Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 19:14
Behavioral task
behavioral1
Sample
02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe
-
Size
204KB
-
MD5
fc71a7b675005fc4b3cf9c5606b42f8f
-
SHA1
087ad97ce0975ef83d298c061224faaf553090e7
-
SHA256
02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9
-
SHA512
e51dee5cc7aed2244506838757dfb4733471b28542d7083f0abacec05905e82aaba9951cdeadeaa6f8aa92e0b05ec1928382aa00f86ee7fcaa431ce407f22781
-
SSDEEP
768:LlvMajCJX9wWQwbjMPkG1VuW/wqvRXMXp677yCzdXZRT2Nq1MaQnepMri14PGBEu:LRlmJtwWFlGVs4emEFb3P0lp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gaoye.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe -
Executes dropped EXE 1 IoCs
pid Process 4548 gaoye.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /k" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /a" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /m" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /f" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /W" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /F" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /P" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /H" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /Z" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /y" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /i" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /b" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /z" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /t" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /J" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /O" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /X" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /R" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /M" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /s" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /N" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /w" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /U" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /D" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /o" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /h" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /K" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /g" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /V" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /u" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /c" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /I" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /e" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /q" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /j" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /n" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /r" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /A" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /Q" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /C" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /Y" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /L" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /x" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /v" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /l" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /E" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /T" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /G" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /p" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /B" gaoye.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaoye = "C:\\Users\\Admin\\gaoye.exe /S" gaoye.exe -
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral2/files/0x000d000000023a68-7.dat upx behavioral2/memory/4548-34-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral2/memory/1828-37-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral2/memory/4548-38-0x0000000000400000-0x0000000000443000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gaoye.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe 4548 gaoye.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1828 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe 4548 gaoye.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1828 wrote to memory of 4548 1828 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe 84 PID 1828 wrote to memory of 4548 1828 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe 84 PID 1828 wrote to memory of 4548 1828 02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe 84 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83 PID 4548 wrote to memory of 1828 4548 gaoye.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe"C:\Users\Admin\AppData\Local\Temp\02d4b06808df5436a3d5e981abbc46b17b95f37a54c9740783a30f9426296ef9.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\gaoye.exe"C:\Users\Admin\gaoye.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5a0e80d6ab58cb738706a35dfc65a52e3
SHA1fa49b159f405f59cd508acb1ac2a40be3d40d8e1
SHA256e1b584b98b0f5e730572a71cae03ae6ca7accdbc15eb451efbc60b377c9af8a5
SHA5125f8089ca28f6da4cbe81783858c3ad5c5b98cd4c7058103b1462d5a98c4d4d060fa2d00eeb97f088b692b77a219fe42b29731d75104fdafa8248cfe6ded0dc0b