Analysis
- user interaction
yes - max time kernel
4s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SAM IS HERE.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target SAM IS HERE.exe
- Size 11KB
- Sample261002-hmwytabd65
- SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
- MD5 5870c114ead5c7fe9c360e763f315824
- SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
- SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
- SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
- TLSH T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} reg.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 SAM IS HERE.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\ntdll.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\advapi32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\shell32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\ole32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\wininit.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\user32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\winlogon.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\lsass.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\svchost.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\gdi32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\ntoskrnl.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\smss.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\dwm.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\spoolsv.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\kernel32.dll SAM IS HERE.exe File opened for modification C:\Windows\System32\services.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\csrss.exe SAM IS HERE.exe File opened for modification C:\Windows\System32\dllhost.exe SAM IS HERE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2496 cmd.exe 5724 cmd.exe 5268 cmd.exe 4912 cmd.exe 308 cmd.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe - Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.7z reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a52 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.arw\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avi\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bay reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bcp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx\PropertyHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aps\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bin reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bmp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList\AcroRd32.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ascx\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bik reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\OpenWithProgids reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\OpenWithProgids reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3ga reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asp\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avcs reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.cdmp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aifc reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ari\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asc\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avif reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.caf reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{1f2e5c40-9550-11ce-99d2-00aa006e086c} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ans reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\MSPaint.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.AAC reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.b4s reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bkf reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.cap\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.cap\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.cc reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ari\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.art reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.au\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avi\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.appref-ms reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avi\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.avifs reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.application reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asf\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bcp\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.c5e2524a-ea46-4f67-841f-6a9465d9d515 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 424 reg.exe 4880 reg.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4116 SAM IS HERE.exe Token: 33 5288 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5288 AUDIODG.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2496 4116 SAM IS HERE.exe 90 PID 4116 wrote to memory of 5724 4116 SAM IS HERE.exe 92 PID 2496 wrote to memory of 3336 2496 cmd.exe 94 PID 4116 wrote to memory of 5268 4116 SAM IS HERE.exe 95 PID 4116 wrote to memory of 4912 4116 SAM IS HERE.exe 97 PID 5724 wrote to memory of 424 5724 cmd.exe 99 PID 4116 wrote to memory of 308 4116 SAM IS HERE.exe 100 PID 5268 wrote to memory of 4880 5268 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\SAM IS HERE.exe"C:\Users\Admin\AppData\Local\Temp\SAM IS HERE.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies registry class
PID:3336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCU /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\system32\reg.exereg delete HKCU /f3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry key
PID:424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKLM /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\system32\reg.exereg delete HKLM /f3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry key
PID:4880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKU /f2⤵
- Executes a command shell one-liner
PID:4912 -
C:\Windows\system32\reg.exereg delete HKU /f3⤵PID:5124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCC /f2⤵
- Executes a command shell one-liner
PID:308 -
C:\Windows\system32\reg.exereg delete HKCC /f3⤵PID:1472
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5288
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵PID:1412
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵PID:2100
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2128
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2168
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:5676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:1996
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:5140
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2296
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2956
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2840
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XAS7Z3C1\microsoftwindows.client[1].xml
- Size 97B
- SHA256 69ed5e8e3128bc0028dfe27bfc46d0a02d69e6055cb0da2435f0877f11da723a
- MD5 c5a3c043b692622d79751799897a47e3
- SHA1 f91c6988469f7518e1b4d52281aa13eb7369e0f6
- SHA512 deafa48fb2c8114d1262b10736386e590303af7c763caad15668265c21874e7ce5e0fe11361ec7ae9309fc2a6c6cc03136e38db5e39023b13c57995fc356d528
- TLSH T108B0121135856C2C874C99F72E0920E871FD0093A30A7475B8ECFC01F987D0AC429CB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Contacts\desktop.ini
- Size 412B
- SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
- MD5 449f2e76e519890a212814d96ce67d64
- SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
- SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
- TLSH T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\desktop.ini
- Size 402B
- SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
- MD5 ecf88f261853fe08d58e2e903220da14
- SHA1 f72807a9e081906654ae196605e681d5938a2e6c
- SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
- TLSH T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\desktop.ini
- Size 282B
- SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
- MD5 3a37312509712d4e12d27240137ff377
- SHA1 30ced927e23b584725cf16351394175a6d2a9577
- SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
- TLSH T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Links\desktop.ini
- Size 504B
- SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
- MD5 3b960da228cc489b622697659c885d64
- SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
- SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
- TLSH T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Music\desktop.ini
- Size 504B
- SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
- MD5 06e8f7e6ddd666dbd323f7d9210f91ae
- SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
- SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
- TLSH T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Pictures\desktop.ini
- Size 504B
- SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
- MD5 29eae335b77f438e05594d86a6ca22ff
- SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
- SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
- TLSH T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Saved Games\desktop.ini
- Size 282B
- SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
- MD5 b441cf59b5a64f74ac3bed45be9fadfc
- SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
- SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
- TLSH T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Searches\desktop.ini
- Size 524B
- SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
- MD5 089d48a11bff0df720f1079f5dc58a83
- SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
- SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
- TLSH T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Videos\desktop.ini
- Size 504B
- SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
- MD5 50a956778107a4272aae83c86ece77cb
- SHA1 10bce7ea45077c0baab055e0602eef787dba735e
- SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
- TLSH T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\AccountPictures\desktop.ini
- Size 196B
- SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
- MD5 2971c89bfb3b06e591694b9a78e467b9
- SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
- SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
- TLSH T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
- Size 174B
- SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
- MD5 8f91870452433a5555c9d453f714698c
- SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
- SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
- TLSH T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
- Size 174B
- SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
- MD5 e0fd7e6b4853592ac9ac73df9d83783f
- SHA1 2834e77dfa1269ddad948b87d88887e84179594a
- SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
- TLSH T17FC0801892E9311041718D12FC749001DBB1B8216C17CF5E07C0518B04A0605E631747
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
- Size 1024KB
- SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
- MD5 1d41d647faf0c99af43c89459acc8e9f
- SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
- SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
- SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
- TLSH T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
- MD5 bbe70a516ccc8b65668330f36fc864a1
- SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
- SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
- SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
- TLSH T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
- Size 196B
- SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
- MD5 08e1b7b2fd872cdcc42af67707dc2a98
- SHA1 512644da4aa90a3919bc29f65e878e9870874f67
- SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
- TLSH T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
- Size 302B
- SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
- MD5 99d72adf4e683fa1e6f1a435ff5be9b3
- SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
- SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
- TLSH T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
- Size 234B
- SHA256 2b1c0b3c687716c564f4c7280fa668d172c7ff1d0c81b3917ad4df464d2a22c4
- MD5 f7e90490051dad957ad55f1334f43838
- SHA1 c28fc0249bdd41164ef9b30a28c45dc703c05d2c
- SHA512 721a25801797b2f443a3d172510113cce61fafab8764c78131e8724654b4bd1452c6f9331198c57e0dc413d5295f86841ee1e3ea3cdc4d956674bb64be9818e7
- TLSH T10CD05B3E83458334FAD0A9E96A19710A543F60891043F20044F512A7F86A0098330EF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
- Size 432B
- SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
- MD5 f107d0270e21a2fe91099fdc15918d44
- SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
- SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
- TLSH T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
- Size 174B
- SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
- MD5 548b310fbc7a26d0b9da3a9f2d604a0c
- SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
- SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
- TLSH T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
- Size 174B
- SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
- MD5 7f1698bab066b764a314a589d338daae
- SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
- SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
- TLSH T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
- Size 174B
- SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
- MD5 17d5d0735deaa1fb4b41a7c406763c0a
- SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
- SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
- TLSH T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
- Size 174B
- SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
- MD5 a2d31a04bc38eeac22fca3e30508ba47
- SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
- SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
- TLSH T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
- Size 176KB
- SHA256 6ea25d299adb39df40212749727988f5f4bd1daba2b02fafb970fa2d1dbec7a7
- MD5 90e4cfb342009eaaae50e1e7ccfd6729
- SHA1 a92ec924cc7e55f7ced198b3c3406935f7c90e62
- SHA512 3bc4c4aa96b72c6a5ecafed98f7c679866ba09f99a71683d13f1205e809700199b3150197477bcefc8f6a65c663073b61b7a27c59748b1721b82f58b210f7e6c
- SSDEEP 3072:bxsJvlkwIJFCaup/yNOas8WY1hKKbfef8zob71T57kLq+Crt3CaEBqwbDpxp:1sJvGwIJ8N/yjs8WY1hKKbmf8e6LVCr8
- TLSH T151041263157FEE51B31B6E199B4B12FFA081B546362B391E74C7E9B32D23108A2C41B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
- Size 282B
- SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
- MD5 9e36cc3537ee9ee1e3b10fa4e761045b
- SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
- SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
- TLSH T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
- Size 418B
- SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
- MD5 93c8b5c191bdcf8aca86d7463d77e6c8
- SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
- SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
- TLSH T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
- Size 298B
- SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
- MD5 819c27ae07898f1a5efda4e146dbb174
- SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
- SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
- TLSH T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
- Size 402B
- SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
- MD5 881dfac93652edb0a8228029ba92d0f5
- SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
- SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
- TLSH T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
- Size 520B
- SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
- MD5 af5909700768a888173cbd32998cf3da
- SHA1 194ed60ed8923749078816fc2c69614d975ba325
- SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
- TLSH T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
- Size 520B
- SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
- MD5 7a985a80859ee46e35031543cf0d142f
- SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
- SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
- TLSH T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
- Size 520B
- SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
- MD5 a882cf89da04eb72950e65080a5cf857
- SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
- SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
- TLSH T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\RGI8F84.tmp
- Size 24KB
- SHA256 04a0fbd0b5c3e4f7e3558a3871fe3f3cce5013a330941c3e72b4cdb19c81f2ad
- MD5 033649d7b623b2f8cd29854ccb6d6a4b
- SHA1 9772f7b7b11625fc3dea7598cdf5b6d0fc511ae6
- SHA512 90df8c97c8d8062970d76af2235c3ab78208c95c332bbc04e72e2782cb926ab12dbb1098914f453eb7b095ee7dc50f80d4cb96c5931a51a25efb5d91a3c50989
- SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
- TLSH T1CAB2BF295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
- MD5 SHA1 SHA512 SSDEEP TLSH