Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10-18-19-14.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-01-10-18-19-14.exe
-
Size
74KB
-
MD5
2536196d167ace8223ae7453964efc43
-
SHA1
56299f1745c8ec79d0208b14d10eb744d927b70e
-
SHA256
f9cd798df715647337e56cedf49fcf778ed456d82f4a39114830e6de52568696
-
SHA512
625b771cdda5f60569657c6c347dc22deda3cc545f783f212a6a48a6d4c013d65e18b67ec8124e6e58fe84f80d511a4ce29bc657d94911b13e30fbc86da6aa5c
-
SSDEEP
1536:l09hsM7RYzLo4DsZSICu4My9mGm51dU0tppsOuVggs0Rh69:lCD7RcjDs0ICuesGodXXM3R
Malware Config
Extracted
xworm
trip-thesaurus.gl.at.ply.gg:16715
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023c77-4.dat family_xworm behavioral1/memory/2300-12-0x00000000007D0000-0x00000000007E8000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3728 powershell.exe 1624 powershell.exe 1704 powershell.exe 4864 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-01-10-18-19-14.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-01-10-18-19-14.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-01-10-18-19-14.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk 2024-01-10-18-19-14.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk 2024-01-10-18-19-14.exe -
Executes dropped EXE 4 IoCs
pid Process 2300 2024-01-10-18-19-14.exe 2580 SecurityHealthSystray 3652 SecurityHealthSystray 3568 2024-01-10-18-19-14.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSystray" 2024-01-10-18-19-14.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\2024-01-10-18-19-14.exe 2024-01-10-18-19-14.exe File created C:\Windows\2024-01-10-18-19-14.exe 2024-01-10-18-19-14.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-01-10-18-19-14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-01-10-18-19-14.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4148 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2300 2024-01-10-18-19-14.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 powershell.exe 2588 powershell.exe 1624 powershell.exe 1624 powershell.exe 1704 powershell.exe 1704 powershell.exe 4864 powershell.exe 4864 powershell.exe 3728 powershell.exe 3728 powershell.exe 2300 2024-01-10-18-19-14.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2300 2024-01-10-18-19-14.exe 2300 2024-01-10-18-19-14.exe 2300 2024-01-10-18-19-14.exe 2300 2024-01-10-18-19-14.exe 2300 2024-01-10-18-19-14.exe 2300 2024-01-10-18-19-14.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2924 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2300 2024-01-10-18-19-14.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 3728 powershell.exe Token: SeDebugPrivilege 2300 2024-01-10-18-19-14.exe Token: SeDebugPrivilege 2924 taskmgr.exe Token: SeSystemProfilePrivilege 2924 taskmgr.exe Token: SeCreateGlobalPrivilege 2924 taskmgr.exe Token: SeDebugPrivilege 2580 SecurityHealthSystray Token: SeDebugPrivilege 3652 SecurityHealthSystray Token: SeDebugPrivilege 3568 2024-01-10-18-19-14.exe Token: SeDebugPrivilege 3524 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe 2924 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2300 2024-01-10-18-19-14.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2588 2272 2024-01-10-18-19-14.exe 83 PID 2272 wrote to memory of 2588 2272 2024-01-10-18-19-14.exe 83 PID 2272 wrote to memory of 2588 2272 2024-01-10-18-19-14.exe 83 PID 2272 wrote to memory of 2300 2272 2024-01-10-18-19-14.exe 85 PID 2272 wrote to memory of 2300 2272 2024-01-10-18-19-14.exe 85 PID 2300 wrote to memory of 1624 2300 2024-01-10-18-19-14.exe 88 PID 2300 wrote to memory of 1624 2300 2024-01-10-18-19-14.exe 88 PID 2300 wrote to memory of 1704 2300 2024-01-10-18-19-14.exe 90 PID 2300 wrote to memory of 1704 2300 2024-01-10-18-19-14.exe 90 PID 2300 wrote to memory of 4864 2300 2024-01-10-18-19-14.exe 92 PID 2300 wrote to memory of 4864 2300 2024-01-10-18-19-14.exe 92 PID 2300 wrote to memory of 3728 2300 2024-01-10-18-19-14.exe 94 PID 2300 wrote to memory of 3728 2300 2024-01-10-18-19-14.exe 94 PID 2300 wrote to memory of 4148 2300 2024-01-10-18-19-14.exe 97 PID 2300 wrote to memory of 4148 2300 2024-01-10-18-19-14.exe 97 PID 2300 wrote to memory of 4180 2300 2024-01-10-18-19-14.exe 115 PID 2300 wrote to memory of 4180 2300 2024-01-10-18-19-14.exe 115 PID 2300 wrote to memory of 4068 2300 2024-01-10-18-19-14.exe 122 PID 2300 wrote to memory of 4068 2300 2024-01-10-18-19-14.exe 122 PID 4068 wrote to memory of 1500 4068 cmd.exe 124 PID 4068 wrote to memory of 1500 4068 cmd.exe 124 PID 4068 wrote to memory of 1500 4068 cmd.exe 124 PID 1500 wrote to memory of 3524 1500 2024-01-10-18-19-14.exe 125 PID 1500 wrote to memory of 3524 1500 2024-01-10-18-19-14.exe 125 PID 1500 wrote to memory of 3524 1500 2024-01-10-18-19-14.exe 125 PID 1500 wrote to memory of 3568 1500 2024-01-10-18-19-14.exe 127 PID 1500 wrote to memory of 3568 1500 2024-01-10-18-19-14.exe 127 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAaAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAaAB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAaABqACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\2024-01-10-18-19-14.exe"C:\Windows\2024-01-10-18-19-14.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\2024-01-10-18-19-14.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2024-01-10-18-19-14.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4148
-
-
C:\Windows\SYSTEM32\CMD.EXE"CMD.EXE"3⤵PID:4180
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10-18-19-14.exe"4⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAaAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAaAB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAaABqACMAPgA="5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\2024-01-10-18-19-14.exe"C:\Windows\2024-01-10-18-19-14.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924
-
C:\Users\Admin\AppData\Roaming\SecurityHealthSystrayC:\Users\Admin\AppData\Roaming\SecurityHealthSystray1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
C:\Users\Admin\AppData\Roaming\SecurityHealthSystrayC:\Users\Admin\AppData\Roaming\SecurityHealthSystray1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
944B
MD59b80cd7a712469a4c45fec564313d9eb
SHA16125c01bc10d204ca36ad1110afe714678655f2d
SHA2565a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
SHA512ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584
-
Filesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
18KB
MD5070dbd3d163d4be78a79266b7dfe091f
SHA1667e8d8f0a6744f04a4d230d4e7b9838c2c35bb2
SHA2562e929eb1246dd09fb3deef36e3d3c4241f6139160b4974acbb34f1d6216e0e65
SHA5128966bda3e87d2ef763c8dad55af809df84de1ecc1530fb6989bd05f02563d40f53f1e88ceb5998cd70812787b77c50c58d6dc07857a8f8a623a543c3d7a718e4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk
Filesize819B
MD59c0b3412fe75b2506c59f0a950363da1
SHA144f9dd56d69223387809007c71f194263f7e0168
SHA25607def7d902fe9d8a46bcc3bf804a7610c57f3fd7de573e599da1e018f07f3a3c
SHA512b75f844e0cdd139c52f5a29ecd883d3b9f7b250fd00248544ff6536c78c7f3e36a34ff1942ca0096206afc37a1e558f4285061677e9d44b53f5efd394f56cb62
-
Filesize
68KB
MD50c8294e9d43eab4f86105d4c92afbfa0
SHA1338416be49b72459690d9bc8e5d0da66dae8ffd5
SHA25655b9e348d510dcaeb9ac6d33eb7d4057cbfe186feb3ce476eb26935db1fd393d
SHA512f24cd690851ce0a2dff4c009ebc87d8072c6ad76cfaa5ff16fa318af87887fbc623fdfe26b141b4c1c7ab8f911bbae503b7514fb8ef5229f5579b5a5106be491