Resubmissions
06/05/2026, 21:07
260506-zyd1taez3m706/05/2026, 21:01
260506-zt2w3sey5j706/05/2026, 20:55
260506-zqg3haex3q706/05/2026, 20:43
260506-zhktesev2k7Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lock.Julie.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lock.Julie.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target Lock.Julie.exe
- Size 5.9MB
- Sample260506-zhktesev2k
- SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
- MD5 e2ac9e24dce3e923bfe2526f7e4681b7
- SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
- SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
- SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
- TLSH T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1828 SyncService.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\"" Lock.Julie.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\"" Lock.Julie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\"" SyncService.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\"" SyncService.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat" Lock.Julie.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat" SyncService.exe - Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\WallpaperStyle = "3" Lock.Julie.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\TileWallpaper = "0" Lock.Julie.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\WallpaperStyle = "3" SyncService.exe Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\TileWallpaper = "0" SyncService.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4424 Lock.Julie.exe 1828 SyncService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4424 Lock.Julie.exe Token: SeIncreaseQuotaPrivilege 4424 Lock.Julie.exe Token: SeSecurityPrivilege 4424 Lock.Julie.exe Token: SeTakeOwnershipPrivilege 4424 Lock.Julie.exe Token: SeLoadDriverPrivilege 4424 Lock.Julie.exe Token: SeSystemProfilePrivilege 4424 Lock.Julie.exe Token: SeSystemtimePrivilege 4424 Lock.Julie.exe Token: SeProfSingleProcessPrivilege 4424 Lock.Julie.exe Token: SeIncBasePriorityPrivilege 4424 Lock.Julie.exe Token: SeCreatePagefilePrivilege 4424 Lock.Julie.exe Token: SeBackupPrivilege 4424 Lock.Julie.exe Token: SeRestorePrivilege 4424 Lock.Julie.exe Token: SeShutdownPrivilege 4424 Lock.Julie.exe Token: SeDebugPrivilege 4424 Lock.Julie.exe Token: SeSystemEnvironmentPrivilege 4424 Lock.Julie.exe Token: SeRemoteShutdownPrivilege 4424 Lock.Julie.exe Token: SeUndockPrivilege 4424 Lock.Julie.exe Token: SeManageVolumePrivilege 4424 Lock.Julie.exe Token: 33 4424 Lock.Julie.exe Token: 34 4424 Lock.Julie.exe Token: 35 4424 Lock.Julie.exe Token: 36 4424 Lock.Julie.exe Token: SeIncreaseQuotaPrivilege 4424 Lock.Julie.exe Token: SeSecurityPrivilege 4424 Lock.Julie.exe Token: SeTakeOwnershipPrivilege 4424 Lock.Julie.exe Token: SeLoadDriverPrivilege 4424 Lock.Julie.exe Token: SeSystemProfilePrivilege 4424 Lock.Julie.exe Token: SeSystemtimePrivilege 4424 Lock.Julie.exe Token: SeProfSingleProcessPrivilege 4424 Lock.Julie.exe Token: SeIncBasePriorityPrivilege 4424 Lock.Julie.exe Token: SeCreatePagefilePrivilege 4424 Lock.Julie.exe Token: SeBackupPrivilege 4424 Lock.Julie.exe Token: SeRestorePrivilege 4424 Lock.Julie.exe Token: SeShutdownPrivilege 4424 Lock.Julie.exe Token: SeDebugPrivilege 4424 Lock.Julie.exe Token: SeSystemEnvironmentPrivilege 4424 Lock.Julie.exe Token: SeRemoteShutdownPrivilege 4424 Lock.Julie.exe Token: SeUndockPrivilege 4424 Lock.Julie.exe Token: SeManageVolumePrivilege 4424 Lock.Julie.exe Token: 33 4424 Lock.Julie.exe Token: 34 4424 Lock.Julie.exe Token: 35 4424 Lock.Julie.exe Token: 36 4424 Lock.Julie.exe Token: SeIncreaseQuotaPrivilege 4424 Lock.Julie.exe Token: SeSecurityPrivilege 4424 Lock.Julie.exe Token: SeTakeOwnershipPrivilege 4424 Lock.Julie.exe Token: SeLoadDriverPrivilege 4424 Lock.Julie.exe Token: SeSystemProfilePrivilege 4424 Lock.Julie.exe Token: SeSystemtimePrivilege 4424 Lock.Julie.exe Token: SeProfSingleProcessPrivilege 4424 Lock.Julie.exe Token: SeIncBasePriorityPrivilege 4424 Lock.Julie.exe Token: SeCreatePagefilePrivilege 4424 Lock.Julie.exe Token: SeBackupPrivilege 4424 Lock.Julie.exe Token: SeRestorePrivilege 4424 Lock.Julie.exe Token: SeShutdownPrivilege 4424 Lock.Julie.exe Token: SeDebugPrivilege 4424 Lock.Julie.exe Token: SeSystemEnvironmentPrivilege 4424 Lock.Julie.exe Token: SeRemoteShutdownPrivilege 4424 Lock.Julie.exe Token: SeUndockPrivilege 4424 Lock.Julie.exe Token: SeManageVolumePrivilege 4424 Lock.Julie.exe Token: 33 4424 Lock.Julie.exe Token: 34 4424 Lock.Julie.exe Token: 35 4424 Lock.Julie.exe Token: 36 4424 Lock.Julie.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4424 wrote to memory of 3064 4424 Lock.Julie.exe 83 PID 3064 wrote to memory of 4592 3064 csc.exe 85 PID 1828 wrote to memory of 4660 1828 SyncService.exe 90 PID 4660 wrote to memory of 5268 4660 csc.exe 92 - System policy modification 1 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3" SyncService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop Lock.Julie.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop Lock.Julie.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1" Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit SyncService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SyncService.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System SyncService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat" SyncService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI Lock.Julie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3" Lock.Julie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0" Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Lock.Julie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background" Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer SyncService.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer SyncService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit Lock.Julie.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1" SyncService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0" SyncService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background" SyncService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Lock.Julie.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Lock.Julie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat" Lock.Julie.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Lock.Julie.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop SyncService.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop SyncService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4424 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\srlsssvr\srlsssvr.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5BC.tmp" "c:\Users\Admin\AppData\Local\Temp\srlsssvr\CSC7BD88ECA99984F27AF26D511B520468F.TMP"3⤵PID:4592
-
-
-
C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1828 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hz0wmpsi\hz0wmpsi.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES122B.tmp" "c:\Users\Admin\AppData\Local\Temp\hz0wmpsi\CSC9511CBE7641F48A2B1117CE2B4C58B8A.TMP"3⤵PID:5268
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\DeviceSync\.dscfg
- Size 123B
- SHA256 499f0618a78c6014cf9d5252f4a2aa4c22586e2fef6738b34989f7f0fe0a7fcc
- MD5 1b0f50f5556c3fb152f62796e9cf75ce
- SHA1 9aa9ef0f3e7845ef5074b4a4b5acd0f5f55b88c7
- SHA512 b781fd1e1226f9bdbc44732953ea925ddb625c0e9175418a37c8f18654e994241173209c43e088e1e68e98c2f151c92027309aef9508ac83963cbb7ce0541951
- TLSH T189B02B2240410510337800C4D3050D345481030304017021FBB98E680B388201A00752
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\DeviceSync\SyncService.exe
- Size 5.9MB
- SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
- MD5 e2ac9e24dce3e923bfe2526f7e4681b7
- SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
- SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
- SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
- TLSH T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\DeviceSync\bg_extracted.jpg
- Size 4.4MB
- SHA256 8d547744b4ab2c3189a566753ec1f19470d1367936e11a941d5addc9ca5e7b92
- MD5 e5e7a24e300db549a35a5f3d734544a3
- SHA1 2b0617e8126fab1c5f136248524283c98d6f6897
- SHA512 defa97ade3dc9fc4a0f1d44c8bbaa3ef2c2b664f9554f5dd8a81a0375781fc7ef48b637fdc1939759d1b1da934c43f8d8efc1696ebf38ba09f70ab3b0b4cbc36
- SSDEEP 98304:pZ54kuruikPJdefM4pxHzaGhQsXu7H0kV0zwMtHiU0BqIclCHeb:P54ku7QVAxTahsXgFV0wOL0BElq4
- TLSH T1BE2633C0FCEB1F75D993118CCF9372B6969D7160D73E28C6B764B2C24A3E44522A8792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 53KB
- SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
- MD5 eb95593cadef8a5dd4ae7059529d25c7
- SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
- SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
- SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
- TLSH T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES122B.tmp
- Size 1KB
- SHA256 95800edd1845d945b47984a185357be7515884c9b8f88ddbaff5393550e931b3
- MD5 1f249c67616b7aeff6f19b8d29697aec
- SHA1 6c8432f69ada6435cde7152dceabf02ced7a7e14
- SHA512 e232788e6f084b42a0b7ee72c317501901bab09da08a78bbf294b8cc047526562c683c5e4517215d019737d9e6c47872dc9fce4e376068e25ca6b25a70a061f7
- TLSH T1C921590553E8471FF0B75B316DE6172BA668FD59EF72939B848002292C51100DEB0FB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RESE5BC.tmp
- Size 1KB
- SHA256 df55749051eacdcb52bffb570d709d9208d052f3b71321f27ec2b5ff5af238bd
- MD5 f23d27531580180427e9fe2308a6455f
- SHA1 3ee64f3b0a19d8be23c22c1fa9fba364382149a6
- SHA512 93e58e1ece50bf6e3dd5867b01beafc99da6e56cb425bddf822665b41c198c9a04212d98993393da5206671bc1e522e419b053b64a97c981e2c5080aa5197a3d
- TLSH T1FB218C0483E84B1EF0B75B316DF6572BA238FD95EF62A35B854042282C61514EEF0E72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4n2rvdb.2cs.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\hz0wmpsi\hz0wmpsi.dll
- Size 3KB
- SHA256 5767e21f83b0139f434560cedf3c0f729cc365e583669401364b4899125fa8c0
- MD5 a3f70cb08567a3599bfc7562764fa73c
- SHA1 8c0911182ad56f745b6cb6dcb170b64ca05dbc82
- SHA512 0810de3afdeabdde7e427c048b7a65bbad9b7676d3725a6600e118bf356c1042638c1735695a9f2616e396db6ff6b09f4dd9226a5d9685a647b57b3ccf7074ed
- TLSH T16B71F206A7D8466BE4BB07346EEB43636774F8549F73672E08D0031DAC913645E31BB1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\srlsssvr\srlsssvr.dll
- Size 3KB
- SHA256 362601493f081b8fe29adb3a2dbf1a986428175d2f48f4627948e5d330913475
- MD5 522ba5dd80d0296c84eff9a686470d5d
- SHA1 87d454587e87205a32f23e34d750a06ddda995ed
- SHA512 0b4ae06cfeac7b31922a3bbc46e8e91bebd7914be63d0865e963bda1511202697d61a7f5f3f5bf216286eb3173cac2487afa352869974c0d1d313a66dd056cb8
- TLSH T15771F20AA7D44627F47B0B346EEB43666770FC50AF63572A49800229ACA16649E31BB1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\hz0wmpsi\CSC9511CBE7641F48A2B1117CE2B4C58B8A.TMP
- Size 652B
- SHA256 db7015c9042415c01adfb225c3b9e661c253576b5b8ae84f8219d1216d841eec
- MD5 f320a2a211a99e10769142c9d830c414
- SHA1 e57eebbcfe496143d50c924e8bff093ef5c05fc4
- SHA512 8329f028c924f4713144e3a25d2af5e0065c59e90379fc9a2c3510c64439462fab40ba4f16a746924b92f00e822960916ab0ae08c3b147b2c5bc8a04de2c0266
- TLSH T1B7F05E4963F8020EF0F34B30BDF6936391A8BC68DE32A3ED1454031D2C645108A72FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\hz0wmpsi\hz0wmpsi.cmdline
- Size 369B
- SHA256 a08ea30d016ced0242450721a459b4a69ec8473a56ffda8df020aab6697c3cde
- MD5 e4e9dab564759194042fbdbb33283f4d
- SHA1 927f799fb7facf9901db3f11cbc3ed0ecc45f36c
- SHA512 0b367f0f3b7ceb6052ec6d35069c2f75e2e3e3e69764b230028a09a9b88deb483dcf8e609cd6e31abbd8456a3833357413c263ba21359b086a48b11fc4cb7156
- TLSH T120E0C62A464AC67E01FD100F266EC8ACC27207932AA8BF849040840FF4272112BD278A
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\srlsssvr\CSC7BD88ECA99984F27AF26D511B520468F.TMP
- Size 652B
- SHA256 e5e0b17330aaf6026779ba82c332ea84d0339db5d53d69ceebf5e0140fd54f37
- MD5 acfd3ba25fa3efb9670c0caf43eae898
- SHA1 39c71b085e77b82209194100173f271cc0aa0afb
- SHA512 ac798d608d4396ccb59f3e1b13f16f3efefbefca6035124dc40ccbe85013cf006070c679cf681269538fa4f2524dc2d072d94e18a806817f281e9f5656a9cc73
- TLSH T1C2F03A0963F8420AF0F34F30BDF6836791A8BC64DE3293ED594003296874914C972FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\srlsssvr\srlsssvr.0.cs
- Size 418B
- SHA256 cbc4940031baf6e739b3838b4df0fe531d59bea50d713d2bafc9c0e720b16cd4
- MD5 378bae59e416d1ef128b553a82dec088
- SHA1 aac56f28dafd3444c326fc34f4510f2390a72893
- SHA512 1a5b0f05ea0fd2dcba9242d265927eef1ce70c3d1f0654e7f7734924f8e20bcb82a57d0d573a0e3a54caf1e9d07d5fc24c07f8ff89d4009267252f892a0f9d1c
- TLSH T1DDE02B207343D9B9546601162EC3A0A17933E20A39DBBE4875ED6220CF57189B73267F
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\srlsssvr\srlsssvr.cmdline
- Size 369B
- SHA256 cc4c574e281f743a383437e41e90bb0b2a073b9a04f2062c89d2f63317248bac
- MD5 d57c4fc61156783949eebde837a53f49
- SHA1 83af235edede6f2277139c54bba55580833541b3
- SHA512 c7fc95d98d9b33d9dbd5ac8cc0a2c926265549a4d98d6eef775119a611a0419919e4214e606fb6e89bff5c3ac03a56d00bd8484dea771380efbff0d75df2ca27
- TLSH T105E06F6A8346CA7E11EA102B22AAC4BD82722BC36AC23FC4D040840DE037010AFD2793
- MD5 SHA1 SHA512 TLSH