Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 01:07
Behavioral task
behavioral1
Sample
29526f77e20b03dbe64c7af03aca394b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29526f77e20b03dbe64c7af03aca394b.exe
Resource
win10v2004-20240426-en
General
-
Target
29526f77e20b03dbe64c7af03aca394b.exe
-
Size
96KB
-
MD5
29526f77e20b03dbe64c7af03aca394b
-
SHA1
861def2a6797ac09a444f04f84ed24a3bdda29af
-
SHA256
7bac783906e85440e958c7829b5829f9e8eed33fdc4253d497db45f8c93a5e24
-
SHA512
16960298e2924988bfcb4c8b45e6946f10c4c100fedc18a380d1d6556245041f3ef627f07a956625b85a1f74169ee6717b94acda6d4234e5b9ef74a6d97293de
-
SSDEEP
1536:JxqjQ+P04wsmJCPLuVDZcPpS2XZNeRBl5PT/rx1mzwRMSTdLpJcM:sr85CPLa9/8QRrmzwR5JJ
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Detect Neshta payload 52 IoCs
resource yara_rule behavioral2/files/0x0006000000020256-13.dat family_neshta behavioral2/memory/2928-2024-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2928-5629-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000400000002037b-6945.dat family_neshta behavioral2/files/0x0004000000020380-7019.dat family_neshta behavioral2/files/0x00010000000202df-7005.dat family_neshta behavioral2/files/0x0004000000020341-7053.dat family_neshta behavioral2/files/0x00010000000202c7-7051.dat family_neshta behavioral2/files/0x000400000002036e-7002.dat family_neshta behavioral2/files/0x00010000000202cc-6991.dat family_neshta behavioral2/files/0x000100000002025d-6983.dat family_neshta behavioral2/files/0x000600000002024a-6970.dat family_neshta behavioral2/files/0x0006000000020265-7074.dat family_neshta behavioral2/files/0x0002000000020345-9450.dat family_neshta behavioral2/files/0x000800000002026f-9448.dat family_neshta behavioral2/files/0x0003000000021566-9496.dat family_neshta behavioral2/files/0x000100000002260f-9524.dat family_neshta behavioral2/files/0x0001000000022fcc-9552.dat family_neshta behavioral2/files/0x0002000000021512-9533.dat family_neshta behavioral2/files/0x0001000000022f8a-9550.dat family_neshta behavioral2/files/0x0001000000022f8d-9548.dat family_neshta behavioral2/files/0x0001000000022f8c-9542.dat family_neshta behavioral2/files/0x0001000000022f8b-9540.dat family_neshta behavioral2/files/0x00010000000167d1-9639.dat family_neshta behavioral2/files/0x00010000000167b8-9626.dat family_neshta behavioral2/files/0x00010000000167cd-9767.dat family_neshta behavioral2/files/0x000100000001680a-9623.dat family_neshta behavioral2/files/0x0001000000022fc9-9615.dat family_neshta behavioral2/files/0x0007000000021514-9535.dat family_neshta behavioral2/files/0x0001000000022fcb-9546.dat family_neshta behavioral2/files/0x0002000000021519-9537.dat family_neshta behavioral2/files/0x00010000000167cb-9784.dat family_neshta behavioral2/files/0x00010000000167f1-9775.dat family_neshta behavioral2/files/0x0003000000021564-9494.dat family_neshta behavioral2/files/0x000400000002151a-9492.dat family_neshta behavioral2/files/0x000600000002026d-9403.dat family_neshta behavioral2/files/0x000100000001e7a5-10000.dat family_neshta behavioral2/files/0x000100000001e74e-9996.dat family_neshta behavioral2/files/0x000100000001e744-9995.dat family_neshta behavioral2/files/0x000100000001e742-9992.dat family_neshta behavioral2/files/0x000100000001e740-9990.dat family_neshta behavioral2/files/0x000100000001e745-9989.dat family_neshta behavioral2/files/0x000100000001e743-9999.dat family_neshta behavioral2/files/0x000100000001691f-10098.dat family_neshta behavioral2/files/0x0001000000022efb-10108.dat family_neshta behavioral2/files/0x0001000000022ef7-10106.dat family_neshta behavioral2/files/0x0002000000021603-10248.dat family_neshta behavioral2/files/0x0002000000000729-10200.dat family_neshta behavioral2/memory/2928-10437-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000800000001e5c9-10498.dat family_neshta behavioral2/files/0x000500000001e8e2-10504.dat family_neshta behavioral2/memory/2928-12708-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 3480 bcdedit.exe 4676 bcdedit.exe 5072 bcdedit.exe 5504 bcdedit.exe -
Renames multiple (520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4968 wbadmin.exe 5908 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1532 netsh.exe 4176 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 29526f77e20b03dbe64c7af03aca394b.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 29526f77e20b03dbe64c7af03aca394b.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\29526f77e20b03dbe64c7af03aca394b.exe 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe -
Executes dropped EXE 2 IoCs
pid Process 2520 29526f77e20b03dbe64c7af03aca394b.exe 1004 29526f77e20b03dbe64c7af03aca394b.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 29526f77e20b03dbe64c7af03aca394b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\29526f77e20b03dbe64c7af03aca394b = "C:\\Users\\Admin\\AppData\\Local\\29526f77e20b03dbe64c7af03aca394b.exe" 29526f77e20b03dbe64c7af03aca394b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\29526f77e20b03dbe64c7af03aca394b = "C:\\Users\\Admin\\AppData\\Local\\29526f77e20b03dbe64c7af03aca394b.exe" 29526f77e20b03dbe64c7af03aca394b.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Downloads\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\Music\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\Videos\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Links\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Music\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\Documents\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 29526f77e20b03dbe64c7af03aca394b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-300.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\iexplore.exe.mui 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80_altform-unplated.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30_altform-unplated.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected.svg 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.strings.psd1.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\7-Zip\Lang\ja.txt.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WideTile.scale-200_contrast-black.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_TeethSmile.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-colorize.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_contrast-white.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-125.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5_thumb.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-125.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-400.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-200_contrast-black.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-lightunplated.png 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected][CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll 29526f77e20b03dbe64c7af03aca394b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png 29526f77e20b03dbe64c7af03aca394b.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.id[CE6520DC-3335].[[email protected]].deep 29526f77e20b03dbe64c7af03aca394b.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 29526f77e20b03dbe64c7af03aca394b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5084 vssadmin.exe 288 vssadmin.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 29526f77e20b03dbe64c7af03aca394b.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings 29526f77e20b03dbe64c7af03aca394b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe 2520 29526f77e20b03dbe64c7af03aca394b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2520 29526f77e20b03dbe64c7af03aca394b.exe Token: SeBackupPrivilege 4852 vssvc.exe Token: SeRestorePrivilege 4852 vssvc.exe Token: SeAuditPrivilege 4852 vssvc.exe Token: SeIncreaseQuotaPrivilege 3980 WMIC.exe Token: SeSecurityPrivilege 3980 WMIC.exe Token: SeTakeOwnershipPrivilege 3980 WMIC.exe Token: SeLoadDriverPrivilege 3980 WMIC.exe Token: SeSystemProfilePrivilege 3980 WMIC.exe Token: SeSystemtimePrivilege 3980 WMIC.exe Token: SeProfSingleProcessPrivilege 3980 WMIC.exe Token: SeIncBasePriorityPrivilege 3980 WMIC.exe Token: SeCreatePagefilePrivilege 3980 WMIC.exe Token: SeBackupPrivilege 3980 WMIC.exe Token: SeRestorePrivilege 3980 WMIC.exe Token: SeShutdownPrivilege 3980 WMIC.exe Token: SeDebugPrivilege 3980 WMIC.exe Token: SeSystemEnvironmentPrivilege 3980 WMIC.exe Token: SeRemoteShutdownPrivilege 3980 WMIC.exe Token: SeUndockPrivilege 3980 WMIC.exe Token: SeManageVolumePrivilege 3980 WMIC.exe Token: 33 3980 WMIC.exe Token: 34 3980 WMIC.exe Token: 35 3980 WMIC.exe Token: 36 3980 WMIC.exe Token: SeIncreaseQuotaPrivilege 3980 WMIC.exe Token: SeSecurityPrivilege 3980 WMIC.exe Token: SeTakeOwnershipPrivilege 3980 WMIC.exe Token: SeLoadDriverPrivilege 3980 WMIC.exe Token: SeSystemProfilePrivilege 3980 WMIC.exe Token: SeSystemtimePrivilege 3980 WMIC.exe Token: SeProfSingleProcessPrivilege 3980 WMIC.exe Token: SeIncBasePriorityPrivilege 3980 WMIC.exe Token: SeCreatePagefilePrivilege 3980 WMIC.exe Token: SeBackupPrivilege 3980 WMIC.exe Token: SeRestorePrivilege 3980 WMIC.exe Token: SeShutdownPrivilege 3980 WMIC.exe Token: SeDebugPrivilege 3980 WMIC.exe Token: SeSystemEnvironmentPrivilege 3980 WMIC.exe Token: SeRemoteShutdownPrivilege 3980 WMIC.exe Token: SeUndockPrivilege 3980 WMIC.exe Token: SeManageVolumePrivilege 3980 WMIC.exe Token: 33 3980 WMIC.exe Token: 34 3980 WMIC.exe Token: 35 3980 WMIC.exe Token: 36 3980 WMIC.exe Token: SeBackupPrivilege 1772 wbengine.exe Token: SeRestorePrivilege 1772 wbengine.exe Token: SeSecurityPrivilege 1772 wbengine.exe Token: SeIncreaseQuotaPrivilege 5676 WMIC.exe Token: SeSecurityPrivilege 5676 WMIC.exe Token: SeTakeOwnershipPrivilege 5676 WMIC.exe Token: SeLoadDriverPrivilege 5676 WMIC.exe Token: SeSystemProfilePrivilege 5676 WMIC.exe Token: SeSystemtimePrivilege 5676 WMIC.exe Token: SeProfSingleProcessPrivilege 5676 WMIC.exe Token: SeIncBasePriorityPrivilege 5676 WMIC.exe Token: SeCreatePagefilePrivilege 5676 WMIC.exe Token: SeBackupPrivilege 5676 WMIC.exe Token: SeRestorePrivilege 5676 WMIC.exe Token: SeShutdownPrivilege 5676 WMIC.exe Token: SeDebugPrivilege 5676 WMIC.exe Token: SeSystemEnvironmentPrivilege 5676 WMIC.exe Token: SeRemoteShutdownPrivilege 5676 WMIC.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2520 2928 29526f77e20b03dbe64c7af03aca394b.exe 84 PID 2928 wrote to memory of 2520 2928 29526f77e20b03dbe64c7af03aca394b.exe 84 PID 2928 wrote to memory of 2520 2928 29526f77e20b03dbe64c7af03aca394b.exe 84 PID 2520 wrote to memory of 3668 2520 29526f77e20b03dbe64c7af03aca394b.exe 98 PID 2520 wrote to memory of 100 2520 29526f77e20b03dbe64c7af03aca394b.exe 97 PID 2520 wrote to memory of 3668 2520 29526f77e20b03dbe64c7af03aca394b.exe 98 PID 2520 wrote to memory of 100 2520 29526f77e20b03dbe64c7af03aca394b.exe 97 PID 3668 wrote to memory of 1532 3668 cmd.exe 102 PID 3668 wrote to memory of 1532 3668 cmd.exe 102 PID 100 wrote to memory of 5084 100 cmd.exe 103 PID 100 wrote to memory of 5084 100 cmd.exe 103 PID 3668 wrote to memory of 4176 3668 cmd.exe 106 PID 3668 wrote to memory of 4176 3668 cmd.exe 106 PID 100 wrote to memory of 3980 100 cmd.exe 107 PID 100 wrote to memory of 3980 100 cmd.exe 107 PID 100 wrote to memory of 4676 100 cmd.exe 108 PID 100 wrote to memory of 4676 100 cmd.exe 108 PID 100 wrote to memory of 3480 100 cmd.exe 110 PID 100 wrote to memory of 3480 100 cmd.exe 110 PID 100 wrote to memory of 4968 100 cmd.exe 111 PID 100 wrote to memory of 4968 100 cmd.exe 111 PID 2520 wrote to memory of 1236 2520 29526f77e20b03dbe64c7af03aca394b.exe 120 PID 2520 wrote to memory of 1236 2520 29526f77e20b03dbe64c7af03aca394b.exe 120 PID 2520 wrote to memory of 1236 2520 29526f77e20b03dbe64c7af03aca394b.exe 120 PID 2520 wrote to memory of 2672 2520 29526f77e20b03dbe64c7af03aca394b.exe 121 PID 2520 wrote to memory of 2672 2520 29526f77e20b03dbe64c7af03aca394b.exe 121 PID 2520 wrote to memory of 2672 2520 29526f77e20b03dbe64c7af03aca394b.exe 121 PID 2520 wrote to memory of 5132 2520 29526f77e20b03dbe64c7af03aca394b.exe 122 PID 2520 wrote to memory of 5132 2520 29526f77e20b03dbe64c7af03aca394b.exe 122 PID 2520 wrote to memory of 5132 2520 29526f77e20b03dbe64c7af03aca394b.exe 122 PID 2520 wrote to memory of 1040 2520 29526f77e20b03dbe64c7af03aca394b.exe 123 PID 2520 wrote to memory of 1040 2520 29526f77e20b03dbe64c7af03aca394b.exe 123 PID 2520 wrote to memory of 1040 2520 29526f77e20b03dbe64c7af03aca394b.exe 123 PID 2520 wrote to memory of 5228 2520 29526f77e20b03dbe64c7af03aca394b.exe 124 PID 2520 wrote to memory of 5228 2520 29526f77e20b03dbe64c7af03aca394b.exe 124 PID 5228 wrote to memory of 288 5228 cmd.exe 126 PID 5228 wrote to memory of 288 5228 cmd.exe 126 PID 5228 wrote to memory of 5676 5228 cmd.exe 127 PID 5228 wrote to memory of 5676 5228 cmd.exe 127 PID 5228 wrote to memory of 5504 5228 cmd.exe 128 PID 5228 wrote to memory of 5504 5228 cmd.exe 128 PID 5228 wrote to memory of 5072 5228 cmd.exe 129 PID 5228 wrote to memory of 5072 5228 cmd.exe 129 PID 5228 wrote to memory of 5908 5228 cmd.exe 130 PID 5228 wrote to memory of 5908 5228 cmd.exe 130 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\29526f77e20b03dbe64c7af03aca394b.exe"C:\Users\Admin\AppData\Local\Temp\29526f77e20b03dbe64c7af03aca394b.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\29526f77e20b03dbe64c7af03aca394b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\29526f77e20b03dbe64c7af03aca394b.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\29526f77e20b03dbe64c7af03aca394b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\29526f77e20b03dbe64c7af03aca394b.exe"3⤵
- Executes dropped EXE
PID:1004
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:5084
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:4676
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3480
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:4968
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
PID:1532
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
PID:4176
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:1236
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:2672
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:5132
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:1040
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:288
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5676
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:5504
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:5072
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:5908
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4944
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:936
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53b73078a714bf61d1c19ebc3afc0e454
SHA19abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA51275959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
-
Filesize
175KB
MD5576410de51e63c3b5442540c8fdacbee
SHA18de673b679e0fee6e460cbf4f21ab728e41e0973
SHA2563f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
SHA512f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
-
Filesize
328KB
MD539c8a4c2c3984b64b701b85cb724533b
SHA1c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA256888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
SHA512f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
-
Filesize
6.3MB
MD51fab4b02e2d7b242541d578f315d90dd
SHA1a41fbceb6d8b0abb1aa2cffcc6bef2215de91be9
SHA256eaaf3ba5fa3e634a4acce400ed802b13dded6f64b785a3962a14581d26c8c0f8
SHA5129d98ea9292cac1a80c9b1ed4f2183708b2f303131081f388b5d7110faaed40ede9dafbf3ff80417ad1dc5203552d3b5b00d2aa6f9e48a2e4298e68f824a1e5c2
-
Filesize
3.2MB
MD5218eff38bfacea25932868ad7dc028d2
SHA1799e881b3566a9643b3a47abdf26e2d32f910186
SHA2563365471b48bd220630bd42a1cbb2be0735e83a0416ab9edbb189eb7fa06ab11a
SHA512a0bff20caf42546f76b2bdb7eb3d3e2975970fb1f7b29ac6816edf4104a0f98234a0a2dac3903bf3c82d9df6bd109ef1bb6c80fdb8684e0f9d8f7a3c7268b544
-
Filesize
5.9MB
MD57f09395ba94084c4d4600356e19c2d4b
SHA1f523b7e73dd96fcb2f896415309ec9c161a686e0
SHA25657b8169206ad1351a9bc44e6dff9e1cab1838d462df808c2fe39ae432ba838a0
SHA5127f04bc711c8daaece548ce9be2d28c0b8ab89fdfe0721205f4538298b76a2bb8f05cd74381882c6f92eff48acc8edf70c0e3f85c0eece55628f28f8d3eac77aa
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Filesize183KB
MD59dfcdd1ab508b26917bb2461488d8605
SHA14ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA256ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
SHA5121afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
-
Filesize
131KB
MD55791075058b526842f4601c46abd59f5
SHA1b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA2565c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
SHA51283e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
-
Filesize
254KB
MD54ddc609ae13a777493f3eeda70a81d40
SHA18957c390f9b2c136d37190e32bccae3ae671c80a
SHA25616d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
SHA5129d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
-
Filesize
386KB
MD58c753d6448183dea5269445738486e01
SHA1ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA256473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
SHA5124f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
-
Filesize
125KB
MD5cce8964848413b49f18a44da9cb0a79b
SHA10b7452100d400acebb1c1887542f322a92cbd7ae
SHA256fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
SHA512bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
-
Filesize
142KB
MD592dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA2563e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
SHA512d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
-
Filesize
278KB
MD512c29dd57aa69f45ddd2e47620e0a8d9
SHA1ba297aa3fe237ca916257bc46370b360a2db2223
SHA25622a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
SHA512255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
-
Filesize
92KB
MD5176436d406fd1aabebae353963b3ebcf
SHA19ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA2562f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
SHA512a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
-
Filesize
147KB
MD53b35b268659965ab93b6ee42f8193395
SHA18faefc346e99c9b2488f2414234c9e4740b96d88
SHA256750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
SHA512035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
-
Filesize
1.2MB
MD5d47ed8961782d9e27f359447fa86c266
SHA1d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA256b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
SHA5123e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
-
Filesize
454KB
MD5bcd0f32f28d3c2ba8f53d1052d05252d
SHA1c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA256bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
SHA51279f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
-
Filesize
558KB
MD515f4411f1b14234b5bed948ed78fa86e
SHA1f9775a3d87efb22702d934322ffcda3511b79c17
SHA256cd6c08078343089d299a30f7bf16555ab349e946892dca1c49c6c0336d27ff0e
SHA512c44d2e96d6d0264075379066fd5d11ba30a675bb6f6b6279c4ac0d12066975c30c33b69b52457cbed4e35852e8b15b3daad9274d6f957ae0681fb7a6c48a33cb
-
Filesize
1.2MB
MD5e316c67c785d3e39e90341b0bbaac705
SHA17ffd89492438a97ad848068cfdaab30c66afca35
SHA2564fc8b9433b45c2607cbdf3d1c042c3918b854c9db3ade13b5bb2761d28f1c478
SHA51225ec433c10adc69305de97107463be74d7b4768acca27886498485e8bc2c8b099994e6c1c6c09a7e603816203d6b18e509fb79f24992915eb802f59bcb790090
-
Filesize
773KB
MD5e7a27a45efa530c657f58fda9f3b9f4a
SHA16c0d29a8b75574e904ab1c39fc76b39ca8f8e461
SHA256d6f11401f57293922fb36cd7542ae811ab567a512449e566f83ce0dcef5ff8e5
SHA5120c37b41f3c075cd89a764d81f751c3a704a19240ad8e4ebab591f399b9b168b920575749e9d24c2a8f0400b9f340ab9fea4db76ff7060d8af00e2b36ac0c4a54
-
Filesize
121KB
MD5cbd96ba6abe7564cb5980502eec0b5f6
SHA174e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA256405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
SHA512a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
-
Filesize
325KB
MD50511abca39ed6d36fff86a8b6f2266cd
SHA1bfe55ac898d7a570ec535328b6283a1cdfa33b00
SHA25676ae68fc7c6c552c4a98c5df640cd96cf27b62e7e1536b7f7d08eff56fcde8b8
SHA5126608412e3ed0057f387bafcddcb07bfe7da4f207c7300c460e5acc4bd234cec3362191800789eb465eb120ec069e3ed49eabb6bd7db30d9e9245a89bb20e4346
-
Filesize
325KB
MD56f87ccb8ab73b21c9b8288b812de8efa
SHA1a709254f843a4cb50eec3bb0a4170ad3e74ea9b3
SHA25614e7a1f2f930380903ae3c912b4a70fd0a59916315c46874805020fe41215c22
SHA512619b45b9728880691a88fbfc396c9d34b41d5e349e04d2eb2d18c535fffc079395835af2af7ca69319954a98852d2f9b7891eff91864d63bf25759c156e192ee
-
Filesize
505KB
MD5de69c005b0bbb513e946389227183eeb
SHA12a64efdcdc71654356f77a5b77da8b840dcc6674
SHA256ad7b167ab599b6dad7e7f0ad47368643d91885253f95fadf0fadd1f8eb6ee9c7
SHA5126ca8cec0cf20ee9b8dfe263e48f211b6f1e19e3b4fc0f6e89807f39d3f4e862f0139eb5b35e3133ef60555589ad54406fb11d95845568a5538602f287863b7d7
-
Filesize
342KB
MD55da33a7b7941c4e76208ee7cddec8e0b
SHA1cdd2e7b9b0e4be68417d4618e20a8283887c489c
SHA256531e735e4e8940dfe21e30be0d4179ceaecb57ce431cf63c5044e07048ac1751
SHA512977aeecfbc693c9d5746fedf08b99e0b0f6fd7b0c7b41ac2b34a832e68a2e6f3c68f38af2e65c87075fcf00c1c6103e34324df45d7da9412cbbeea7e410794b6
-
Filesize
439KB
MD5400836f307cf7dbfb469cefd3b0391e7
SHA17af3cbb12d3b2d8b5d9553c687c6129d1dd90a10
SHA256cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a
SHA512aa53cb304478585d6f83b19a6de4a7938ba2570d380a565a56ff5365aed073d5f56b95ad3228eb7d1e7e6110c6172a58b97bd6a5e57e4a8d39e762ed31dc17c8
-
Filesize
155KB
MD596a14f39834c93363eebf40ae941242c
SHA15a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc
SHA2568ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a
SHA512fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2
-
Filesize
230KB
MD5e5589ec1e4edb74cc7facdaac2acabfd
SHA19b12220318e848ed87bb7604d6f6f5df5dbc6b3f
SHA2566ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67
SHA512f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a
-
Filesize
265KB
MD525e165d6a9c6c0c77ee1f94c9e58754b
SHA19b614c1280c75d058508bba2a468f376444b10c1
SHA2568bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217
SHA5127d55c7d86ccabb6e9769ebca44764f4d89e221d5756e5c5d211e52c271e3ce222df90bc9938248e2e210d6695f30f6280d929d19ef41c09d3ea31688ae24d4bf
-
Filesize
155KB
MD5f7c714dbf8e08ca2ed1a2bfb8ca97668
SHA1cc78bf232157f98b68b8d81327f9f826dabb18ab
SHA256fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
SHA51228bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c
-
Filesize
207KB
MD53b0e91f9bb6c1f38f7b058c91300e582
SHA16e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA25657c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f
-
Filesize
223KB
MD5d3703aa630c754bcb9474464bb65fcc9
SHA1e2a6db23e266c438664940617c934ca0439dc0c8
SHA25655214339c74106620c794060642e5d03613ca3dc1c252e3ab3b33cb1335c16b8
SHA512b6c6c25c456ae52ebefffde6a45f6ebe95866825930771aee8471b111379853ac5ac33c4c0664c8c549a6c7c3ca7fd2d701cab2559b7654fd19ef252f9785c2b
-
Filesize
242KB
MD543f672e65d0e3e5440c85e063f2b4c05
SHA1f2f74e2f7bba2a53bdf2429130e904ca9b2a7584
SHA25678909f36f84a19be9f29851843cac3e60a36d239c37caa768242c6c0e0c6fea0
SHA512cad2d3ce2ba1f0f3d07045601227b618c470b050f334fc728ce3b52bdcbe73ded4a072d79ca1034fb4ca07d0720664cdf5af621f4019b69086b79aa77d8c3145
-
Filesize
138KB
MD59838249f0dd888dbe4f8a7dc148cb27d
SHA1b82f2b7559bade106613f19728f0abc223b23908
SHA2565e35e21d35768f4dc2fae3c84d834a433f99a0329e1154f490c564fe4f3a3686
SHA5123d1eae1de5dc6a4febc59eff52b87643c5e34fabe19614ecfe5b1cd075264ede638a5d3dfbebaa5f21a4dedde0f2957a22427116c5ba5f1517829024c1b72b02
-
Filesize
256KB
MD5ca0e79dc3e445a64eabf98effd74adbb
SHA15b0a97d95f4a13f7b48a8805d86972efe6ee7cc9
SHA25624b392a1adb3a6b112d9a2c333e1bdf36f1182a0d514c2be4b9947e64d9cb4b2
SHA512a61d38741fc0915978d33dcf377b68f53f01679e4cfdc417252685e24d640e49d722a7dce38f16211a201aecd0664e5ae38927e230c0bcb04c44a908db89e590
-
Filesize
302KB
MD5517682f110de9cb6176c4e09a570c082
SHA173800d7b8b2ee890e08e7a8c825f55ed78f795a7
SHA256fa84437953481e8e0b79b10ffecf8343552c32ef33566317926eb9d1682b3f8f
SHA51295317132e85773745f27dd15b4862a03c60ebcc3d928531bd5cdffb2c7986e02331e9a5c87a8cd72fde852dc5120ccf60f66b10e0f9aee9a78f4e45789ea59c7
-
Filesize
138KB
MD59b4c90533f30a05ce6a1e8dea56f16aa
SHA14fe6ed43031db12613f7a06947d6d74c34df75ee
SHA256601c2c28e123adc3cd93ad7c1b7fe15fc2660853ad765285e37d1700f10aad9c
SHA5121b956bd7e7a2a8b2d80696a92944ef5425de5fac654525b0e22a74f4cee036577dd94c4f7c2f1f9efd08f8e3a7a2900418fb42634670685e7056fa04c1d3ff5b
-
Filesize
2.3MB
MD5a8478d478cc6d76e891212e71c2fd7f1
SHA187d5aaf9b49b3db6856b7ec866411f4e7c52209d
SHA2567b08c5d81189283330221b0d0869717a91526f42d2f1b715cb8d3ff08211a285
SHA512bf5fff573268a13f76ccb03e76ad4dc931828a769aba1bbe2a9b55400813a5e7e0c601a4cc75774abcea42bbbd6a5a47af1a3aeedfe4de18b1f5a808afaca662
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe
Filesize2.3MB
MD5b308eb49c5c15b75f0e0fe5d8f2d32dc
SHA1d9be20b7c2925de4cf8d1aa24836a278e3a06a5c
SHA2563d4a91f26b0b89d0472898c21363d97be56553ff3249c0c615f586ddec79b15f
SHA512df6fdc08e714c380c0c70cd3759c3b09dd319fc98e10209afee2ee3cd2059e41156f1a22386c2f7b22255b448d7f1de7109a650dc46849bc5990b11768d3cfcc
-
Filesize
250KB
MD55d656c152b22ddd4f875306ca928243a
SHA1177ff847aa898afa1b786077ae87b5ae0c7687c7
SHA2564d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
SHA512d5e50ee909ea06e69fc0d9999c6d142f9154e6f63462312b4e950cf6e26a7d395dbb50c8e2a8c4f4e1cfb7b2c6ae8ad19e3b7c204c20e7557daa1a0deb454160
-
Filesize
509KB
MD57c73e01bd682dc67ef2fbb679be99866
SHA1ad3834bd9f95f8bf64eb5be0a610427940407117
SHA256da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d
SHA512b2f3398e486cde482cb6bea18f4e5312fa2db7382ca25cea17bcba5ab1ff0e891d59328bc567641a9da05caca4d7c61dc102289d46e7135f947ce6155e295711
-
Filesize
4.4MB
MD5e6d85e363906b9adac9820a960c48f57
SHA1a3311406d69852e2d9b4a4fb35b396d8b352649a
SHA2563356dcadb393e558d5d46a983b9ae2de483e64b17447e4e9e55f8c7775fb9d01
SHA51299d1f18056255e7efe513766d8ecebc4186bb84752f4559a5254987c7ba585e11c32534afa8e51cb8f2fd8346d1c752f4fd7af3e693d795538ae1a72eb771061
-
Filesize
138KB
MD55e08d87c074f0f8e3a8e8c76c5bf92ee
SHA1f52a554a5029fb4749842b2213d4196c95d48561
SHA2565d548c2cc25d542f2061ed9c8e38bd5ca72bddb37dd17654346cae8a19645714
SHA512dd98d6fa7d943604914b2e3b27e1f21a95f1fe1feb942dd6956e864da658f4fbd9d1d0cf775e79ceaae6a025aafd4e633763389c37034134bd5245969bec383e
-
Filesize
2.4MB
MD5e0b4c7d5e41c9319a4fc2be350267270
SHA16d7b6305eab3957825b38538c7d6a7cec7a66981
SHA256586393f277fdb9f7f139e2f9b3cf7074ce0a04177656d8359a8cc482663b86ee
SHA512a1c2fd4e6744665e63dac7a5c3f8841ad38917f58198fd7acec5cb96dbad3014f6f715270dc4db86dd7c2be1e298c2b5fc850b172720d9de62f4e71a9f1259de
-
Filesize
1.1MB
MD5301d7f5daa3b48c83df5f6b35de99982
SHA117e68d91f3ec1eabde1451351cc690a1978d2cd4
SHA256abe398284d90be5e5e78f98654b88664e2e14478f7eb3f55c5fd1c1bcf1bebee
SHA5124a72a24dec461d116fe8324c651913273ccaa50cb036ccdacb3ae300e417cf4a64aa458869b8d2f3b4c298c59977437d11b241d08b391a481c3226954bba22e4
-
Filesize
3.6MB
MD5c16c8c02ad73ebacbb065a258cc7935e
SHA1605b5b60b1f3d7582b52c33f46483dffbaa40042
SHA256f3a27da42dd68ed469100a9a6bea78c5f57ea72c7dea63692fe8596a36f60fcb
SHA5127132d1c5174343ab1b400644fee33e79c33ef1019af5f7b5a663f3c44217fe4bbe4ec246a1fcabe709ee654a0b65e5775247a1a553856c67126b52b1bdb35d46
-
Filesize
1.1MB
MD5a5d9eaa7d52bffc494a5f58203c6c1b5
SHA197928ba7b61b46a1a77a38445679d040ffca7cc8
SHA25634b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
SHA512b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787
-
Filesize
2.3MB
MD558bd9c4528106bd7c642e360e88aaa6f
SHA1cffcbb805e4a4631d27a5f2dc05d4435f171ecaa
SHA256646f02277517fde160bba5b1dd1f2ca01e39ff0a66045e9505873ec016944e18
SHA512d5874559f253d3b9bf4f9d67dd887d24fa73b028886d9713048173a2cecdad7aebdacddc16718d277dc80eacfb545ffce69a069f0c3cd89bd887e742081db7cf
-
Filesize
3.5MB
MD5b7a3bcf22fc089abe52272cb15c53687
SHA1163bb8f14049f01b0c4714c25619db788e267938
SHA256a88d91f65c0608543aa1734b70b9f83d939ea0b2ee36fccaa70d9a401c42b356
SHA512ef36d5d9c5e2d7b3b278494c79091e083570dfeb4d63bdfc4c93f049b6353acfe6fed118771f86e09018026520da424cc0262db7a2bf4f0af0a7ead0638819e6
-
Filesize
1.3MB
MD527543bab17420af611ccc3029db9465a
SHA1f0f96fd53f9695737a3fa6145bc5a6ce58227966
SHA25675530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c
SHA512a62c2dd60e1df309ec1bb48ea85184914962ba83766f29d878569549ca20fca68f304f4494702d9e5f09adedc2166e48ee0bc1f4a5d9e245c5490daf15036bea
-
Filesize
1.1MB
MD55c78384d8eb1f6cb8cb23d515cfe7c98
SHA1b732ab6c3fbf2ded8a4d6c8962554d119f59082e
SHA2569abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
SHA51299324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6
-
Filesize
3.9MB
MD5839f4c449808ac2eb9d5bf19f8913711
SHA1bb8796eff90a6bc46d42dddd43b97eb932c8029e
SHA256c82507f0ef783a9c3a63a8a46ddb65a539bc8c80df6fc56a31e07ea140eead3f
SHA512842973fd100cdc1262d43b66dffc01cfb9d9bc5814473c658c2a2f8d32f51a5a8850082c1695eec25ecc25ceaf1c87f3aa5cd72438b2cbab5709a70313b1fdc7
-
Filesize
141KB
MD59cc8047a7f7963378556e4de802b0a7d
SHA1e8b64a0be5eb3d465a259c1211dd8d1d62202dd8
SHA256aac915fbd1808bab7670e4a143642ca857a4c4ffe3f9bc0999ffb5b9f566bd65
SHA512260334d4f2967cf52ccf2ad21a346a3ae38d39a07f58188588f55285d58a904afd3b8c1ee7a9d86d1010b90b1fbcfc19f30074f803bf356cb8ee2ebc62fd35c5
-
Filesize
281KB
MD599ac881582035c636c2359fcc7c72b71
SHA134e222ce94d0fb0cbfe61e7e37d527c01a413e5e
SHA2568aa538991767d32b538ad399c1e2af1e536ab9fc04ca70f13c0728347f404753
SHA51244bd12f2e8da0bd02c0348720bc73d00823ab9bb6a5ef7eba1881dacf0817c37d763b0cc3ab201e958822220ecc4d93a871ca693bb0f6ed95c1b26eb7a00d6f2
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[CE6520DC-3335].[[email protected]].deep
Filesize2.7MB
MD5bd1132c6e00638d18edf26e2bbd27c60
SHA1085c47f3b3ad6cff99bc70ffcc936c97f1b06962
SHA2564b47ec3d1751b9d8a4b9065ba63ebe7c3642193c7156b6fba16bbad24fdc92e7
SHA5127dedd1428d3846dc027ddcd0c80deb23e79599714a585190e4c899ab20bf3b13cc7aab85c688a50a95682f7d2637bdac6faaa6914a7ece5ab0e28cd6a8ae6041
-
Filesize
494KB
MD505bdfd8a3128ab14d96818f43ebe9c0e
SHA1495cbbd020391e05d11c52aa23bdae7b89532eb7
SHA2567b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
SHA5128d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da
-
Filesize
1.6MB
MD5ef29a3a431cdefb94b747615a6bebef1
SHA12de46183f9116ec58dd18bd72e13cbed2436e206
SHA256ac1d3d3070372e530a049d7fd11c5822c42a3e6acd703dc38a96837500dc412b
SHA5124cd591b5ba4cc962be5b9d34d116bbfd71fbbda62e9ed1220d6bdafba1984b5d482951eac3c57accb31c73775a0d8dd30e4ddc40a829d26ad2d899a78d53eb0e
-
Filesize
485KB
MD586749cd13537a694795be5d87ef7106d
SHA1538030845680a8be8219618daee29e368dc1e06c
SHA2568c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
SHA5127b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c
-
Filesize
674KB
MD597510a7d9bf0811a6ea89fad85a9f3f3
SHA12ac0c49b66a92789be65580a38ae9798237711db
SHA256c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA5122a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
-
Filesize
56KB
MD5127fe6658efb06e77b674fdb9db7d6d5
SHA14790bde7c2d233c07165caaab0f5b7d69a60c950
SHA256d5746d9f3284dadf60180f7f7332a08895c609520e0c2327918f259d182cbaf6
SHA512b919c93abb89f3c826586346337ed295127f1f084bd7fc54d13a4db4b4ca1ffd3ad3dc6f362b5a414b76846061d8d1a3a8b9cf94475b4debb2bf68e67d2bcb72
-
Filesize
5KB
MD55504aa2dd8f2bb698e4c7cdd78e0edd0
SHA1df73315a2da39ffa1577191f34434779a6a900a6
SHA25674830e11b3b1244f949efbdcd46f52617306dd280947b524e142fc73d3acc4d8
SHA51251c936d35dc7a6775815b4c2e3f96c29654fe374241b1460d41b357d03ce3b5b707dd08c65c588746086d0bc10dab81d3f06bef1c19d6ee3c78620567b5cd29c