61c1c11c4054e61ab9fa8777caeaf9c84821ad1b7e773e4bc8b5d844d90e8c7d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lets20Compress.exe
Size

16.8MB
MD5

c34118d64ca94041f56cbeba5daf9abd
SHA1

14ef602cc6ea87ac0f961fc3dac25a4e56923e00
SHA256

61c1c11c4054e61ab9fa8777caeaf9c84821ad1b7e773e4bc8b5d844d90e8c7d
SHA512

ca6878539c9e4f590f628785794ee1fe7c0f0cb8148ef0657e57de33d37595439731b299a42008a6fc6cb282da6cca97adc48f9e52ca083d171568a9f1f3d150
SSDEEP

393216:neTuAoAu6yJEULuZmyGdM90bq/5H7hifJJ8fM:nAJZcEUSG40bY1ihJ8U

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 21 IoCs

pid	Process
828	Lets20Compress.exe
828	Lets20Compress.exe
788	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1636	MsiExec.exe
1636	MsiExec.exe
828	Lets20Compress.exe
1636	MsiExec.exe
1236	msiexec.exe
1636	MsiExec.exe
1108	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	1980	msiexec.exe
7	1236	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	Lets20Compress.exe
File opened (read-only)	\??\Q:	Lets20Compress.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	Lets20Compress.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	Lets20Compress.exe
File opened (read-only)	\??\P:	Lets20Compress.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	Lets20Compress.exe
File opened (read-only)	\??\T:	Lets20Compress.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	Lets20Compress.exe
File opened (read-only)	\??\S:	Lets20Compress.exe
File opened (read-only)	\??\W:	Lets20Compress.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	Lets20Compress.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	Lets20Compress.exe
File opened (read-only)	\??\H:	Lets20Compress.exe
File opened (read-only)	\??\I:	Lets20Compress.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	Lets20Compress.exe
File opened (read-only)	\??\Z:	Lets20Compress.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	Lets20Compress.exe
File opened (read-only)	\??\V:	Lets20Compress.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	Lets20Compress.exe
File opened (read-only)	\??\R:	Lets20Compress.exe
File opened (read-only)	\??\X:	Lets20Compress.exe
File opened (read-only)	\??\Y:	Lets20Compress.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6324.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BFF.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f776087.msi	msiexec.exe
File created	C:\Windows\Installer\f776088.ipi	msiexec.exe
File created	C:\Windows\Installer\f77608a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f776088.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6248.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f776087.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68DF.tmp	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe
2504	powershell.exe
2100	powershell.exe
2736	powershell.exe
2760	powershell.exe
908	powershell.exe
2740	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lets20Compress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Lets20Compress.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Lets20Compress.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Lets20Compress.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Lets20Compress.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2028	powershell.exe
2504	powershell.exe
2100	powershell.exe
2736	powershell.exe
2760	powershell.exe
1236	msiexec.exe
1236	msiexec.exe
908	powershell.exe
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1236	msiexec.exe
Token: SeTakeOwnershipPrivilege	1236	msiexec.exe
Token: SeSecurityPrivilege	1236	msiexec.exe
Token: SeCreateTokenPrivilege	828	Lets20Compress.exe
Token: SeAssignPrimaryTokenPrivilege	828	Lets20Compress.exe
Token: SeLockMemoryPrivilege	828	Lets20Compress.exe
Token: SeIncreaseQuotaPrivilege	828	Lets20Compress.exe
Token: SeMachineAccountPrivilege	828	Lets20Compress.exe
Token: SeTcbPrivilege	828	Lets20Compress.exe
Token: SeSecurityPrivilege	828	Lets20Compress.exe
Token: SeTakeOwnershipPrivilege	828	Lets20Compress.exe
Token: SeLoadDriverPrivilege	828	Lets20Compress.exe
Token: SeSystemProfilePrivilege	828	Lets20Compress.exe
Token: SeSystemtimePrivilege	828	Lets20Compress.exe
Token: SeProfSingleProcessPrivilege	828	Lets20Compress.exe
Token: SeIncBasePriorityPrivilege	828	Lets20Compress.exe
Token: SeCreatePagefilePrivilege	828	Lets20Compress.exe
Token: SeCreatePermanentPrivilege	828	Lets20Compress.exe
Token: SeBackupPrivilege	828	Lets20Compress.exe
Token: SeRestorePrivilege	828	Lets20Compress.exe
Token: SeShutdownPrivilege	828	Lets20Compress.exe
Token: SeDebugPrivilege	828	Lets20Compress.exe
Token: SeAuditPrivilege	828	Lets20Compress.exe
Token: SeSystemEnvironmentPrivilege	828	Lets20Compress.exe
Token: SeChangeNotifyPrivilege	828	Lets20Compress.exe
Token: SeRemoteShutdownPrivilege	828	Lets20Compress.exe
Token: SeUndockPrivilege	828	Lets20Compress.exe
Token: SeSyncAgentPrivilege	828	Lets20Compress.exe
Token: SeEnableDelegationPrivilege	828	Lets20Compress.exe
Token: SeManageVolumePrivilege	828	Lets20Compress.exe
Token: SeImpersonatePrivilege	828	Lets20Compress.exe
Token: SeCreateGlobalPrivilege	828	Lets20Compress.exe
Token: SeCreateTokenPrivilege	828	Lets20Compress.exe
Token: SeAssignPrimaryTokenPrivilege	828	Lets20Compress.exe
Token: SeLockMemoryPrivilege	828	Lets20Compress.exe
Token: SeIncreaseQuotaPrivilege	828	Lets20Compress.exe
Token: SeMachineAccountPrivilege	828	Lets20Compress.exe
Token: SeTcbPrivilege	828	Lets20Compress.exe
Token: SeSecurityPrivilege	828	Lets20Compress.exe
Token: SeTakeOwnershipPrivilege	828	Lets20Compress.exe
Token: SeLoadDriverPrivilege	828	Lets20Compress.exe
Token: SeSystemProfilePrivilege	828	Lets20Compress.exe
Token: SeSystemtimePrivilege	828	Lets20Compress.exe
Token: SeProfSingleProcessPrivilege	828	Lets20Compress.exe
Token: SeIncBasePriorityPrivilege	828	Lets20Compress.exe
Token: SeCreatePagefilePrivilege	828	Lets20Compress.exe
Token: SeCreatePermanentPrivilege	828	Lets20Compress.exe
Token: SeBackupPrivilege	828	Lets20Compress.exe
Token: SeRestorePrivilege	828	Lets20Compress.exe
Token: SeShutdownPrivilege	828	Lets20Compress.exe
Token: SeDebugPrivilege	828	Lets20Compress.exe
Token: SeAuditPrivilege	828	Lets20Compress.exe
Token: SeSystemEnvironmentPrivilege	828	Lets20Compress.exe
Token: SeChangeNotifyPrivilege	828	Lets20Compress.exe
Token: SeRemoteShutdownPrivilege	828	Lets20Compress.exe
Token: SeUndockPrivilege	828	Lets20Compress.exe
Token: SeSyncAgentPrivilege	828	Lets20Compress.exe
Token: SeEnableDelegationPrivilege	828	Lets20Compress.exe
Token: SeManageVolumePrivilege	828	Lets20Compress.exe
Token: SeImpersonatePrivilege	828	Lets20Compress.exe
Token: SeCreateGlobalPrivilege	828	Lets20Compress.exe
Token: SeCreateTokenPrivilege	828	Lets20Compress.exe
Token: SeAssignPrimaryTokenPrivilege	828	Lets20Compress.exe
Token: SeLockMemoryPrivilege	828	Lets20Compress.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
828	Lets20Compress.exe
1980	msiexec.exe
1980	msiexec.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 1236 wrote to memory of 788	1236	msiexec.exe	32
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 828 wrote to memory of 1980	828	Lets20Compress.exe	33
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1236 wrote to memory of 1108	1236	msiexec.exe	34
PID 1108 wrote to memory of 2028	1108	MsiExec.exe	35
PID 1108 wrote to memory of 2028	1108	MsiExec.exe	35
PID 1108 wrote to memory of 2028	1108	MsiExec.exe	35
PID 1108 wrote to memory of 2028	1108	MsiExec.exe	35
PID 1108 wrote to memory of 2504	1108	MsiExec.exe	37
PID 1108 wrote to memory of 2504	1108	MsiExec.exe	37
PID 1108 wrote to memory of 2504	1108	MsiExec.exe	37
PID 1108 wrote to memory of 2504	1108	MsiExec.exe	37
PID 1108 wrote to memory of 2100	1108	MsiExec.exe	39
PID 1108 wrote to memory of 2100	1108	MsiExec.exe	39
PID 1108 wrote to memory of 2100	1108	MsiExec.exe	39
PID 1108 wrote to memory of 2100	1108	MsiExec.exe	39
PID 1108 wrote to memory of 2736	1108	MsiExec.exe	41
PID 1108 wrote to memory of 2736	1108	MsiExec.exe	41
PID 1108 wrote to memory of 2736	1108	MsiExec.exe	41
PID 1108 wrote to memory of 2736	1108	MsiExec.exe	41
PID 1108 wrote to memory of 2760	1108	MsiExec.exe	43
PID 1108 wrote to memory of 2760	1108	MsiExec.exe	43
PID 1108 wrote to memory of 2760	1108	MsiExec.exe	43
PID 1108 wrote to memory of 2760	1108	MsiExec.exe	43
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1236 wrote to memory of 1636	1236	msiexec.exe	48
PID 1636 wrote to memory of 908	1636	MsiExec.exe	49
PID 1636 wrote to memory of 908	1636	MsiExec.exe	49
PID 1636 wrote to memory of 908	1636	MsiExec.exe	49
PID 1636 wrote to memory of 908	1636	MsiExec.exe	49
PID 1108 wrote to memory of 2740	1108	MsiExec.exe	52
PID 1108 wrote to memory of 2740	1108	MsiExec.exe	52
PID 1108 wrote to memory of 2740	1108	MsiExec.exe	52
PID 1108 wrote to memory of 2740	1108	MsiExec.exe	52

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Lets20Compress.exe
"C:\Users\Admin\AppData\Local\Temp\Lets20Compress.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\Let's Compress 06052024.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Lets20Compress.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731854142 "
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:1980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33DF22C486008124D9B6F4DC6327744D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91FC2776A12729CE5F96E1B2A5AF8CD7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssDEAF.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiDEAC.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrDEAD.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrDEAE.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssF09E.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiF07C.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrF07D.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrF07E.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8E4.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi8E1.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr8E2.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8E3.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2168.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi2155.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr2156.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr2157.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss39AE.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi39AB.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr39AC.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr39AD.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8321.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi830E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr830F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8310.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DD0A4FCDBDF29499851C6F35EF4854E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6C0F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi6BFC.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr6BFD.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr6BFE.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:824

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D8" "00000000000005AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f776089.rbs

Filesize
21KB

MD5
b80afd7cca5c3cc67ae05223234eb862

SHA1
5280c2092f0377e3d88fc5a470e78f23515b613f

SHA256
96a27754b3fcc3e04050d5782bb186184ef8770837c10e5834d5355c419e7321

SHA512
8b98b43d9ace3849d7d3fe808180ed5f0715101bffacf6b766da560dabe6a72187d5bdcc3b8955356dcf4842a407e12501f932c4603598cc290ee5bbd8d5c046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
978e265df087de6c5fd6a26576ff821b

SHA1
f1cc8edb1b7b605a48c16f67a58cecb98c903d49

SHA256
e8bc0899d376cffcaf2cfa0c36883865b28c0efe382f7ff2c15265fa587e017d

SHA512
d9cdc054746b5714f46537680cce487e785afc33273459c4a6ae79974b0bcd5798edb3b390833d4f53311020ccc49118149e7cea4a911b26752b170c093ad34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c3a69091227562b7ee58736c0050fb9

SHA1
b11692ee8229d5aeadebf800fa58d9891943d726

SHA256
bde7683fc3521ea2aad71e15cd89a77fd4721557b4597790b338ff2932712400

SHA512
bd5addb484bdf11e9757972e614e16cc5d2c1d5d87691bb670c9a6bacec0464a89ab1bfbb64ebe5bb200b4f0fa929b1c4cede650bebd3778794968daaf6fb020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Filesize
264B

MD5
075aadc1a9f4749665658df96671011f

SHA1
49c2ce53d223f046667db2fce4aa143ea3570648

SHA256
b65d467fb5aa9ebb857a88bb0dcde4a623f6fb8afa18b3101518054766402b13

SHA512
4d8171774c2f3d444e0b881a0c26eb51cd4fd79959ce28dacdc12e1bf9a2b6ad9f989a357a983b7a522b28ba900e675bdae08e830e677351ac47bcf4c2def89e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID961.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDE8F.tmp

Filesize
670KB

MD5
846afe3ed676561d5f2cb293177f6c03

SHA1
bd31e948dca976ab54f8a01b87cbd6920659dc92

SHA256
d3f27a9fb0862de63db0e05de28a02c7913139c10440e0b9bff25c76a90806ed

SHA512
e5c10552930223fc818f5e973de482e0d9664defa3771be208be05dd944bef2ae279285a14ac0278ff4cc9d7384e4811e46434018dde314d6150855d9238457e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pro2169.tmp

Filesize
252B

MD5
af02dd78879e5c4ea20ca577de8e3d02

SHA1
d498285ed56cf306ec684a906a05a19f3601b04c

SHA256
38f361cd8ca0ed9c8ff378e12d49657c5790cc54e2d19e1bdd2e78e2f6b009fe

SHA512
bafb145a2678a032639e45471e8196b986ca31d06e0b5af5ab55027517125a1d0edd96d8c1f6945b4fcf71bd8b4d3af40ca7400d83edfa361af337ee3161a3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD770.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msiF07C.txt

Filesize
202B

MD5
dc0deabc7403be926e4388180d04c50e

SHA1
1b8b9320419c3164ae1491587061d2632ff73cec

SHA256
884dcb3a49831d2fe08e9c6190b4821a927e5a327d0d73f6aef7cbbf6f448fc0

SHA512
681d991009e83844f75b9ffede5180650995acdfd935556705e8594385d3cac4109efaf4924d889e89f22cc7ac708c8f1a22ccdfbbb7baa083cf458833f9b4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss2168.ps1

Filesize
35KB

MD5
1771da38a05dbc54dedba7bb06b0c719

SHA1
9582f4cd02f7c17a4f30af5bb1ba94e3fc8df727

SHA256
e983eba5229fd09430d942005b6873aceb7910ce5378ca2ee5991be0f8905028

SHA512
92adec8d4837c4792f04a2c079b42a973da0a1d36da5846dbd4c24ed7286369623f16d753190c5deae945349e5b2c21b77b2a59d69d814d1b75ddc699e306aff

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss39AE.ps1

Filesize
35KB

MD5
4a5e7ccc783aca1dadaf19400bb30243

SHA1
a65e5cab0569abe833b0201ebbc381753501a247

SHA256
d5660753ec720c3761c2df95279968257abed016b4aa890cb858a577cb8d5954

SHA512
b3e53c2ebc7f0ff8019e5afc1cd724143f1c3718a5a98c65b51da9666a3059c4836b950a9c438d45c68f8e731f4b3de27246bc22f45dd46593455ccdaa1dd931

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss8E4.ps1

Filesize
35KB

MD5
0791096e8b998a86a3a8d11256244059

SHA1
b38c9b06c02738db0182e806d766370ae5439362

SHA256
975cd5eb18dee3067e12bf7a0609ab53b3bb1e68c48337647b3112e20f9fb8e3

SHA512
5f6c7bcf95dc71d732c3bc89e37ca94795962715f8fe2d183e23f07215cf018c6a56d01dab2deab1707898385b3dc9f1b56281096132d5b927a1260b6b7ee3ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssDEAF.ps1

Filesize
5KB

MD5
8f69da7a9f4b3c2d0f423583b262ed49

SHA1
b6d2ceb18fe78d279f76f412e4660bff5f6a88c7

SHA256
dc6b6e1812f41c80ee67a72ebcb7a999488c866d805354936fb7506667005b43

SHA512
71782d54137e87ec8d4311adf83b9b269aadfcba55b753ce8562d0fe74cc95f00118b01f3139b8ff0a142156d6461bececfc38380e9acd0c117b2fff0e846edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssF09E.ps1

Filesize
35KB

MD5
921c1530f468a03721ad3b5778ff21c4

SHA1
92ec47a71e3a5dfcf4afef6a04087b50451ae46c

SHA256
c1fc70194720b6984284845817d40e54d51588156a0cc6a49fe888c1bba9bf0f

SHA512
90d33523b37014c3224312ae5a29c769eeb9505faa79e5fc286187916c8cc0e18a44c09a3b671a77972d97c473598039289764ef4beed3450b5691ebad1fd559

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr2156.ps1

Filesize
30KB

MD5
849c1e53d083ba3303ffb0e452d5a3ba

SHA1
636df73cdc17565438fdcc1c83f412707ec6ac7b

SHA256
ed1db5eac86be404d164953f67c0fe49e1dbe773fcea1306a388ba9a69bde454

SHA512
045d22dd1a960705612b7c1c54e98dfa63e6bc47902cd21e71b911a49895f0b08540323f249c18cae152033032de83e0ba955ea21d4193899136811111c1d3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr39AC.ps1

Filesize
30KB

MD5
0aeaffae4dfae7a6881f9c4ebf793fff

SHA1
ce85584d4e97649681256f76b9fad523ab943eb6

SHA256
456620d70528f746a9d7f4dfe6de0a17b33b4f18606fb71a7dbcd2f275c63dd2

SHA512
0e10bff3cb045ec46ffe90b60579654970ccdfb1e333aa3372f8601bf5a8941587408b5249ba14680c4beb9e8f48f7b54db9fe85c580fd9ecaabaa4f96b3d8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr8E2.ps1

Filesize
30KB

MD5
32a9a87385259b48bb0e1abd4208047b

SHA1
ccbbb91ba87b695cd1a8f9d3e41e617c41d17d0e

SHA256
bd9de559cbc14abbd1be0f514137a908e557eacd53b660f117bbf8cae05c0988

SHA512
3ed049eef080021a4b6f4e40ee08e1ab5c8bc0a4b209bd2e96431db0b9f0c18627ec98603da93915927df9dfd4876944786c280181c39609c0e42947048df132

Download Submit
C:\Users\Admin\AppData\Local\Temp\scrDEAD.ps1

Filesize
1KB

MD5
112071ff00de034a6d5a4738d0112015

SHA1
f4dadedefebb237a3da3a8d38fe7cd1890f5e999

SHA256
caeff8215d14706bb3de55f6fe8811f22ae36bde28a619f48480596ab93514e4

SHA512
a784445f14a20d5ff5cff5afc7f3bf2cc8a11dd752a728e3d09ff10282954eb0018d90ebd621b98a07ca8e022adbe63643c11a7e72455ce6b899c1d605016dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\scrF07D.ps1

Filesize
30KB

MD5
293c08e42d131f47adcb654164db8691

SHA1
b621e8a63a9dd801cb669e5ba11bb04f0de5407a

SHA256
83a430db3c56e3637873f292b90cb4e643479ee9d8fff8f4f00b40e9ebd3f606

SHA512
9d8f9d9896badb302ced635e658ef899fed4e1dfedaf14af075691e50f2682e25b27ae8d7210eb4129ea244335e55202d82d7e727cca5ea15293f06e1e4620e7

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\Let's Compress 06052024.msi

Filesize
2.9MB

MD5
6e0a0b2f7c7ecd3556ec495aedc3d2c3

SHA1
13e1b312e594a1b35602391e32334080dee68eaa

SHA256
f1fe9acd58595bc3c85275ac9ba790c7bee2e5d00c8e5b42298f77af00ed7e0e

SHA512
9513eea25c77bfa01eddb918c87234a9e1cf2fc753ff6078ea040408c7978519f896110a4b8446b3075f9390b6662bbd2a7fb794e064142006dc8238427f670b

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_ar.qm

Filesize
156KB

MD5
ced94831acb03de85d682ef997425446

SHA1
bdcb654b0b665e7e222343b24224c5e1620292ba

SHA256
eb09d3211567f7a0419738a8b29c8f8dffd33a72cc7826f8a06b04dd63e7b80d

SHA512
7731afa705de33543d0db78ae8a2b1368977abac302a005733be861b80f8f23acccb94c106d7f7006299689c506ea861877100647968d264225ce9c3d804b37e

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_bg.qm

Filesize
230KB

MD5
afd63ee60ec8c618477962f5bf4a211f

SHA1
c77088f5832e81ce5d6d5b1e695b1c90471a7b96

SHA256
3c466e21df3b04188c77b4712cc068fc1ed3fa4ae87c133c0848e91abdf7cf1f

SHA512
5a2176bee420e90ec25fb0606c1efb7b44480af3ba587ce10e8071afd820c32b62b723dd466c36126809258bea081d4a0721e2dc0d4633dc14fdf9cc612950d1

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_ca.qm

Filesize
305KB

MD5
60ff1719cc1a153cb34585d3a1877a12

SHA1
bb05d5ac1c6119c29aec3e00bd45bc153e962950

SHA256
37381da435021c876f78e9bdaab804f1fd7cfcd58167dd2ee8715c1fc314a682

SHA512
54fb126b2c253af24497f5830a826cae843c5d900eb6bf0bf9ab48d78e4e96919333e689398eaa6671d544b37f221af601db32dd589982169fffc09616828db5

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_cs.qm

Filesize
170KB

MD5
c57d0de9d8458a5beb2114e47b0fde47

SHA1
3a0e777539c51bb65ee76b8e1d8dce4386cbc886

SHA256
03028b42df5479270371e4c3bdc7df2f56cbbe6dda956a2864ac6f6415861fe8

SHA512
f7970c132064407752c3d42705376fe04facafd2cfe1021e615182555f7ba82e7970edf5d14359f9d5ca69d4d570aa9ddc46d48ce787cff13d305341a3e4af79

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_da.qm

Filesize
245KB

MD5
322149590d208bf86e762d282bca89a1

SHA1
662ec905d188b49d4116f249d363f904a53c15f0

SHA256
7ae318be007b0525f3d34f019f81840b98c34fdbdd3660aaa59d3828bf733368

SHA512
2708c30603d39e6c77ddba4264f53c02d5b5d160cc9217e90ce1774a441f7ee55284c7fbab5d6ae5581e39540aa73dfc8eda58192b8c417c998485c9827db2be

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\DC99C02\translations\qt_de.qm

Filesize
327KB

MD5
01c1cce1167663af72d1395039ac85cb

SHA1
64b238ed85f848b0df72d855830428ae52cd7939

SHA256
2897f258008c81e0cc442372e3fb6d2858df468d343272ba2d628474a3043a35

SHA512
6fb2b97699baf04ff5ead52633f063297934a1252a265d4252d9937d889cc6fc5930888fc14e4324819e6d423b4b392b54acfd134d6f2b46399aaae82e293cb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
004cceb7bed9cfb5e3c69052b062df70

SHA1
5f8cd59bdaa82761a3c08c687567a921b85f8f13

SHA256
baf25dbba1f0d14087b10cc00e5dbc6925d4b9e773be598bbd445b7af17b5433

SHA512
5f8dfea2ea1a8089f4e16caa39320d1d339ec050a88f0a8db092b395d85ae523ab5a60f8680ea5c02d03c1c8979bd3fe82d6524d238f6c5e13412dded57d0e65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
be5ce8df6cca8277b19ffd0d9c25a01a

SHA1
d6041e24e50f98b8c96e352ee3597c297099db4a

SHA256
d00fb7f8bc65729f95d1205e4a3c9b5854e06b5f031806082e404c36b1da7d5a

SHA512
6918717cc52583bac9a9075140320e5c6235f655b01620f4ec8b5ee30118cea8152ed15e3b18a4b26380f160432f9784430cffb6ce87435918b7b761ff11ea10

Download Submit
C:\Windows\Installer\MSI6324.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 2.3.26.0\install\decoder.dll

Filesize
206KB

MD5
9d45f2790dda55df2d99ef66dcb2019d

SHA1
f2a369c1b82476e2e0641f95394dd4dee8223f01

SHA256
9b7ff49f7e1d0a39826ec458c8004b20a65a4bd0592b083f38b01e2dbc2b510f

SHA512
9bef561ec6908dcd7e75f5f63cff8b1ec73e9be2b4e4aa5602182cde18d691cc28259b980c87246c5d27b4284bc783fba44d92a202f77b15f3e65c89dd3aa069

Download Submit
memory/828-0-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/828-219-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download