d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170

Resubmissions

09/10/2024, 17:46

241009-wch6vszgpk9

09/10/2024, 17:34

241009-v5l8jsvarc9

Analysis

max time kernel
209s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
postinstall.exe
Size 78KB
Sample241009-v5l8jsvarc
SHA256 d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170
MD5 6a51174161805d1ab3b2266491977262
SHA1 7bfa58d9d08860d10b785aa29c15b771acea97f2
SHA512 2a46dc3253116f6c29e0d1fac396cdad7c9830b5aaa8e03b4fc818731b8a4b477f7a9da7a69d001c8ae86af45cc3cca8c5566fca32b8ece6544afabd839d650d
SSDEEP 768:dFrUDyws7COidwuGPthR2IJwCfWnq3+fZAMZSme4QJJ9WMrbtTq58VO/8Nf+4PfT:dxUD5s7C9dqthlD9uOm48i6W
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1120	powershell.exe
1796	powershell.exe

Power Settings 1 TTPs 24 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2380	cmd.exe
4696	powercfg.exe
3844	powercfg.exe
4636	powercfg.exe
2128	powercfg.exe
3884	cmd.exe
4252	cmd.exe
1660	powercfg.exe
2944	cmd.exe
3828	powercfg.exe
2672	cmd.exe
3092	cmd.exe
2004	cmd.exe
1520	cmd.exe
4712	cmd.exe
4328	cmd.exe
2304	powercfg.exe
4004	powercfg.exe
820	cmd.exe
5024	powercfg.exe
2200	powercfg.exe
3816	powercfg.exe
1548	powercfg.exe
3524	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1584	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1548	powercfg.exe
Token: SeCreatePagefilePrivilege	1548	powercfg.exe
Token: SeShutdownPrivilege	3828	powercfg.exe
Token: SeCreatePagefilePrivilege	3828	powercfg.exe
Token: SeShutdownPrivilege	4696	powercfg.exe
Token: SeCreatePagefilePrivilege	4696	powercfg.exe
Token: SeShutdownPrivilege	2304	powercfg.exe
Token: SeCreatePagefilePrivilege	2304	powercfg.exe
Token: SeShutdownPrivilege	3844	powercfg.exe
Token: SeCreatePagefilePrivilege	3844	powercfg.exe
Token: SeShutdownPrivilege	4004	powercfg.exe
Token: SeCreatePagefilePrivilege	4004	powercfg.exe
Token: SeDebugPrivilege	1584	taskmgr.exe
Token: SeSystemProfilePrivilege	1584	taskmgr.exe
Token: SeCreateGlobalPrivilege	1584	taskmgr.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeShutdownPrivilege	1660	powercfg.exe
Token: SeCreatePagefilePrivilege	1660	powercfg.exe
Token: SeShutdownPrivilege	4636	powercfg.exe
Token: SeCreatePagefilePrivilege	4636	powercfg.exe
Token: SeShutdownPrivilege	2128	powercfg.exe
Token: SeCreatePagefilePrivilege	2128	powercfg.exe
Token: SeShutdownPrivilege	5024	powercfg.exe
Token: SeCreatePagefilePrivilege	5024	powercfg.exe
Token: SeShutdownPrivilege	2200	powercfg.exe
Token: SeCreatePagefilePrivilege	2200	powercfg.exe
Token: SeShutdownPrivilege	3816	powercfg.exe
Token: SeCreatePagefilePrivilege	3816	powercfg.exe
Token: SeRestorePrivilege	3536	7zG.exe
Token: 35	3536	7zG.exe
Token: SeSecurityPrivilege	3536	7zG.exe
Token: SeSecurityPrivilege	3536	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe
1584	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4360	OpenWith.exe
4396	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3352	2324	postinstall.exe	84
PID 2324 wrote to memory of 3352	2324	postinstall.exe	84
PID 3352 wrote to memory of 3404	3352	cmd.exe	85
PID 3352 wrote to memory of 3404	3352	cmd.exe	85
PID 2324 wrote to memory of 380	2324	postinstall.exe	86
PID 2324 wrote to memory of 380	2324	postinstall.exe	86
PID 380 wrote to memory of 4828	380	cmd.exe	87
PID 380 wrote to memory of 4828	380	cmd.exe	87
PID 2324 wrote to memory of 4060	2324	postinstall.exe	89
PID 2324 wrote to memory of 4060	2324	postinstall.exe	89
PID 2324 wrote to memory of 3608	2324	postinstall.exe	90
PID 2324 wrote to memory of 3608	2324	postinstall.exe	90
PID 3608 wrote to memory of 1120	3608	cmd.exe	91
PID 3608 wrote to memory of 1120	3608	cmd.exe	91
PID 2324 wrote to memory of 4712	2324	postinstall.exe	95
PID 2324 wrote to memory of 4712	2324	postinstall.exe	95
PID 4712 wrote to memory of 1548	4712	cmd.exe	96
PID 4712 wrote to memory of 1548	4712	cmd.exe	96
PID 2324 wrote to memory of 4328	2324	postinstall.exe	97
PID 2324 wrote to memory of 4328	2324	postinstall.exe	97
PID 4328 wrote to memory of 3828	4328	cmd.exe	98
PID 4328 wrote to memory of 3828	4328	cmd.exe	98
PID 2324 wrote to memory of 3524	2324	postinstall.exe	100
PID 2324 wrote to memory of 3524	2324	postinstall.exe	100
PID 3524 wrote to memory of 4696	3524	cmd.exe	101
PID 3524 wrote to memory of 4696	3524	cmd.exe	101
PID 2324 wrote to memory of 2672	2324	postinstall.exe	102
PID 2324 wrote to memory of 2672	2324	postinstall.exe	102
PID 2672 wrote to memory of 2304	2672	cmd.exe	103
PID 2672 wrote to memory of 2304	2672	cmd.exe	103
PID 2324 wrote to memory of 3092	2324	postinstall.exe	104
PID 2324 wrote to memory of 3092	2324	postinstall.exe	104
PID 3092 wrote to memory of 3844	3092	cmd.exe	105
PID 3092 wrote to memory of 3844	3092	cmd.exe	105
PID 2324 wrote to memory of 2004	2324	postinstall.exe	106
PID 2324 wrote to memory of 2004	2324	postinstall.exe	106
PID 2004 wrote to memory of 4004	2004	cmd.exe	107
PID 2004 wrote to memory of 4004	2004	cmd.exe	107
PID 2324 wrote to memory of 4816	2324	postinstall.exe	114
PID 2324 wrote to memory of 4816	2324	postinstall.exe	114
PID 2324 wrote to memory of 2916	2324	postinstall.exe	115
PID 2324 wrote to memory of 2916	2324	postinstall.exe	115
PID 4424 wrote to memory of 4072	4424	postinstall.exe	127
PID 4424 wrote to memory of 4072	4424	postinstall.exe	127
PID 4072 wrote to memory of 1612	4072	cmd.exe	128
PID 4072 wrote to memory of 1612	4072	cmd.exe	128
PID 4424 wrote to memory of 3928	4424	postinstall.exe	129
PID 4424 wrote to memory of 3928	4424	postinstall.exe	129
PID 3928 wrote to memory of 4276	3928	cmd.exe	130
PID 3928 wrote to memory of 4276	3928	cmd.exe	130
PID 4424 wrote to memory of 3792	4424	postinstall.exe	131
PID 4424 wrote to memory of 3792	4424	postinstall.exe	131
PID 4424 wrote to memory of 1496	4424	postinstall.exe	132
PID 4424 wrote to memory of 1496	4424	postinstall.exe	132
PID 1496 wrote to memory of 1796	1496	cmd.exe	133
PID 1496 wrote to memory of 1796	1496	cmd.exe	133
PID 4424 wrote to memory of 2380	4424	postinstall.exe	134
PID 4424 wrote to memory of 2380	4424	postinstall.exe	134
PID 2380 wrote to memory of 1660	2380	cmd.exe	136
PID 2380 wrote to memory of 1660	2380	cmd.exe	136
PID 4424 wrote to memory of 2944	4424	postinstall.exe	138
PID 4424 wrote to memory of 2944	4424	postinstall.exe	138
PID 2944 wrote to memory of 4636	2944	cmd.exe	139
PID 2944 wrote to memory of 4636	2944	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\postinstall.exe
"C:\Users\Admin\AppData\Local\Temp\postinstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=80 lines=20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\system32\mode.com
    mode con: cols=80 lines=20
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color E
  2⤵
  PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /import "%SYSTEMDRIVE%\Modules\PatsimaOS V2.1 IDLE ON.pow" 01100101-0101-1100-0110-009977665544 >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\powercfg.exe
    powercfg /import "C:\Modules\PatsimaOS V2.1 IDLE ON.pow" 01100101-0101-1100-0110-009977665544
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /import "%SYSTEMDRIVE%\Modules\Ultimate-Performance.pow" 01101001-0110-1101-0111-009966554433 >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\powercfg.exe
    powercfg /import "C:\Modules\Ultimate-Performance.pow" 01101001-0110-1101-0111-009966554433
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /s 01100101-0101-1100-0110-009977665544 >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\powercfg.exe
    powercfg /s 01100101-0101-1100-0110-009977665544
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\powercfg.exe
    powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %SYSTEMDRIVE%\Modules\7zip.exe /S >NUL 2>&1
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /b /wait "" "%SYSTEMDRIVE%\Modules\7zip.bat"
  2⤵
  PID:2916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2240

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1584

C:\Users\Admin\AppData\Local\Temp\postinstall.exe
"C:\Users\Admin\AppData\Local\Temp\postinstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=80 lines=20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\mode.com
    mode con: cols=80 lines=20
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color E
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /import "%SYSTEMDRIVE%\Modules\PatsimaOS V2.1 IDLE ON.pow" 01100101-0101-1100-0110-009977665544 >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\powercfg.exe
    powercfg /import "C:\Modules\PatsimaOS V2.1 IDLE ON.pow" 01100101-0101-1100-0110-009977665544
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /import "%SYSTEMDRIVE%\Modules\Ultimate-Performance.pow" 01101001-0110-1101-0111-009966554433 >NUL 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\powercfg.exe
    powercfg /import "C:\Modules\Ultimate-Performance.pow" 01101001-0110-1101-0111-009966554433
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /s 01100101-0101-1100-0110-009977665544 >NUL 2>&1
  2⤵
  - Power Settings
  PID:820
- - C:\Windows\system32\powercfg.exe
    powercfg /s 01100101-0101-1100-0110-009977665544
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e >NUL 2>&1
  2⤵
  - Power Settings
  PID:1520
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c >NUL 2>&1
  2⤵
  - Power Settings
  PID:3884
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a >NUL 2>&1
  2⤵
  - Power Settings
  PID:4252
- - C:\Windows\system32\powercfg.exe
    powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %SYSTEMDRIVE%\Modules\7zip.exe /S >NUL 2>&1
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /b /wait "" "%SYSTEMDRIVE%\Modules\7zip.bat"
  2⤵
  PID:3500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\postinstall\" -spe -an -ai#7zMap30952:102:7zEvent14207
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 00ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397
MD5 d136d3411d4aa688242c53cafb993aa6
SHA1 1a81cc78e3ca445d5a5193e49ddce26d5e25179f
SHA512 282ea53f8093c00e8c64d253782068211f8c4187391d5078755f55dedb8825c0042173d82f489d7b6c06e88184b70e83c1e92dadb80f57bd96c95855ac6b3da1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
Size 1KB
SHA256 a7b1c85b1aabebdb4568389ca4340402b5a327afeb5365a9183b962a6a8d1e3a
MD5 a213dcaf4d22d6c60e8fe38675357e89
SHA1 0929c35794522a1702dfb5b33fb7382fa398123a
SHA512 e64cb47151925ae7471025a25fa3bba2593a260059163829311838ceb2966661a59d2d648bd81fdc02bb0fd9d9fe46ef05a978209ab31e57a42eac2c27c7d0bc
MD5 SHA1 SHA512

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Size 13KB
SHA256 d10f0f54aa31bb0245b094aae1df320569103a0d46ef3b9403bf21d12fd54b85
MD5 b3d323ea4eb46ce5078e4e07cd873907
SHA1 da6f064987bc574ce8d77b6f228948b24863737a
SHA512 3eaa0f43c033fc42a42cfb47c572eb121cc8508518b9c83bb3189079314cf77982e7761333ff6028182dea3716e0a1b9b3c14f7aebc75ded2bdcccce4f543925
SSDEEP 384:s7QJ4fHHTiiPcn0gNqVPW899999zT+J0+t:s7QJ4fHHTiiPcn0gNqVPW8999996
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20241007_091203424.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20241007_091203424.html
Size 93KB
SHA256 6e89a7a2335cc9e47e820a119c90e4c69ed8d736c61fdc2477e2154f45077f22
MD5 3c8027a9c9235b264f09fa930d98ec16
SHA1 9e0969f08ffe390b9bea0e99e0b8e1f3c2e50a27
SHA512 77e1472fa5f66097561b98ac6b89365add1849d101faa3dab29480532a20f3aa6b43be088c003af342e1d6bd512bfc884f52aabe89e05cfd3cf85dcf2d3ae93e
SSDEEP 768:fdsOTLyUFJFEWUxFzvovE7OQEpexaxsDII:fdsWyUr+WUxpvos7OQeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242.log
Size 15KB
SHA256 5d74ac426a6217437e6e6f649bb63a3a6da7fb9e4e7790710e8ebec0e9b8b72a
MD5 b98a76718ec2073bced1142f9a564cf3
SHA1 4fe50d2752cdc0ad36516d77aacebe7a233119f2
SHA512 0bd92d0f0eb39f38292899ee0546c45ddcddf23ef406733fa80cc578edc67279db39b5f6a2fe5038757a14437b3aa7b8f504bcae6b6f6a0cf0968c590d5de192
SSDEEP 384:pm+VfjEGBTuOZlOZaVXabVKV3PV1h+4xrA+xZp0ghDxZx:pv+SlSsXaZ83NDZLrLx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_000_dotnet_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_000_dotnet_runtime_6.0.27_win_x64.msi.log
Size 551KB
SHA256 c0f8cf80634ac057ed8be0e60c8a0cdcd38144e1a882ae73c0c9340a2f9413ef
MD5 1c1e753afe1f9c8d68a9471617ddd0bc
SHA1 df084257db7ca88fefd0529ecf32d777c6e61445
SHA512 ac0981d17f04dd14e1ff13652b607264cd1a0a5328ce061f299daad018d8ee683b7045236e249fc228e41d51adbcf2919be82859d80525742568ad17b2fa554f
SSDEEP 3072:kKWPjciryAy0vTEVz6CDqVrIhQuaf355uu6GqZecZNX7+kcRTOQpzeUv300Pc+IG:ejbbwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 2b2b067ebf38cf32987a40a59ad138e4b568dbb22a6ba86d49111e44f18ce8a4
MD5 b26f0216b0e42cf51ba684a041c6b7fa
SHA1 4bbaaf1b8498151fef27c4ebc660cb0089d1358a
SHA512 b40b8137a9edea07f81947e9a293fe3b9452a6b1338e5dcc5730234c1755833ccd137957a5551144d029ca4e6d9274158cb06e8c29989f0c9b080e2e71efbf24
SSDEEP 1536:OPNG/Ufur3J0IvDz2pAqeUb5IJLzg6iCUMa0xmsfUmHnjPyje8zVQZrN:OlBje8zVQVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 8247a2320aadf73876faaf83b27bacc2003ae5f52900d8f3e8a812dc456ed0d2
MD5 5b71d08976d9bb567720f16adc658a27
SHA1 87ec1b586710db47232eae74ccc4e2617be05e41
SHA512 e3c53bd8042a74901c52d763efae74d58d2bb1327e46bba96b8d0f194101df4cca2d8568792bfa5b95db304144cb723acdb28b9403065dba6beccda69a50bf5c
SSDEEP 1536:0Tw1nryb+KQ8VXjDWrWqOk+Z8ZoxeMU0yteG5BENsMwFaj+gWEyzuDk7MdvmpuMn:0Nvj+gWEyzuDk7Mde/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
Size 847KB
SHA256 71627cd5fbefe98f2e7e6e545d766b3b73b70aa2c5d272e7b83a016bc819fced
MD5 81e18869ea1f2ff742788d002a656c27
SHA1 fc344ce4ab917fc8f85da3bd5d64d1ce806620c5
SHA512 e3d2d96d3da69b287fc00c0afa1b32546ba2b141cc49e8f0a6e429da32582c522c23b1f64ee017e2945f4bbc65d559f79f806354933c1c98511d623f384b0455
SSDEEP 3072:sqKpijHmbPNtuz/Lan/JmvjhuTTCaS2CQpuCuQo/KYtvqFRT16MWjZ2en2bACnKi:njU2P0go
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324.log
Size 15KB
SHA256 aeaf61e6801184910b8bd506b73d4f70d413dfa44e176ea69b1491541c4499c5
MD5 08360ee1c0e2297b1c82074de1037a52
SHA1 3db8bff81bb97ec176b12c6ecfe070d880ec6f78
SHA512 5752a3507e30afacd5ae49cb8f91928f044e24cbcee35df93f9ba36886333464bec48d3aee562a6689b2c6a04526d3921c2d06dc36d52567a5499a90583abe74
SSDEEP 384:l9RVKSjvWuAPJJPJQV5jYV+VpCVgv3hVDoHW2JFaRY12J4:l5IBJBi5jaQpkCziNi4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 bc19de6b0cff3c55f195cd6df1a182ece15f29e8a668b914e9a78bcb3cd14af4
MD5 7a61a613d8b53763baa0b13a172b0da5
SHA1 1cf63d3ecd573b37da787fdd512a788474a1b3b0
SHA512 86e6d8223bb37e550b49c509a9147f2e4af58afc7ad59096ccf9d0b2c4bdae023fbf35df9da3eaaedb8881375d917cf1d6c73bf80535f91fc20e28c675a9ab71
SSDEEP 3072:cFfKjbt6c9B/p1ajbLJOtmlmv9WCX19XsNl+obpGHeRz/5+wKvGsF7up8nGxoven:7jqUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 d56ae4651274e3f06c5355be227d5c198ee466233c43c80d1919359f268e8387
MD5 75b3d6ff207beffb2878108293767c4c
SHA1 c7f47c72cefd958c0ac48f46c1efca97b3b8ee0d
SHA512 e4046493fd76b69510cc2ac36c6d9b5e0d29df86362c39405ebf960aaf79084e10ff5e4ae7c2cbb567a49d5029e96c13f7a8d6ffed1b2fc66814532d672ee96a
SSDEEP 1536:oyWC/ThMVJ3gy3JzG1OkfxeBrpCSFbjbhZ7BcOasUSsMKlMjEq4nxQjK:oG+jEq4nx2K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 d7aecd914b6470ca53fd30b4f00771b57678cc0b39a88f3264e0125c70a15345
MD5 c617204e493891ef5ac8e69cfbf816a3
SHA1 89d85046cd49463de539f808340e717219767f51
SHA512 ac322b328649c87ec47290b621f903d706e5f7f8ae37140c59238c5d505f37ce0e479183e86306bc5f54863208fd3f765de9afb76c8e5b71f4c2ea1ba5e699a5
SSDEEP 1536:TRnAXPY1sgaYBntjGVfAL1pRbZ2EXJBpjo3uMhkFBhJ70jXvhMKc0HoLhnVya:THkjXvhMKc0HoLhnIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
Size 852KB
SHA256 38452f045edc1fb8eb4c36f0006a8dce48e9c624bf02184f529adcf6b7f1a4ac
MD5 a50e5de0e76369350165abb73ff67b5e
SHA1 bf504295b161b7c1c752bb1ae39f506b17513c50
SHA512 96a5610073b080706d5f2a23c1916e0f956525b8c8cad9c2ca4030d905e3a76e0dd0abe915bc2b72089af20bf7cfcc0a61a8d4631194fac5a3358a03d56c80d7
SSDEEP 3072:JLOZjsddw13Hrbud7nHUtCOisDnpy9WJecMfuDjh1UNXuLEoUdFt8gu4R8AgrJRT:KjEoiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345.log
Size 15KB
SHA256 c7710c2b82a6b083078f1fd67bab09faebdd0d9b3a3f6ad98b73e8a0bf69c37e
MD5 b328430c82b4e48ac2e624e7e4ea78bd
SHA1 cdfa752f1ede464a4cbde04ba28c96d3e1002230
SHA512 a1259bc932bc3d59e2c300a7476744cde97d21e2b70bb346848ea7809b6b24807a7b96d1ced3c91a3d1d1c009560106f566d90d031e0899702832d0c8397ea97
SSDEEP 384:F/WV6nS+9bfZ6JZ6MV3cg9A3QJsVSVVjVm3Bv4Vk/M6ziILWM6q:Fgy0J0+vJeUVx8dpypq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_000_dotnet_runtime_8.0.2_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_000_dotnet_runtime_8.0.2_win_x64.msi.log
Size 469KB
SHA256 cf1a6f88fb0064851fcf829d4130eeceed35629b8c5226df49e7683940eaa2e3
MD5 1c61ec53c31784f2dbc5f126615130e7
SHA1 abafd6d5a769c2bf3a0b8875416848a282f4c215
SHA512 19ceae1906d96929f559f85963422f82e140e0427e347c7cc16c7a787df93520d01079a4d1ff7e9e1e56254e47c739231b3d5ac222608226a04b064988c38420
SSDEEP 6144:JbTPI6UJ+dhMi0aSsYiE9qlXVM2g6s4Dj/uR+ymo+NuZea5M:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_001_dotnet_hostfxr_8.0.2_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_001_dotnet_hostfxr_8.0.2_win_x64.msi.log
Size 95KB
SHA256 070305e026a7486d40c1fef63b8c9954e8fad39e200d5dc716f5fb1f2a861034
MD5 41e8e0ffdf56e32f74f051d658da1ce2
SHA1 493728d81673926555b5d2723d500dc1ccafa0e4
SHA512 690675d1b3b60e82d3cdd255588197860513f5aa7fa6e0ea666d77e4ed503ceaab13e90206724783c541f0c41d76f75eb904d04aa367b6c0df45fc538a441017
SSDEEP 1536:QGrHQdTVa5Vv6XGTfh6aXebOAZY/pf2JwpTb4iaK8kCcxmTuEt3KXK8nf1HB28Bw:QGrHQdTVBrdKtnf1HB2Cj9wcGCuMcOcN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_002_dotnet_host_8.0.2_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_002_dotnet_host_8.0.2_win_x64.msi.log
Size 109KB
SHA256 6aebc49b79d25fb3b021ae82bbbcde1a0f5b997e07d9bd798828b08c15c5c459
MD5 b0014d1881cd28b3a1f396fd969c6a5a
SHA1 4afbc8f9581aecc1572ef02789870cc83dd0070d
SHA512 043a06acefd2d60c42953f0625719e11047cefe1b59ea2a49342fcb973bc066b799484d7073df227442542f6767f7e899da91a68bd2011de4b624297e3041f88
SSDEEP 3072:m61CchaQ6mFj1Z+j0OjuHeAkal/SrzIHDzf73mK:ujYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log
Size 846KB
SHA256 e0cb701d2f5c87511fa7162ad5b3bb577150ea0d47c75c17f0e4cb7ab13fc6c3
MD5 cf39fc0aac5999fc788c89bc261e6b30
SHA1 39c8f3ff98ccd9760cdab173eeb56c82339c1704
SHA512 6b20266ab67898a7328270f734c923bca5ce791a66c24b3ed7de7ddd5eeb9690d71aa2e651d48773deeb3b6c9f0ab3ee9342ce4feab75ec1aede3308b2a5f1fc
SSDEEP 3072:OA/YivoSXdXwGDIOY1cel3tY0l0Bkmt00jF/e7aFpapOyxmGH5bNJBJSD+fMV74y:/jHEWAAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OFGADUSE-20241007-0917.log

Path C:\Users\Admin\AppData\Local\Temp\OFGADUSE-20241007-0917.log
Size 57KB
SHA256 aa3fcffb906b571509295705bc7b262e354c7669c3a46614292122f61727ad6e
MD5 4918ec1675c6d64eb1878d5da75fba26
SHA1 8e485c9673f5d7d6ef2fe44844e85ec1de98046f
SHA512 b1bdbbf2a6b08650d698687c1a7d8e2195ac89dc241cc4e1fcb7e9496307e8d07907419ff4fbe436ec39a739ef3b0c5aa3e0ad560fda3b23709a459e3bc130ae
SSDEEP 1536:pJMOaQO/dCO0WsWIwc4gWsYYzU77oxsFHRaDypI/zepoSXAHscDDUYjCi6MwWcas:3dCC8eFxsFHcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OFGADUSE-20241007-0917a.log

Path C:\Users\Admin\AppData\Local\Temp\OFGADUSE-20241007-0917a.log
Size 181KB
SHA256 f8d629b55304ee3c3265f966f5b9d1bf4b5b95ed1353bd66029fcbf688e2926e
MD5 47d132f10e90ac008c5da854d14cd323
SHA1 d628810f38006715446c4373cc003432f28e1a45
SHA512 3bd0979f9e1035e7a847abe8f23750cc6384f5a36f3ad236897ae83ff5c2f545b537f6d291efc46c0268e4679ede092b0eac866b0f8871cc49770665c97b8bf7
SSDEEP 1536:VR+M4wxpL1FXWMlub/9uj14STGo5233YIbaaubMupdb3ib2ld2QaE1fuu+8uwc/7:6R583ib2ld2QaEy/Z/t/Pv
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_oxp0im5b.rap.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxp0im5b.rap.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

aria-debug-668.log

Path C:\Users\Admin\AppData\Local\Temp\aria-debug-668.log
Size 470B
SHA256 1cc09fe5e702caf413a18e3884a917e462cf0b43a4ce09f93115923a0e750367
MD5 faeb96b4c091316849ecb217336d5218
SHA1 72dfcbfeb7aabfdb50afc39b52e276e0fdc99947
SHA512 708fb8a537efa511d563a96e0980acbf637e4e5c590439537e3f65da72bb325628699b7800eee15da91313a69f973e9e7dd2e2db3eefa6612472a9b91bcde568
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 6KB
SHA256 ef1a7b6964ce167bb3a6cbe407e1fbb05a6b1d3c4fae26f9c4ab43777e350b7e
MD5 d7b97ace5d43127f2ad88bb6d000df66
SHA1 c60deac635a29c2e7e81ff6a998eeac439797f21
SHA512 0e408eca84251877543a62b76a0d3ce496a2043ed43f78baeec5248fa3478de005253281c7ce51981316a9c0a3b8227133f894ac774c0677ac7fca0ca98f5394
SSDEEP 96:xqrliqrlstGq7xkqqmQBYvK3cK3l2q/CTVquBXkYB4B4IovK26K2v0q+/oP:/z1k3NBOB6jqT8W6Ok5dP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 e8157a79433de5b676fb1d6da268933db6b32504634478ed8c75c27b60ccf5b1
MD5 ecd6f203ad9e6ead9c67e3eb4c9007ca
SHA1 a6f61b3de0628a86e8f3399c81a9b518a8b966ad
SHA512 8de647b1b9e32e441430c5b4455a5ed3c26ab61c8d50ea80ceffe22713d93f44dba10d4eec1f3d65ca31e3a61a0d048dae5d5a777d19833b5f9b1f31a0f23323
MD5 SHA1 SHA512

Submit Download

dd_vcredistMSI33E6.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI33E6.txt
Size 426KB
SHA256 17b6c9f58479344f26cfb4c0f8e158bc865942ae5c7303c86f26bfe809033df3
MD5 8b5de2f19abc636dd49e7e4e508118b7
SHA1 bdd6d20c83ab17fbe50ed2b85a0fd7b0887f72ce
SHA512 5a48bad6b111f2cdf67a9dcc781502624ffa82ae169bd80d12784540abfe9785cb8a571c23bca0c6c7e1c66d2d89f05a4cb2d274680cdda9ae2721142299e294
SSDEEP 1536:MKktLMfoOi1dFkxTi3e7+/C1C1bcFTv/N0mQrI3UB04nvs+6hpthZ6WZnvHt4l/k:MKSjjE5JrQs3E7EP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistMSI3407.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3407.txt
Size 414KB
SHA256 9b810d48ab16698d347accd29c79759d85739523bf0ba45ef38696ee1b8fe484
MD5 e68f72e692b0d432a241d8e588d128db
SHA1 ee8a6da56655428119b687a1bd1467ae1a74fd62
SHA512 4911f11460774050635d519032e2c9cb2ee214341867110c8145785c368c5d351f79de41e8cc5fe8cb12c168269b8239be8d1fea088f1db28c2ce39532f9680c
SSDEEP 1536:ofMgo5n7B1yav3uyeX8rOR/CqxEMGfjT8DjJXPLoew8DrYiGldZBpqG5HPHNIFzO:ofNQjIP0B24mpicOws
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI33E6.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI33E6.txt
Size 11KB
SHA256 09f84436d77965b80653c4e4f3169874002743d8dd4d331d9a4a19123439b103
MD5 a7e7d05d8ac6f214167c3a6c56d81cdb
SHA1 e4909a4ce5b69b273b3ac102bee155c2daf4f080
SHA512 9c318ff586d4de2db47d7bac2adb83d7090258415def96b13673e4c3778479ade1620002a29b2d5eb8c7192ebf9e4d5c85589d256f375cdb13d09676654002bc
SSDEEP 192:E7pSAlEj+YFTnbnzRnbnBMxq0EIqnbngDkT8VxR58ff:E7pSAlEj+YFTbtbBMxq0EIqbVwgff
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI3407.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3407.txt
Size 11KB
SHA256 b4aec0966b4606a00137ccd52c7309f63ff81aba57fa998c8dfa8e8c5a6fe1b4
MD5 295502a37244acde9bd221a87171cfbb
SHA1 4e0ce76dedc6c4769f8db00ddd4461543c4cb4d1
SHA512 2b5162cddc8f46f0142dedc259cc81d9b52a7d3263b2486bdd9b9680c46f1d63076b210f36a7a5405178a2851ec0e8742ad0c67e7dcdff4920fde1c9d1a94bae
SSDEEP 192:kbaQfydKcFYPq4hXn/nz1n/ntM1qwAMKntnMvg/8px9l8bf:kbaQfydKcFYPq4hX/J/tM1qwAMKtxUsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 162KB
SHA256 d219e55c013fcb52ceac30c3aaee1ea74f7a27fc82648a6eedea345bea91e057
MD5 6029fa218690fd7d5bee94e498e5d990
SHA1 12aa9337454d146c6896e881b2d1e5038af33269
SHA512 13563052109f5948b9df680bda4c6da393657af9ab10fd9c3b34905dda3c7c9372fdef2e024c85f458693753487c660cbe5221d7a0703ccaec056b260c28838a
SSDEEP 3072:a0htEnHPROY0KJ+L8Sfj0rMGDzxYYWxVOOOpt6K0Sios:56qqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 84109328f48832b2ee71cfe624a7af201e9ff174bdd6b0ded2016c4220c62d61
MD5 076237e2f23b176f524f66670b5a1733
SHA1 4e6c22107b83d64789e9f3c211b6f2e139b2539e
SHA512 696bc3e2499044d555125b4d5b49a113d813f24c8bc4667955c9be1157374a401ea3a5954e8958e3dfb97f2830b7378665174842da04e297e501f23e99aac655
MD5 SHA1 SHA512

Submit Download

wct3B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct3B4.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctCDDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\wctCDDF.tmp
Size 40.2MB
SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
MD5 fb4aa59c92c9b3263eb07e07b91568b5
SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
SSDEEP 786432:YMwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:YpQcWxDMPnN+dk65gGUjku4vNjLjw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 697B
SHA256 6e8bd512a6d794407aad2c0f6cd82350963abb5cc8d5c0ad47806bd2eabad42c
MD5 8976414ce8ce484277082101c5f1ba5b
SHA1 51128eb50385cbdab51d55a82ad932dcc4c68bac
SHA512 05ef0f750781bd3873a46e97dacb54dbc473402e8b7a3c88b0e2445d1e7b6f263e1334926c8d1ef5e9c1e10d6a0416d7acb9d2e3840a82fb87cdb320e13981d5
MD5 SHA1 SHA512

Submit Download

memory/1120-0-0x00007FFB476E3000-0x00007FFB476E5000-memory.dmp

Download

memory/1120-1-0x000002145CA50000-0x000002145CA72000-memory.dmp

Download

memory/1120-15-0x00007FFB476E0000-0x00007FFB481A1000-memory.dmp

Download

memory/1120-12-0x00007FFB476E0000-0x00007FFB481A1000-memory.dmp

Download

memory/1120-11-0x00007FFB476E0000-0x00007FFB481A1000-memory.dmp

Download

memory/1584-24-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-18-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-17-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-16-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-23-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-28-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-27-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-26-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-25-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download

memory/1584-22-0x0000019CCBA10000-0x0000019CCBA11000-memory.dmp

Download