Analysis Overview
SHA256
4428b755338c423f4b0d8e3273b77918208171919fc3cf38b86df7565eb6bfe5
Threat Level: Known bad
The file 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye was found to be: Known bad.
Malicious Activity Summary
Auto-generated rule
Auto-generated rule
Modifies Installed Components in the registry
Deletes itself
Executes dropped EXE
Drops file in Windows directory
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-06 21:41
Signatures
Auto-generated rule
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-06 21:41
Reported
2024-04-06 21:43
Platform
win7-20240221-en
Max time kernel
144s
Max time network
119s
Command Line
Signatures
Auto-generated rule
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Installed Components in the registry
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048} | C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048}\stubpath = "C:\\Windows\\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe" | C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1}\stubpath = "C:\\Windows\\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe" | C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4}\stubpath = "C:\\Windows\\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe" | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5} | C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E} | C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827}\stubpath = "C:\\Windows\\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe" | C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4} | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2} | C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}\stubpath = "C:\\Windows\\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe" | C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}\stubpath = "C:\\Windows\\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe" | C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1} | C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}\stubpath = "C:\\Windows\\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe" | C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A} | C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056} | C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056}\stubpath = "C:\\Windows\\{43936A58-A620-4de2-8776-D2F71A729056}.exe" | C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827} | C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7} | C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED} | C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}\stubpath = "C:\\Windows\\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe" | C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}\stubpath = "C:\\Windows\\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe" | C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E}\stubpath = "C:\\Windows\\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe" | C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe | N/A |
| N/A | N/A | C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe | N/A |
| N/A | N/A | C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe | N/A |
| N/A | N/A | C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe | N/A |
| N/A | N/A | C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe | N/A |
| N/A | N/A | C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe | N/A |
| N/A | N/A | C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe | N/A |
| N/A | N/A | C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe | N/A |
| N/A | N/A | C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe | N/A |
| N/A | N/A | C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe | N/A |
| N/A | N/A | C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe | C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe | N/A |
| File created | C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe | C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe | N/A |
| File created | C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe | C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe | N/A |
| File created | C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe | C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe | N/A |
| File created | C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe | C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe | N/A |
| File created | C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe | C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe | N/A |
| File created | C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe | C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe | N/A |
| File created | C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe | C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe | N/A |
| File created | C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe | C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe | N/A |
| File created | C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe | C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe | N/A |
| File created | C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"
C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{FE376~1.EXE > nul
C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{4FCCD~1.EXE > nul
C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{0A9E8~1.EXE > nul
C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{2972D~1.EXE > nul
C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{43936~1.EXE > nul
C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{43718~1.EXE > nul
C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{29CE7~1.EXE > nul
C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe
C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{8CC7B~1.EXE > nul
C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe
C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{30FFE~1.EXE > nul
C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe
C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{FCF36~1.EXE > nul
Network
Files
C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
| MD5 | 0d4ffd22cf722d08267fe7be755ab611 |
| SHA1 | 2cdce78c0a19631e3b1bdc6b9b30810fe677fcac |
| SHA256 | 1bd669eefdd330dcabaa6d00b9339c391ce67975c1a3910d48d97483e32c6be7 |
| SHA512 | 2a0cb21d5c769487d43ac6b778e215c88ea45d00d2323405f98da934e110743f5086a58facf594e39e8d0fe4722052c8704d79c9258eac58353ab66844bb2015 |
C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
| MD5 | 9b6fb2aa39f4b74d0342cbffc8d925fe |
| SHA1 | 3569d9b6dcb4474dd16dbaea63b6fa6d6e973082 |
| SHA256 | 810019b2ca25e1f4a315502182ec3581dbd7400f099a69f97e793c0efbe25072 |
| SHA512 | 1fb01a90872c9a06d75fae1eab97bdedc40484b39b411a7b91230835e641cda0c90f74dde8de544b255824420b8bcaf8b7532c4f6e2db9c0d1a62a11681a77ab |
C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
| MD5 | 991c39e2ede9ae4d2a60ea652cf04506 |
| SHA1 | af302222f7d1d7f8461cad11e34aeb9fc1c3e6e2 |
| SHA256 | 41b1e09ac96959c7be420c2cd32a7437fa243b67abcc260469860903723e280b |
| SHA512 | 245bca01b8b88e25ba8c04490feffe135c316bd8948db867ecc032e9770e7f76afc5ab3f6c815dc06e9366ebb1d1ac11bbb79f55d9ed9e4f5ee3fdfc5231406c |
C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
| MD5 | bdd73b4422d2d6e085d596164c59d751 |
| SHA1 | 60f93eb59a89ecd33a7d5ca2fd61c149aaedb15f |
| SHA256 | a4eebd156f2e941e2162e23d100c02ed23acfef8ebc33367453853f5894d81e3 |
| SHA512 | 4b2ae8bde0d151f58f1fedb18d1ef891a3832cb72b15b2a260e310c105f6ed0f68e337edf9a8d19201565c71d04b060f18a40b06df88fc480805e7ca9c9be6ea |
C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
| MD5 | f13f8974e550a514d8e0a11538741e3f |
| SHA1 | c4955f91a3e6d338028c502f2c0d0a6706519316 |
| SHA256 | 976a82d56d8cd021248b436e36dfd8d1490268b73e2ba3223315a35a06847091 |
| SHA512 | 2d85158ac7c32bd15478a9a49c9bc492384c2c7b0267b914c7d0fcadddb509810126d5dca7489473fe03a409193cea9778fcbb4c619bc1dae0f9cee32b2c7302 |
C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
| MD5 | 3a471ee6a3714b30805891c8ea0dc458 |
| SHA1 | f3f0ab50f99049a8c6cc1a51c18017cd570eb6f6 |
| SHA256 | dca091b8bc2ae4c2a5bcf306348bbfdb81073ef8da2f082efdb3c071f2d91055 |
| SHA512 | f5b2a2633ec52f0521bc30a5ea6fa0dcd43817926e06fe7748571d0c822133b3322f5bb0521bb6a0141db42fe3c06c365a78f4c46fa3c983ed33dfd42abda080 |
C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
| MD5 | b2d0b3374cd44fe2bcc9b79eedfe6605 |
| SHA1 | 5f06a620d3d2a7edf9036a72723d19e1c44942fc |
| SHA256 | 1b9082e216cbac73b77e76d189c2393b0b5810837d9a27f86a44b88c04849069 |
| SHA512 | beb50df4339ccafc1080152fb6013bb8b2cbeac100449cea5afc3a880e36cb326cf629b1245d69d7082d88ddc8eb4e899c279ffec73bec56b6d7a5c748eb08cf |
C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
| MD5 | 5095cbfa261a0c20d25f94735a0b3ce2 |
| SHA1 | ec52e21704b3088c982ffdfe377c6c4218298aef |
| SHA256 | fa78f6710e3ea4adce82ac21ed17f483466b391fb3bbf233e4ef3c63741e3892 |
| SHA512 | 9d7cacb320cc67de01708063287875a913e25f28293b2a837ff873c3a67a3418bb53dd1733ea66f08ad98221b9cdd977a0ba47ca01735d6a22f3d7c28b8fead9 |
C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe
| MD5 | b84c53f83f74de9dbdc2712c54831525 |
| SHA1 | a9c45f6a2d3bc2fae451b7471c8f125d87f330a4 |
| SHA256 | 0ec07c6a0098c56ae533bf026e8f0841672d0ef1ed5c3418c598f51315719c56 |
| SHA512 | 4495639d68ec1380fbca8cbfdcdc0477f6f8e6d21145ab7300a70927eef0939b8549a1900fdbacd3ed65f881a8cbe6936fd138b7da8c8d43e6903c125fb80f3f |
C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe
| MD5 | 568614f9a0189101cc695146ea085523 |
| SHA1 | 64eeb19b44711d6a87b26c30fc57fabcbaa062b1 |
| SHA256 | 65068179e3212802565666dec0cc193b2edccff1902e2b11a17fd0ce5e8c7b69 |
| SHA512 | 5b5c78cc341ba58e1e5baa91999c8c3e249bec101e6a2387e57f84b1cc99a4452e5d8b959fbb64f2785870b1c9452c84fa4da04f47a2ec75e4eca5a08a677f96 |
C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe
| MD5 | 1ece3c80fdb05c0da196cbc435f25419 |
| SHA1 | a6a39585fcbbd491aa34b49883785c69ce3660d7 |
| SHA256 | a47f22d708917cb0ce0d6379e95b2c35ebfdd93db9f6cda271481f662dad46a1 |
| SHA512 | e67b0aa3c9b238126a3a6fc141f0281bdb28cf3d25b98462b54a5cee697af7aa21e02979c2780fb180bce7dd4f7239e6af9fe873c8bd2bdd6aba3d87e5ad4532 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-06 21:41
Reported
2024-04-06 21:44
Platform
win10v2004-20240226-en
Max time kernel
169s
Max time network
163s
Command Line
Signatures
Auto-generated rule
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Installed Components in the registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}\stubpath = "C:\\Windows\\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe" | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B290045B-5532-43bd-98FA-0A3BB423928F}\stubpath = "C:\\Windows\\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe" | C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}\stubpath = "C:\\Windows\\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe" | C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF3882D-C162-4d6b-9EE9-07EB5F538427} | C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}\stubpath = "C:\\Windows\\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe" | C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51} | C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897} | C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}\stubpath = "C:\\Windows\\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe" | C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6} | C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}\stubpath = "C:\\Windows\\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe" | C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA7A391-3447-4ff6-9012-41295DFB015D} | C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}\stubpath = "C:\\Windows\\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe" | C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78} | C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA7A391-3447-4ff6-9012-41295DFB015D}\stubpath = "C:\\Windows\\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe" | C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C} | C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}\stubpath = "C:\\Windows\\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe" | C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B6F47B7-2361-4aa5-8956-A18046597B13}\stubpath = "C:\\Windows\\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe" | C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7} | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B290045B-5532-43bd-98FA-0A3BB423928F} | C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6} | C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B6F47B7-2361-4aa5-8956-A18046597B13} | C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}\stubpath = "C:\\Windows\\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe" | C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe | N/A |
| N/A | N/A | C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe | N/A |
| N/A | N/A | C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe | N/A |
| N/A | N/A | C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe | N/A |
| N/A | N/A | C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe | N/A |
| N/A | N/A | C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe | N/A |
| N/A | N/A | C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe | N/A |
| N/A | N/A | C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe | N/A |
| N/A | N/A | C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe | N/A |
| N/A | N/A | C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe | N/A |
| N/A | N/A | C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe | C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe | N/A |
| File created | C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe | C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe | N/A |
| File created | C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe | C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe | N/A |
| File created | C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe | C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe | N/A |
| File created | C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe | C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe | N/A |
| File created | C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe | C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe | N/A |
| File created | C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe | C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe | N/A |
| File created | C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe | C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe | N/A |
| File created | C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe | C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe | N/A |
| File created | C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe | C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe | N/A |
| File created | C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe | C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"
C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{FE9EF~1.EXE > nul
C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{B2900~1.EXE > nul
C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{C4FC3~1.EXE > nul
C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{81C6E~1.EXE > nul
C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{5EB9F~1.EXE > nul
C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{3CF38~1.EXE > nul
C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{AAA7A~1.EXE > nul
C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{3BD0F~1.EXE > nul
C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{816FF~1.EXE > nul
C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\{2B6F4~1.EXE > nul
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
Files
C:\Windows\{FE9EFBFD-8CF3-40b9-B243-7EA11CB1C7D7}.exe
| MD5 | 49770e2c1f3f9e88b846d31fda13dd7e |
| SHA1 | 4f165ab1cd861f514eb4351ad9cb38cc50bedaac |
| SHA256 | e0ccb8a3ec8149214d1d5c46fa4a2455b3ca40b5347aa568c55ea36d6af07a4b |
| SHA512 | ce4ed586dbc90249fd0ca63c4fe7abf5b4c17951c9327aecc5ba299b007ae1a177d9e35463a63a378a1d80698fc88cd0bcf627e7b8604d438bd98a3a3a5aee5c |
C:\Windows\{B290045B-5532-43bd-98FA-0A3BB423928F}.exe
| MD5 | e010487ac22595ac10b9487eb4153f9c |
| SHA1 | 4fcd5f6be77cce6f42ce37dd58f9dd5f3179ff2e |
| SHA256 | d0149d9aeaca624841d732eb6ee40b2e033ffb1ac0a5d5302a917adcd6a48535 |
| SHA512 | 9cbebcd801cada5fd97a2cd29d25a1c448fd64360e094a977402e86e6f0fef6e81f90e929ffb571739ffb735d1c9cca484928d605a0e869c3f677377e46f43a0 |
C:\Windows\{C4FC3941-895D-4be2-84B6-DB75E1DC8DC6}.exe
| MD5 | 317b45dd22b9cf6f71f4921bc86ccf0f |
| SHA1 | d2c411ba3c3ad236f152adde3a9073e2b32e6e79 |
| SHA256 | 48b904043bcbb79a7e8c0486c5f5cf090c1177bf60a169abc651ef8712f95c2b |
| SHA512 | 3b544d219a9c6366245a5e27055d4221308994806f278c1a75d470c14d665464a2c506dbe4115c5de916ac7e6ff0118b7ea5fd069e33b5e9356041987f91c530 |
C:\Windows\{81C6E9F4-005A-4192-88FD-CA506FE4B2B6}.exe
| MD5 | aef776603f0dd0a09b80414f7df2252d |
| SHA1 | 9b80f2475fdee3a3b367b945f01aec659bb5af66 |
| SHA256 | ef2deede31c0aa96b8783361f4b9f1c75bb0e9dc8e4e43ef5a116547427e04b5 |
| SHA512 | 864e5424f5ef724cd7241018d2fd8511c4254edcc4ccc25ed7c29d95db81f4799bc96835f6aba157e6e00c0f586e4fe2e5ff8cea592b6d02bf1d2e717bfc6f8e |
C:\Windows\{5EB9FE7B-DF6C-48fd-BBC9-5B6EB8C68B78}.exe
| MD5 | 0a2f616a3cb2851665c93247b25e3fb8 |
| SHA1 | 0f78c94ba3c86c39b66f520a8653e1ea934a71a6 |
| SHA256 | 471effea6aa8be6445590d5ba28aa326d2e6b90eac08e0d1e4bd1e9856817ec7 |
| SHA512 | b0a6799084b29bd2fe9e0771b43e169c3fd16a0a677772f5f9506a2986ea5be87e8441f96ebdf0941a296d310104e4028ea8fbfa7ca4e46f271d7983ff2e9b5a |
C:\Windows\{3CF3882D-C162-4d6b-9EE9-07EB5F538427}.exe
| MD5 | 51b9e0edd23e855abe00127f213902c2 |
| SHA1 | 908ffe1ab99c0b2b68d5a49a1a504eefe4591b27 |
| SHA256 | 88509b9fcac24bd64e34c03ad7cc07ca96cf8f98204b4554c40268564dfa706c |
| SHA512 | 83991a48260008315c622c83c177015587233e4f88e1c9db8054ff3d2e4562d3326606d1893f6997082b54fa59fc8c885b301c19307c224b4fcbce3eb6284f00 |
C:\Windows\{AAA7A391-3447-4ff6-9012-41295DFB015D}.exe
| MD5 | 718dc2cf5a98528a5415bcbff57d7329 |
| SHA1 | f56c1f84eb3bfe3f73d68138010e534f507b0742 |
| SHA256 | b048cfa954f123550f0dbdd757649950755024239d84bf09ca6965997d17a4d6 |
| SHA512 | 270da870ce22a28e1e60bca66b8afa30bb7d6d4d1f27b8f37d130a522379cc3ed6095d951621f32461c92d4c21f34833fd91ef5d57de9d217d3d1894856fc6ac |
C:\Windows\{3BD0FDE5-F562-499d-88A6-1D5175C70E3C}.exe
| MD5 | 04497063577ac5a95296566c7ad41fa1 |
| SHA1 | 14c4d6465c6040e665c8b66d746e8506a88b7a16 |
| SHA256 | 31430a180b9adebf350f22120b41a9c78c8abbc69571392d5a45793dce2448f3 |
| SHA512 | a7a7f77bd7ee2ff00d027532d7ebade3453795d7628806844f52a7f9d3952323cf7c0fea8fc7fc2ec0e693a3603b32cacdbff500baf13bf8fe89c0de37f26265 |
C:\Windows\{816FFF5D-2CCF-4c92-BD44-AC5AC5EE0A51}.exe
| MD5 | e7226646e3a60ed64eaf74a723fc91b5 |
| SHA1 | ad4b18607ec0157cb63d5f8fb591088fc98d53ab |
| SHA256 | 92de6be66c6f7f9e363843331a2361f2af403fc5ac377961f7a688ea50b11f24 |
| SHA512 | bea75621fd739becce980d13631e21a946640c3c4a6dc58a3626d492eab4b7a911a8950b35b9115f6aaaf99003ba73f5255357c5e6d9f3f620289dbb62ff770a |
C:\Windows\{2B6F47B7-2361-4aa5-8956-A18046597B13}.exe
| MD5 | cd733128c0e308b72d72222c94b7df49 |
| SHA1 | d63211e6561d74a474fa5d83afdbfa1047d40279 |
| SHA256 | b49a1daa939d5ee5adb9e8c1d710b3b221dce4f8d9149c46d7ec9ff577655cb2 |
| SHA512 | d7a17f5cc3f2c05f3fde58aa4c6b500f8ab90b7ae026d7c409bc49150c065d601b4cd85e95b311f4cfbb8ea89edabfe7a480fd91decd60a1ff6169f27e9bf254 |
C:\Windows\{2C5EB3D0-1A95-4f19-A3B7-DCDE96F24897}.exe
| MD5 | 029dc6161c26613d96a7a4b4b3b4dffc |
| SHA1 | f6cfa08b40be15beb674318157fadb8bc7930a5e |
| SHA256 | 48e94e75da5d03856746a6c20c33d54110952455be23db508cab33b47d3ee8bf |
| SHA512 | 3408a17161380faf3929d0fc38a813a4eb587ea75dff543437ade8118a13360ac1cd07e35936ef50deb063b86aa6a31c42734d6936a239752f8063e7bff79a3d |