Analysis
- user interaction
yes - max time kernel
130s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
Noxa_PingLagger.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Noxa_PingLagger.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Noxa_PingLagger.bat
- Size 38KB
- Sample261002-rc6vpsyfpg
- SHA256 7619425f390bff164922bba49cfd9cabfc9f2ab4deca6b488434548c81165772
- MD5 ab70faea3af01ba3cb41c03651710ef1
- SHA1 06faa1beb7e041d8a169cb5353b4023a76357061
- SHA512 a7fd3157452c32fd806d033ffaf66b0d962949ab194b55789f24c2fcea57659e6d388d558dbf30a4a3e00d31e7d024004df43ff376b6727b9c7a5402dc81ab5a
- SSDEEP 768:BjnmQ2vvQ43dxgMm7AcGsFduEErDMLf9xuRQyIH1yDwO2yaCmTiLJUtOyxlllHAK:BjnmQ6vT3PyXbVcYAUVUY
- TLSH T1120364467D1226B5A603EE6C99A34E05FEA6B8030D0A394D39BE41041F9D71CD6FFBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4112 SystemSettingsAdminFlows.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SystemSettingsAdminFlows.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\Recovery\ReAgent.xml SystemSettingsAdminFlows.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Logs\PBR\Panther\diagerr.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\FirstBootTel-M2.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\FirstBootTel-M2.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\setupact.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\DISM\dism.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\setupinfo SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\DISM SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\DDACLSys.log SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\setupinfo SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\WinRE\bootstat.dat SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\DlTel.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\DISM\dism.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\compatscancache.dat SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\diagwrn.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\compatscancache.dat SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\setup.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\windlp.state.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\_s_8E2D.tmp SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\PushButtonReset.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\ResetConfig.ini SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\CBS\CBS.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\CBS\CBS.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\CBS SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\INF SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\BCDCopy.LOG2 SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\INF\setupapi.offline.20240401_072605.log SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\CompatData_2026_09_12_01_00_05_00000001.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\unattend-original.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\unattend-original.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\unattend.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\BCDCopy SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\SessionID.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\SessionID.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\INF\setupapi.setup.log SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\diagerr.xml SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\DlTel.Merge.00001.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\INF\setupapi.dev.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\ResetConfig.ini SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\setupact.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\FirstBootTel-M1.etl SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\WinRE SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\setuperr.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\ReAgent\ReAgent.xml SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\INF\setupapi.dev.log SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\INF\setupapi.setup.log SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\FastCleanup SystemSettingsAdminFlows.exe File opened for modification C:\Windows\Logs\PBR\Panther\Resources SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\Panther\DlTel-Merge.etl SystemSettingsAdminFlows.exe File created C:\Windows\Logs\PBR\ReAgent\ReAgent.xml SystemSettingsAdminFlows.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5656 cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5656 cmd.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId CastSrv.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{D0839BD8-5B90-45CB-A1AA-E7FC0EB5DACF} svchost.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeBackupPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeSystemEnvironmentPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeBackupPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeSecurityPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeTakeOwnershipPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeBackupPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeTakeOwnershipPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeTakeOwnershipPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeBackupPrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeRestorePrivilege 4112 SystemSettingsAdminFlows.exe Token: SeShutdownPrivilege 4112 SystemSettingsAdminFlows.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4112 SystemSettingsAdminFlows.exe 4480 LogonUI.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5656 wrote to memory of 5432 5656 cmd.exe 90 PID 5656 wrote to memory of 5100 5656 cmd.exe 91 PID 5656 wrote to memory of 4228 5656 cmd.exe 92 PID 5656 wrote to memory of 5888 5656 cmd.exe 93 PID 5656 wrote to memory of 5904 5656 cmd.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Noxa_PingLagger.bat"1⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\system32\print.exeprint ("deobf by discord.gg/speedhub")2⤵PID:5432
-
-
C:\Windows\system32\print.exeprint ("deobf by discord.gg/speedhub")2⤵PID:5100
-
-
C:\Windows\system32\print.exeprint ("deobf by discord.gg/speedhub")2⤵PID:4228
-
-
C:\Windows\system32\print.exeprint ("deobf by discord.gg/speedhub")2⤵PID:5888
-
-
C:\Windows\system32\print.exeprint ("deobf by discord.gg/speedhub")2⤵PID:5904
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1864
-
C:\Windows\System32\CastSrv.exeC:\Windows\System32\CastSrv.exe CCastServerControlInteractiveUser -Embedding1⤵
- Modifies registry class
PID:4784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2868
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4112
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1484
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5640
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4668
-
C:\Windows\System32\ResetEngine.exeC:\Windows\System32\ResetEngine.exe1⤵PID:712
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\sysreseterr.exe1⤵PID:920
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a3e855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$SysReset\Logs\ResetConfig.ini
- Size 189B
- SHA256 d64f8cc7ad695029fc5f0e638c28371b42d4350926ef6ed70df3f88dae511de8
- MD5 e2cfb3cced39b7635012441e1d9f66c3
- SHA1 ceaf20e08d3b190fe9325e07f8156280de3a5274
- SHA512 87b157d14c9d10b1e0d8981a42d8f62a8594c58eaa2cee110d5b792feeb096bf1308b0cef585c96e454aa2c0a38197049cab82969659d745548c8a6e58964fcf
- TLSH T187C012207120C18C09148A97E2A8CB82913A98C11747DA662DE521EAB32272665AA41A
- MD5 SHA1 SHA512 TLSH
- Path C:\$SysReset\Logs\SessionID.xml
- Size 106B
- SHA256 bd7dec40e48bfc6015373454851478c2385cb663edaf521728e44696dcf6015a
- MD5 9e6eacb70760e029713bcdc5078665a3
- SHA1 214e837d0971664a6c82d537d538bad6368d913b
- SHA512 be13606926e5ea17724560ec5b3bacf1456f9cfdfddb0afa8ed5b0e8894e8ee480805b9da1526efc76c675ed5ca402daa6f82466f10a7e0e1232334ae8819edf
- TLSH T1ACB012460A216251004A99121F342A0017AA2420703106C3FD7FA635A1DCE8A1F58148
- MD5 SHA1 SHA512 TLSH
- Path C:\$SysReset\Logs\Timestamp.xml
- Size 42B
- SHA256 379b962cb30fa6ff6f97bff6651b1aa8b8c49ac1e63c340a3095fa2b5e391296
- MD5 307ad0b49c2eb3352a76ace32d3e8ddc
- SHA1 74b276de3d53c2f394d3a810ee7a8273125906f7
- SHA512 456df808623348b0cfb733948b1216d6a79816a1290c8b020045fc236d9f1e46434075ceccd9d05792c36ca8ee7ba1c72bdc83be2d7997f6e428dda117059c58
- MD5 SHA1 SHA512
- Path C:\$SysReset\Logs\Timestamp.xml
- Size 41B
- SHA256 e5b3898728e13b6f76aff7dcba85f12e23a5e291ae73079f243c4208aba24e2f
- MD5 53cffd93ff9f60a238a95670059d1602
- SHA1 3470202bf5171f05fbf1381a4ba6ded7a2b8f822
- SHA512 8732f2876d5b94c557177f22c3d757757dd9bb0445f65d016b250d89e22b203ace68b2e6e06c74814c47816d25017f0fd3bf5fe97ccc7db6f583e7b1de1fade4
- MD5 SHA1 SHA512
- Path C:\$SysReset\Logs\Timestamp.xml
- Size 42B
- SHA256 d3063d0fb507e99680ea365e611b2ec258b74c20903ff46d27ad53a798b11924
- MD5 f4e07412041256aaef4995e47c9bbb97
- SHA1 5c793f59fe476a0ba81bbd74c5ff8c2791c8bc55
- SHA512 220d525126362ad050b5f54115e8fd3cea3547eb61733b46b6e212c81ecd747feee543ba34f543a5aea877e96f52c04be706b14bbb67ac96a1840c7c71f71d8c
- MD5 SHA1 SHA512
- Path C:\$SysReset\Logs\WinRE\bootstat.dat
- Size 66KB
- SHA256 064b720de6c2b55ce66f194ddbc991a4a3cd8b41e85dde5997f6052fef7459ed
- MD5 6572e4db921fbac8af26a56063fd050d
- SHA1 dd943e41788150e57e011cd0e041d9c1d6671b99
- SHA512 66a184e1eb5dfd7edb61e23190d3c502f9c38808b085491bea8eb21184e0554ab9fa7acd3d03d27de23439a2d2c3955a2b1df2a4dc65cb312d7b3083d9ec72b3
- SSDEEP 3:1lE/71tKtG:q1tKM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\$SysReset\Logs\setupact.log
- Size 117KB
- SHA256 1f46f54beaf9586a4e8f25c402e0ab500a12568bbd8526d2c10d99dfc5c0c937
- MD5 ba852344a8a8ef650d74c7e3d51a423c
- SHA1 2fb7adea0146399f8f3959f363b1abd10c27586b
- SHA512 32aa80351beb42025aee60e9fb9b48c19be6f3dee05b42477f9260308ec68fa31a1c5df195df1ef6ddd02704dbb6bcd48258f42ad53e27e1d105a3809d8a6e7d
- SSDEEP 384:VryVbyRsqkokzsKL8yghz3o+TQezzN6WR68KjM9Dq21VYrK22M9DAtH1tHhtHB/a:wb/3s83+Tz3NW87CjY2szu
- TLSH T168C3392B0F2CC1F5E519624136991D2F71363CE1B1FCA09CB37E92623F58A54C7E9A86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\$SysReset\Logs\setuperr.log
- Size 1KB
- SHA256 ba3da189fa2eb90271ee421868f05790fafbcfa95c77f81eea07820aac7202c3
- MD5 f8bad47c922b6de8f9be7a61f4d8c4cd
- SHA1 fd87e5728fc90b74e318d2b6b42603e0842ac4c0
- SHA512 eb7a26b78041a6da6cc9d76570e52e5a09558aee256aa530ea258ffb5c4299ddd9e5b438202e11132600773b9f5aa5eb5acda9c230ac0386af20a446edc4f453
- TLSH T138213E071E9694A7C0B012217C00BE151E9938F350CDC429B7BC03D9FBA88E0F9BB4DA
- MD5 SHA1 SHA512 TLSH
- Path C:\$SysReset\ResetSession.xml
- Size 11KB
- SHA256 30d20981ca365bc93ccd0f51f4df00448e745210aaca0486f890b2577ea6a1b8
- MD5 b2bf0a27c06993a7fea68724aed650f1
- SHA1 17289218d0c83324e7f489ab6b0680b2ad98db36
- SHA512 978d12d5f0964ec54fe4a152cdf1d5d34df238249d45de32072ebd3ef07b43215c1c23f07b2afa0d874440884236fcba64ae9cac11a0568010d09719851ef0a8
- SSDEEP 192:XOmJZcCVkia0knImLvbrPwKKC1KCCFd9eVu1vmHlIg0COA8ajwWL69rZNiBymYlf:XOm3cCVkia0kImLvbrPwKKC1KCCFd9eQ
- TLSH T10032EA48E3125B33D252872D9AB5FC989179B79D86CCC22AE05C7E62B4C2E17423F3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{59B97B4F-6EB0-4691-BE18-6011876190BD}\ssshim.dll
- Size 161KB
- SHA256 fbce8d79097c40a79961fd546e3c21be33acf8194af2e23f7b7a8c148315c7cb
- MD5 4f417172c8065f44465829a114e426ed
- SHA1 c2a0f0aaea3deb7d6383536ce2df9eea63df21b6
- SHA512 d06c0a9075daf56a710cda3da695279fd376f6425ba2e2b1069ba7b15a0a45579119c8d3bc9fb84b317c2fd3b3e5f13ce9c7219515e1bfc501b490535cd1f1f1
- SSDEEP 3072:tNnmlzuNZYhYubo/p6KZzJBVKiQsxL7w+u7MEc4:Lm0NZYlOAgzJfAsF9i
- TLSH T1B2F316366292A1D5D6AEC03892B76D02EAB13414137076EF0BE485791F77FE4AE3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Panther\UnattendGC\diagerr.xml
- Size 12KB
- SHA256 41e3c0d894a80be624d6961866650f6d561bfe0857f9d86fc8955e19b187f839
- MD5 9ce51dae1306232bc1ce4a188b9a9bed
- SHA1 96a96ee5f450a3e4597b415548697af3230d4006
- SHA512 e9c0c7299f6b2494365fc0f9827a4b1ac9fc44dd096fb476eaa464656cdeca7c77652e189ec7c5383aa8d6b019a3afd4fa8fae56aa0f317e94ea66f0afc56792
- SSDEEP 192:53gbq3gbq3gbHWrM/1LPw3BT3gbq3gbq3gbt:53Iq3Iq3Ihc3Iq3Iq3It
- TLSH T14642B829B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F5B07CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Panther\UnattendGC\diagwrn.xml
- Size 15KB
- SHA256 400fca657ed759a73f51d7a5674f86a14256604d293a81829c5d80ede2393c80
- MD5 7e225bbbc73fcf46ae2235d4875fd955
- SHA1 839b45d46ae89197512422f3518ec37db4d9f01b
- SHA512 1e5b41599b58b1fcf09af3990fbbec4b1258ee4bcd4db7c8d51ace19393d8b666debcc00c9a5b9e6c89c8fab75ce64b7174db482114fb4b3e48a35e62d7ed74a
- SSDEEP 192:53gbq3gbECcT27O03gbY3gbq3gbq3gbEUQjQOQEZUQnvhHQ4CQnvvZ:53Iq3ILc23IY3Iq3Iq3IfITmavCsZ
- TLSH T13B622A3CB1942EB75C9002F8DBD038C26B809B794116A03795C5FEABB279082F9B17DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Recovery\ReAgent.xml
- Size 1KB
- SHA256 87581cae08d00ccae20c99dc0b0800c127ab500c3a96819e4d318bc042e8e5a9
- MD5 cd8fa9d81812ef92c3d4134c3f1971ca
- SHA1 bad3f34c4eaddd231b282dd48d0ae1dee09bb7d1
- SHA512 d648b00d32ee202e90c19804f977e0f7357e38d57fd6f1f091b5d3d1a4b7535f2417ec716132b57ec95d24b7ee84769ed206917a985d3e4fc3e40e6f5713c751
- TLSH T1CA210A4A81B818A7D7B1C366F1F8BD60463FF0DD12E08A5CE029F6D395474528B5F9B0
- MD5 SHA1 SHA512 TLSH