1548 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
PID 2884 wrote to memory of 1548 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
PID 2884 wrote to memory of 1648 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1648 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1648 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1648 N/A C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe C:\Windows\SysWOW64\cmd.exe
PID 1548 wrote to memory of 2436 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
PID 1548 wrote to memory of 2436 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
PID 1548 wrote to memory of 2436 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
PID 1548 wrote to memory of 2436 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
PID 1548 wrote to memory of 2656 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\SysWOW64\cmd.exe
PID 1548 wrote to memory of 2656 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\SysWOW64\cmd.exe
PID 1548 wrote to memory of 2656 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\SysWOW64\cmd.exe
PID 1548 wrote to memory of 2656 N/A C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"

C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe

C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul

C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe

C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{FE376~1.EXE > nul

C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe

C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{4FCCD~1.EXE > nul

C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe

C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{0A9E8~1.EXE > nul

C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe

C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{2972D~1.EXE > nul

C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe

C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{43936~1.EXE > nul

C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe

C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{43718~1.EXE > nul

C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe

C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{29CE7~1.EXE > nul

C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe

C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{8CC7B~1.EXE > nul

C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe

C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{30FFE~1.EXE > nul

C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe

C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{FCF36~1.EXE > nul

Network

N/A

Files

C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe

MD5 0d4ffd22cf722d08267fe7be755ab611
SHA1 2cdce78c0a19631e3b1bdc6b9b30810fe677fcac
SHA256 1bd669eefdd330dcabaa6d00b9339c391ce67975c1a3910d48d97483e32c6be7
SHA512 2a0cb21d5c769487d43ac6b778e215c88ea45d00d2323405f98da934e110743f5086a58facf594e39e8d0fe4722052c8704d79c9258eac58353ab66844bb2015

C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe

MD5 9b6fb2aa39f4b74d0342cbffc8d925fe
SHA1 3569d9b6dcb4474dd16dbaea63b6fa6d6e973082
SHA256 810019b2ca25e1f4a315502182ec3581dbd7400f099a69f97e793c0efbe25072
SHA512 1fb01a90872c9a06d75fae1eab97bdedc40484b39b411a7b91230835e641cda0c90f74dde8de544b255824420b8bcaf8b7532c4f6e2db9c0d1a62a11681a77ab

C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe

MD5 991c39e2ede9ae4d2a60ea652cf04506
SHA1 af302222f7d1d7f8461cad11e34aeb9fc1c3e6e2
SHA256 41b1e09ac96959c7be420c2cd32a7437fa243b67abcc260469860903723e280b
SHA512 245bca01b8b88e25ba8c04490feffe135c316bd8948db867ecc032e9770e7f76afc5ab3f6c815dc06e9366ebb1d1ac11bbb79f55d9ed9e4f5ee3fdfc5231406c

C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe

MD5 bdd73b4422d2d6e085d596164c59d751
SHA1 60f93eb59a89ecd33a7d5ca2fd61c149aaedb15f
SHA256 a4eebd156f2e941e2162e23d100c02ed23acfef8ebc33367453853f5894d81e3
SHA512 4b2ae8bde0d151f58f1fedb18d1ef891a3832cb72b15b2a260e310c105f6ed0f68e337edf9a8d19201565c71d04b060f18a40b06df88fc480805e7ca9c9be6ea

C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe

MD5 f13f8974e550a514d8e0a11538741e3f
SHA1 c4955f91a3e6d338028c502f2c0d0a6706519316
SHA256 976a82d56d8cd021248b436e36dfd8d1490268b73e2ba3223315a35a06847091
SHA512 2d85158ac7c32bd15478a9a49c9bc492384c2c7b0267b914c7d0fcadddb509810126d5dca7489473fe03a409193cea9778fcbb4c619bc1dae0f9cee32b2c7302

C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe

MD5 3a471ee6a3714b30805891c8ea0dc458
SHA1 f3f0ab50f99049a8c6cc1a51c18017cd570eb6f6
SHA256 dca091b8bc2ae4c2a5bcf306348bbfdb81073ef8da2f082efdb3c071f2d91055
SHA512 f5b2a2633ec52f0521bc30a5ea6fa0dcd43817926e06fe7748571d0c822133b3322f5bb0521bb6a0141db42fe3c06c365a78f4c46fa3c983ed33dfd42abda080

C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe

MD5 b2d0b3374cd44fe2bcc9b79eedfe6605
SHA1 5f06a620d3d2a7edf9036a72723d19e1c44942fc
SHA256 1b9082e216cbac73b77e76d189c2393b0b5810837d9a27f86a44b88c04849069
SHA512 beb50df4339ccafc1080152fb6013bb8b2cbeac100449cea5afc3a880e36cb326cf629b1245d69d7082d88ddc8eb4e899c279ffec73bec56b6d7a5c748eb08cf

C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe

MD5 5095cbfa261a0c20d25f94735a0b3ce2
SHA1 ec52e21704b3088c982ffdfe377c6c4218298aef
SHA256 fa78f6710e3ea4adce82ac21ed17f483466b391fb3bbf233e4ef3c63741e3892
SHA512 9d7cacb320cc67de01708063287875a913e25f28293b2a837ff873c3a67a3418bb53dd1733ea66f08ad98221b9cdd977a0ba47ca01735d6a22f3d7c28b8fead9

C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe

MD5 b84c53f83f74de9dbdc2712c54831525
SHA1 a9c45f6a2d3bc2fae451b7471c8f125d87f330a4
SHA256 0ec07c6a0098c56ae533bf026e8f0841672d0ef1ed5c3418c598f51315719c56
SHA512 4495639d68ec1380fbca8cbfdcdc0477f6f8e6d21145ab7300a70927eef0939b8549a1900fdbacd3ed65f881a8cbe6936fd138b7da8c8d43e6903c125fb80f3f

C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe

MD5 568614f9a0189101cc695146ea085523
SHA1 64eeb19b44711d6a87b26c30fc57fabcbaa062b1
SHA256 65068179e3212802565666dec0cc193b2edccff1902e2b11a17fd0ce5e8c7b69
SHA512 5b5c78cc341ba58e1e5baa91999c8c3e249bec101e6a2387e57f84b1cc99a4452e5d8b959fbb64f2785870b1c9452c84fa4da04f47a2ec75e4eca5a08a677f96

C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe

MD5 1ece3c80fdb05c0da196cbc435f25419
SHA1 a6a39585fcbbd491aa34b49883785c69ce3660d7
SHA256 a47f22d708917cb0ce0d6379e95b2c35ebfdd93db9f6cda271481f662dad46a1
SHA512 e67b0aa3c9b238126a3a6fc141f0281bdb28cf3d25b98462b54a5cee697af7aa21e02979c2780fb180bce7dd4f7239e6af9fe873c8bd2bdd6aba3d87e5ad4532

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 21:41

Reported

2024-04-06 21:44

Platform

win10v2004-20240226-en

Max time kernel

169s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"

Signatures

Auto-generated rule

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}\stubpath = "C:\\Windows\\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe" C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B290045B-5532-43bd-98FA-0A3BB423928F}\stubpath = "C:\\Windows\\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe" C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}\stubpath = "C:\\Windows\\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe" C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF3882D-C162-4d6b-9EE9-07EB5F538427} C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}\stubpath = "C:\\Windows\\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe" C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51} C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897} C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}\stubpath = "C:\\Windows\\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe" C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6} C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}\stubpath = "C:\\Windows\\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe" C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA7A391-3447-4ff6-9012-41295DFB015D} C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}\stubpath = "C:\\Windows\\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe" C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78} C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA7A391-3447-4ff6-9012-41295DFB015D}\stubpath = "C:\\Windows\\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe" C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C} C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}\stubpath = "C:\\Windows\\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe" C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B6F47B7-2361-4aa5-8956-A18046597B13}\stubpath = "C:\\Windows\\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe" C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7} C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B290045B-5532-43bd-98FA-0A3BB423928F} C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6} C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B6F47B7-2361-4aa5-8956-A18046597B13} C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}\stubpath = "C:\\Windows\\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe" C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
File created C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe N/A
File created C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe N/A
File created C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe N/A
File created C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe N/A
File created C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe N/A
File created C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe N/A
File created C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe N/A
File created C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe N/A
File created C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe N/A
File created C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
PID 1888 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
PID 1888 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
PID 1888 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 1888 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 1888 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 4276 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
PID 2524 wrote to memory of 4276 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
PID 2524 wrote to memory of 4276 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
PID 2524 wrote to memory of 3384 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 3384 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 3384 N/A C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe C:\Windows\SysWOW64\cmd.exe
PID 4276 wrote to memory of 3784 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
PID 4276 wrote to memory of 3784 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
PID 4276 wrote to memory of 3784 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
PID 4276 wrote to memory of 3280 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\SysWOW64\cmd.exe
PID 4276 wrote to memory of 3280 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\SysWOW64\cmd.exe
PID 4276 wrote to memory of 3280 N/A C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 3124 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
PID 3784 wrote to memory of 3124 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
PID 3784 wrote to memory of 3124 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
PID 3784 wrote to memory of 540 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 540 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 540 N/A C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3124 wrote to memory of 3540 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
PID 3124 wrote to memory of 3540 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
PID 3124 wrote to memory of 3540 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
PID 3124 wrote to memory of 4560 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3124 wrote to memory of 4560 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3124 wrote to memory of 4560 N/A C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 4456 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
PID 3540 wrote to memory of 4456 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
PID 3540 wrote to memory of 4456 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
PID 3540 wrote to memory of 3660 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3660 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3660 N/A C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 4408 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
PID 4456 wrote to memory of 4408 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
PID 4456 wrote to memory of 4408 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
PID 4456 wrote to memory of 1312 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 1312 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 1312 N/A C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 2660 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
PID 4408 wrote to memory of 2660 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
PID 4408 wrote to memory of 2660 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
PID 4408 wrote to memory of 5084 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 5084 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 5084 N/A C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 3684 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
PID 2660 wrote to memory of 3684 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
PID 2660 wrote to memory of 3684 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
PID 2660 wrote to memory of 4284 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 4284 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 4284 N/A C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 2800 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
PID 3684 wrote to memory of 2800 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
PID 3684 wrote to memory of 2800 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
PID 3684 wrote to memory of 708 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 708 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 708 N/A C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 4632 N/A C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
PID 2800 wrote to memory of 4632 N/A C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
PID 2800 wrote to memory of 4632 N/A C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
PID 2800 wrote to memory of 4688 N/A C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"

C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe

C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul

C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe

C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{FE9EF~1.EXE > nul

C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe

C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{B2900~1.EXE > nul

C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe

C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{C4FC3~1.EXE > nul

C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe

C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{81C6E~1.EXE > nul

C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe

C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{5EB9F~1.EXE > nul

C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe

C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{3CF38~1.EXE > nul

C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe

C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{AAA7A~1.EXE > nul

C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe

C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{3BD0F~1.EXE > nul

C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe

C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{816FF~1.EXE > nul

C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe

C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Windows\{2B6F4~1.EXE > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe

MD5 49770e2c1f3f9e88b846d31fda13dd7e
SHA1 4f165ab1cd861f514eb4351ad9cb38cc50bedaac
SHA256 e0ccb8a3ec8149214d1d5c46fa4a2455b3ca40b5347aa568c55ea36d6af07a4b
SHA512 ce4ed586dbc90249fd0ca63c4fe7abf5b4c17951c9327aecc5ba299b007ae1a177d9e35463a63a378a1d80698fc88cd0bcf627e7b8604d438bd98a3a3a5aee5c

C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe

MD5 e010487ac22595ac10b9487eb4153f9c
SHA1 4fcd5f6be77cce6f42ce37dd58f9dd5f3179ff2e
SHA256 d0149d9aeaca624841d732eb6ee40b2e033ffb1ac0a5d5302a917adcd6a48535
SHA512 9cbebcd801cada5fd97a2cd29d25a1c448fd64360e094a977402e86e6f0fef6e81f90e929ffb571739ffb735d1c9cca484928d605a0e869c3f677377e46f43a0

C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe

MD5 317b45dd22b9cf6f71f4921bc86ccf0f
SHA1 d2c411ba3c3ad236f152adde3a9073e2b32e6e79
SHA256 48b904043bcbb79a7e8c0486c5f5cf090c1177bf60a169abc651ef8712f95c2b
SHA512 3b544d219a9c6366245a5e27055d4221308994806f278c1a75d470c14d665464a2c506dbe4115c5de916ac7e6ff0118b7ea5fd069e33b5e9356041987f91c530

C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe

MD5 aef776603f0dd0a09b80414f7df2252d
SHA1 9b80f2475fdee3a3b367b945f01aec659bb5af66
SHA256 ef2deede31c0aa96b8783361f4b9f1c75bb0e9dc8e4e43ef5a116547427e04b5
SHA512 864e5424f5ef724cd7241018d2fd8511c4254edcc4ccc25ed7c29d95db81f4799bc96835f6aba157e6e00c0f586e4fe2e5ff8cea592b6d02bf1d2e717bfc6f8e

C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe

MD5 0a2f616a3cb2851665c93247b25e3fb8
SHA1 0f78c94ba3c86c39b66f520a8653e1ea934a71a6
SHA256 471effea6aa8be6445590d5ba28aa326d2e6b90eac08e0d1e4bd1e9856817ec7
SHA512 b0a6799084b29bd2fe9e0771b43e169c3fd16a0a677772f5f9506a2986ea5be87e8441f96ebdf0941a296d310104e4028ea8fbfa7ca4e46f271d7983ff2e9b5a

C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe

MD5 51b9e0edd23e855abe00127f213902c2
SHA1 908ffe1ab99c0b2b68d5a49a1a504eefe4591b27
SHA256 88509b9fcac24bd64e34c03ad7cc07ca96cf8f98204b4554c40268564dfa706c
SHA512 83991a48260008315c622c83c177015587233e4f88e1c9db8054ff3d2e4562d3326606d1893f6997082b54fa59fc8c885b301c19307c224b4fcbce3eb6284f00

C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe

MD5 718dc2cf5a98528a5415bcbff57d7329
SHA1 f56c1f84eb3bfe3f73d68138010e534f507b0742
SHA256 b048cfa954f123550f0dbdd757649950755024239d84bf09ca6965997d17a4d6
SHA512 270da870ce22a28e1e60bca66b8afa30bb7d6d4d1f27b8f37d130a522379cc3ed6095d951621f32461c92d4c21f34833fd91ef5d57de9d217d3d1894856fc6ac

C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe

MD5 04497063577ac5a95296566c7ad41fa1
SHA1 14c4d6465c6040e665c8b66d746e8506a88b7a16
SHA256 31430a180b9adebf350f22120b41a9c78c8abbc69571392d5a45793dce2448f3
SHA512 a7a7f77bd7ee2ff00d027532d7ebade3453795d7628806844f52a7f9d3952323cf7c0fea8fc7fc2ec0e693a3603b32cacdbff500baf13bf8fe89c0de37f26265

C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe

MD5 e7226646e3a60ed64eaf74a723fc91b5
SHA1 ad4b18607ec0157cb63d5f8fb591088fc98d53ab
SHA256 92de6be66c6f7f9e363843331a2361f2af403fc5ac377961f7a688ea50b11f24
SHA512 bea75621fd739becce980d13631e21a946640c3c4a6dc58a3626d492eab4b7a911a8950b35b9115f6aaaf99003ba73f5255357c5e6d9f3f620289dbb62ff770a

C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe

MD5 cd733128c0e308b72d72222c94b7df49
SHA1 d63211e6561d74a474fa5d83afdbfa1047d40279
SHA256 b49a1daa939d5ee5adb9e8c1d710b3b221dce4f8d9149c46d7ec9ff577655cb2
SHA512 d7a17f5cc3f2c05f3fde58aa4c6b500f8ab90b7ae026d7c409bc49150c065d601b4cd85e95b311f4cfbb8ea89edabfe7a480fd91decd60a1ff6169f27e9bf254

C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe

MD5 029dc6161c26613d96a7a4b4b3b4dffc
SHA1 f6cfa08b40be15beb674318157fadb8bc7930a5e
SHA256 48e94e75da5d03856746a6c20c33d54110952455be23db508cab33b47d3ee8bf
SHA512 3408a17161380faf3929d0fc38a813a4eb587ea75dff543437ade8118a13360ac1cd07e35936ef50deb063b86aa6a31c42734d6936a239752f8063e7bff79a3d