564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8

Analysis

max time kernel
150s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/10/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
COPILT.exe
Size 89.0MB
Sample261012-3fagfssxay
SHA256 564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8
MD5 e5b888cf4f3084163c64f0608741a634
SHA1 75e19d26637e16046ebcbeb30953393220bdb5dd
SHA512 0c76e3f564c41e4ee698137ccd05c104443951b826ad5baaac3246ac877db5ad48a6a0e59b4e708e1dbe0c89022d64378459a69e6d66f25ae087f2d4c623f405
SSDEEP 1572864:jUBcVqw0hW83VmEPqb8iu6E6HvqwtizGtVKP0OiuB+laGRu:Av30EPqb8i3Hviz0a
TLSH
T1F918333FB894C981B18D91BCC5421CDECE41DA9F69EF9DC41B5EFE42A425A4E8E93403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4440	wevtutil.exe
5820	wevtutil.exe
1772	wevtutil.exe
4916	wevtutil.exe
5092	wevtutil.exe
4280	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (2375) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	COPILT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	SecurityHealthService.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	COPILT.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 1 IoCs

pid	Process
4948	SecurityHealthService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	COPILT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	COPILT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
1	discord.com
3	discord.com

Drops desktop.ini file(s) 19 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	COPILT.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1805035633-626948184-3225555471-1000\desktop.ini	COPILT.exe
File opened for modification	F:\$Recycle.Bin\S-1-5-21-1805035633-626948184-3225555471-1000\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	COPILT.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	COPILT.exe
File opened (read-only)	\??\T:	COPILT.exe
File opened (read-only)	\??\G:	COPILT.exe
File opened (read-only)	\??\K:	COPILT.exe
File opened (read-only)	\??\S:	COPILT.exe
File opened (read-only)	\??\U:	COPILT.exe
File opened (read-only)	\??\W:	COPILT.exe
File opened (read-only)	\??\X:	COPILT.exe
File opened (read-only)	\??\Y:	COPILT.exe
File opened (read-only)	\??\E:	COPILT.exe
File opened (read-only)	\??\M:	COPILT.exe
File opened (read-only)	\??\O:	COPILT.exe
File opened (read-only)	\??\Z:	COPILT.exe
File opened (read-only)	\??\J:	COPILT.exe
File opened (read-only)	\??\L:	COPILT.exe
File opened (read-only)	\??\V:	COPILT.exe
File opened (read-only)	\??\H:	COPILT.exe
File opened (read-only)	\??\I:	COPILT.exe
File opened (read-only)	\??\N:	COPILT.exe
File opened (read-only)	\??\P:	COPILT.exe
File opened (read-only)	\??\Q:	COPILT.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
4	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	COPILT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	SecurityHealthService.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4564-0-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4564-887-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4564-2017-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-4823-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-4871-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-4950-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4948-4951-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-4981-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5020-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5047-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5087-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5113-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5153-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5179-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5219-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5246-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5286-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5313-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5352-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5373-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5418-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5439-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5484-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5505-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5551-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5571-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5604-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5617-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5656-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx
behavioral1/memory/4564-5681-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp	upx
behavioral1/memory/4948-5722-0x00007FF748280000-0x00007FF7483C9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe
1020	cmd.exe
10256	cmd.exe
10100	cmd.exe
3320	cmd.exe
4508	cmd.exe
5172	cmd.exe
1704	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	COPILT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	COPILT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3980	vssadmin.exe
10276	vssadmin.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBitEncryptedFile"	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon	COPILT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBitEncryptedFile"	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\icon.ico"	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit	COPILT.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	848	vssvc.exe
Token: SeRestorePrivilege	848	vssvc.exe
Token: SeAuditPrivilege	848	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1064	WMIC.exe
Token: SeSecurityPrivilege	1064	WMIC.exe
Token: SeTakeOwnershipPrivilege	1064	WMIC.exe
Token: SeLoadDriverPrivilege	1064	WMIC.exe
Token: SeSystemProfilePrivilege	1064	WMIC.exe
Token: SeSystemtimePrivilege	1064	WMIC.exe
Token: SeProfSingleProcessPrivilege	1064	WMIC.exe
Token: SeIncBasePriorityPrivilege	1064	WMIC.exe
Token: SeCreatePagefilePrivilege	1064	WMIC.exe
Token: SeBackupPrivilege	1064	WMIC.exe
Token: SeRestorePrivilege	1064	WMIC.exe
Token: SeShutdownPrivilege	1064	WMIC.exe
Token: SeDebugPrivilege	1064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1064	WMIC.exe
Token: SeRemoteShutdownPrivilege	1064	WMIC.exe
Token: SeUndockPrivilege	1064	WMIC.exe
Token: SeManageVolumePrivilege	1064	WMIC.exe
Token: 33	1064	WMIC.exe
Token: 34	1064	WMIC.exe
Token: 35	1064	WMIC.exe
Token: 36	1064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1064	WMIC.exe
Token: SeSecurityPrivilege	1064	WMIC.exe
Token: SeTakeOwnershipPrivilege	1064	WMIC.exe
Token: SeLoadDriverPrivilege	1064	WMIC.exe
Token: SeSystemProfilePrivilege	1064	WMIC.exe
Token: SeSystemtimePrivilege	1064	WMIC.exe
Token: SeProfSingleProcessPrivilege	1064	WMIC.exe
Token: SeIncBasePriorityPrivilege	1064	WMIC.exe
Token: SeCreatePagefilePrivilege	1064	WMIC.exe
Token: SeBackupPrivilege	1064	WMIC.exe
Token: SeRestorePrivilege	1064	WMIC.exe
Token: SeShutdownPrivilege	1064	WMIC.exe
Token: SeDebugPrivilege	1064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1064	WMIC.exe
Token: SeRemoteShutdownPrivilege	1064	WMIC.exe
Token: SeUndockPrivilege	1064	WMIC.exe
Token: SeManageVolumePrivilege	1064	WMIC.exe
Token: 33	1064	WMIC.exe
Token: 34	1064	WMIC.exe
Token: 35	1064	WMIC.exe
Token: 36	1064	WMIC.exe
Token: SeSecurityPrivilege	4916	wevtutil.exe
Token: SeBackupPrivilege	4916	wevtutil.exe
Token: SeSecurityPrivilege	5092	wevtutil.exe
Token: SeBackupPrivilege	5092	wevtutil.exe
Token: SeSecurityPrivilege	4280	wevtutil.exe
Token: SeBackupPrivilege	4280	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	8452	WMIC.exe
Token: SeSecurityPrivilege	8452	WMIC.exe
Token: SeTakeOwnershipPrivilege	8452	WMIC.exe
Token: SeLoadDriverPrivilege	8452	WMIC.exe
Token: SeSystemProfilePrivilege	8452	WMIC.exe
Token: SeSystemtimePrivilege	8452	WMIC.exe
Token: SeProfSingleProcessPrivilege	8452	WMIC.exe
Token: SeIncBasePriorityPrivilege	8452	WMIC.exe
Token: SeCreatePagefilePrivilege	8452	WMIC.exe
Token: SeBackupPrivilege	8452	WMIC.exe
Token: SeRestorePrivilege	8452	WMIC.exe
Token: SeShutdownPrivilege	8452	WMIC.exe
Token: SeDebugPrivilege	8452	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4564	COPILT.exe
4564	COPILT.exe
4564	COPILT.exe
4948	SecurityHealthService.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4564	COPILT.exe
4564	COPILT.exe
4948	SecurityHealthService.exe
4948	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 5172	4564	COPILT.exe	82
PID 5172 wrote to memory of 3980	5172	cmd.exe	84
PID 4564 wrote to memory of 1704	4564	COPILT.exe	87
PID 1704 wrote to memory of 1064	1704	cmd.exe	89
PID 4564 wrote to memory of 2340	4564	COPILT.exe	91
PID 2340 wrote to memory of 1616	2340	cmd.exe	93
PID 4564 wrote to memory of 1020	4564	COPILT.exe	94
PID 1020 wrote to memory of 4916	1020	cmd.exe	96
PID 1020 wrote to memory of 5092	1020	cmd.exe	97
PID 1020 wrote to memory of 4280	1020	cmd.exe	98
PID 4948 wrote to memory of 10256	4948	SecurityHealthService.exe	101
PID 10256 wrote to memory of 10276	10256	cmd.exe	103
PID 4948 wrote to memory of 10100	4948	SecurityHealthService.exe	104
PID 10100 wrote to memory of 8452	10100	cmd.exe	106
PID 4948 wrote to memory of 3320	4948	SecurityHealthService.exe	107
PID 3320 wrote to memory of 2832	3320	cmd.exe	109
PID 4948 wrote to memory of 4508	4948	SecurityHealthService.exe	110
PID 4508 wrote to memory of 4440	4508	cmd.exe	112
PID 4508 wrote to memory of 5820	4508	cmd.exe	113
PID 4508 wrote to memory of 1772	4508	cmd.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\COPILT.exe
"C:\Users\Admin\AppData\Local\Temp\COPILT.exe"
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:1616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\cmd.exe
  cmd.exe /d /q /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:10256
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:10276
- C:\Windows\system32\cmd.exe
  cmd.exe /d /q /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:10100
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:8452
- C:\Windows\system32\cmd.exe
  cmd.exe /d /q /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  cmd.exe /d /q /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    PID:4440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    PID:5820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3ed1660c9dbe6f63ce628f0ed94d224ef43a9ea49236615c1b0bcf3701058768
MD5 35fe39189d4bb5bf1c57d5b3452b2446
SHA1 4dcee0ae25c9060e51c2a5db5d500bf5e39af824
SHA512 4288ec04733c1290a7cf9e19f9df9447fd31bd09a3f94551656ef052dcecc8445fa9523d3fcccf3b511a85e61331b5a58eae4866512a7ecc83b15fb4d50d3c48
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 295dc924427727c25c67c6aa332bc8c7c1053842d22d88ed2104a05cc5687e19
MD5 6bc99c1f1bbd4d6c18452c97d0c265b3
SHA1 e29a2b9ae8a5ea37a87bbade669b2adb97b0099b
SHA512 dd00bc54fa46ec9689def4bfc5eb7ee134972b29260db45d708b34f14b17ccfc4d76a54c5f01dd88ced43ac88cd3964eb713a81c1d28720a7df9a0c7f213cd8e
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 b464e4a8ed2f6b0221e4a03e17881f494e5e9ee6292c930ad5e366bc5d213b67
MD5 74cbdaa9e4d40fa4b8d522e8bafa7d47
SHA1 a3746b84e3497cf03e3437419c0b06bf140f3912
SHA512 bb1ea6196b113486a9734c326aae81faf4a259c69de7896f605c105bd9e0ec0d89a971de4eef77c1fb9b8b18ef27886132f5bdc69d9de3463a6b81f27fd2dad6
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 60b7e6c7eb7edbe98ca9466616de7a903d8606e2f7bc48954d79fd4a9b6d86fd
MD5 2b06ba0ad6ec9838ed107b2e3b965bcf
SHA1 ab2aea5c62f3c14ede47067f5c5fae07d6ba8458
SHA512 4924ec9619fe66cbf9e7bb974c0c224acb2350a9fb670fbf2416e24739f626b3dc85db67045027b72145bc5eb2140ff4d05294e9697cac8bbe34f72fcaf1facb
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 bd3d3a39ac63ba9f4e91865730663f41bda69278256e470d2735795b125570b0
MD5 4a81e0d14e9b99064fec02603b9bbbf8
SHA1 cbae64566d2f8eafae275c4bc4808bdcf7a68e10
SHA512 af19b78d0e19399f9129451260accd9f746cf3e5647fe2b94bbe83b11af5ab138d5a241dca7f67f0a525c25cbfc2af8f1451626fbab87147cf8e3f186095402b
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 fb0c2ec15516a8de0e1830e5e8fbcc21af066271abbb6e1a264180cc4cc04d41
MD5 8fb02b50865941bab2abdd2602464bb2
SHA1 a8a30bd0f39f10f40ce302f5467aa66cdff845cb
SHA512 29ca8f9e4f65d1bd0e3065e0a9cdc428dcf0e84c254dfcc74cd2f327a16369afe249f9a2f25051cf913ec9afb853dcdf26fe971ae69e0fff9dc53efb0cb989de
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 6b30ff4fc6fd98dc7986a8c93fd697ae83df6ba8350924a8b839a4d692e183ea
MD5 a87b8751fd54725bf6246bb4c9e05a8a
SHA1 fd6dbdbd25eb622651bc36f003f066708fdc8235
SHA512 9c6072299392819b7401679b7cd1d81bde466c312008154ce618fb7e2c214e82facce3cbd4d3104d305f9ea539ba4828e5ddec2755838b361a44ae760c8e74ba
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 16af440e8be8334ebb3ae0216d916aa5afddf93c7106a97abc88f409f3f118f8
MD5 46dccd0aa59a74727c4bcda48a3746d5
SHA1 ac03be4b0dfed56fa44dd1066355e4c22f87807e
SHA512 221413e11b7cf84aac1d9f70610af724c8ebe5997a779b983c7d20d414c8052c5fd25694d0007d28de7b8632d10acdf4d561167a494c0891355b5f80eb6b87b7
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9984f4fd7f6f6656361b08058193a5edb9f1d31ca8116ccf5834022af48c7459
MD5 7671883435a62b9771c17b49add68e5a
SHA1 dd6845386debfe27248e30d2c102d2957da39fa0
SHA512 0dec4311fc5f5de3a37fc4d4b671ec7d47a04771467422af97eb91c7b8b41bbbc819fe55739575a97ec1213c7339ba5df400ad0ed0281775c073bf2563e04231
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 2292f0242dda54d5cdbae4e28d7501efcf948bdae3f4038b2fd5653d1c82fe66
MD5 bc4b9cc9175a387511b78d162a8d16ad
SHA1 962c4f7ee8afd3d2fc51f4171c3b23a83353ee3c
SHA512 a2a9dc0e8a794668372334eb7c50cb084179d3624dec7968e63f7b26ff3663ddcf2549216bbdc5e619b1e859d765feed04c80d2a27268c286d657a3ae285e654
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 f4d12ff0db1784ca490f0170633a8f259d271e3f290a1d7ed0b262c78a41a6b4
MD5 06db456addff301485e9794b9f5237b4
SHA1 c2b83b78173f79b40175fcde1c8df3c1b4502883
SHA512 cdae75011071224f4807a489608460f5e446665351acad161cb1316d993bc8a7c3e0f10b1435f1ab04be8cd27a15c4d79e58ace861edc230e1b597da9fee4388
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 2e063d64b762ff7ab9eaea019ca30228d18601a91807ce9da865b70f429c53b5
MD5 6ab09e905b1ef67066c74fac3c2f6c41
SHA1 71dc2ff0ca0a17074a9c0c34b025d52f88ad26f8
SHA512 92c7cdb90d703177b939a69ed093a34a7839f90d15b5cf9420c7fa2f4b2ddc385b942c6ee0a8368b139cc7f4d1c30bbdc920dc2bb2026df325501ba07f62b8ca
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3b3ca68553ded637ddaf03b69e02e9b8b8a4f56b187d17426d88acfe3ec4d091
MD5 a1df49551214f71cb4132489d31a1c45
SHA1 ef734b144a8cd8e2754b22b17ac413868ce2ac15
SHA512 13e0a407850e158cf0c2002d5279b5d2b019a2c9ceb14b5ca6346fb29e801d3c483a05139701fbb584fa9772a300e76f357f92ce61946a3484dcdcce7968caad
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 b4a9251b86e8073dfe7bdcc49aab176137d825f5a4ca359f176a8adb107a8a53
MD5 edcaba1b11f2b6eab5c58f7cfa1187f0
SHA1 6b3053516d31ac7bc952a14e77e6c8e8d5c6e332
SHA512 8e07982cb6426c9fb05ade1aeeb3d8ff657099632b251309f3006e0d456be035e1bccd5073eebfc6fab32a34f489f1ad872f133a83604a66e9ceab793daf7b9f
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7f4c202c44253005df36ab09b4e5af63758126eeaba46c159092b523bb3ae43b
MD5 3ce70a84b94e200c4ce202ded37f890c
SHA1 40c10a27f71f1c89b8d32d5e27b2ef2e4ad19973
SHA512 90cdefb9c4b1dba5ba43631b124fab7db508acc05a6ed9b2b9a3b69408f86b6c3b1f6b51aee45cbf7fb8ed5582c0f82a6ef216fa80a79a2f6fe23a4be431ca16
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 d889ff8bd7e622904e0f32a9319ca7e9a099d729cfff9cb8df3bc7392efb444a
MD5 bdaab9e1638496bbfa8d21d0aab88bed
SHA1 baab8e4792f8768ca1c4f0390024dadce3194b49
SHA512 a6f039ea4cd09e05338a05893e85e32d36e3e6be633df3241e0c94bffd4f7e63f7adc1ce8ec3793981547778afd2a31f6607b71592bc7cbe1a8cf18bce9b0f09
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 faa4e263b951d77fb79c5e9ba07e760a00ba5adfbb7f852f442dfd11a523a130
MD5 8468403b9ff7ae200757fc6c5fda6d8b
SHA1 101af75093606515cf2eb5bd55b4200499c9ca7e
SHA512 48f6f7afb742785dfe7e861e23deb9e89608c3c80d3090faca052e5dc200c0b056bb7394cd0ee2f9be850e48b99548b30b41a84f1be5bda68d490f5de75bc21a
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 48bdb5cabcedc7bc473274d3bba32779586b2e9a166543fb285fdbb85521caa8
MD5 11ce28c8a34862a85265e768906c1a5b
SHA1 1d7c0042deccaea8de369092432e8d9609a26e8c
SHA512 47a86c7d04a9106b6c2770a83c0b5883d16ae32de5aee79ad166f919d73fc4b9e6184740472f5f808f7b16eee233bc6774d717f8dc5c5a94cda863be15662fd0
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 938637cb174afd233b2529aaefc9dc9a1950b517fbf04bd730441a2aa1c81c94
MD5 bd2d50b9da7c2d6b5784b1d95f7af6b1
SHA1 83b9e80622d60ee49d28f9bf6835620d9fce5127
SHA512 0b78933e45fa59ca0825823f1f12eb08eb84d00a4ec28f1f51bda6bc90dc76e568499e204d4a0abb237dc1742bd38c0dca9b6c1c3bce21a4cca95d0e5c190ea2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 999c43317d27acec463ac472cc87a83d036cf0ba4e19cb12f91d2269038ebae2
MD5 aec1dbe7718eed59dff17d274c0186c0
SHA1 7ddf2dd051cc151521370f05ea1c232bbad62136
SHA512 13f4fc2ca2e7d7e3333169d4b366c06e79a970ee7c336b8adef8c8e36d90584a6ece34d894d28364a840afb71d54e7b9f2e9263752a147dc416faa75c2b9b98d
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3124d652c93b5da65d0edb2543b1a7b11df3aa165adf795f37386c011add027a
MD5 797f44e148c7b5deabdaef8cb78f9ed1
SHA1 5993ea45bf55f5d6f1d8cb6a71dad6777dcae136
SHA512 0b44ae6dadd2d7caccb78c2592fa16c0aaed7c778fbafaf8be37f64d5deb2b8a2e53a7fd1fd89b0e1de9c92cd8386193980732110eab07949171b56f59b29e8c
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 ce4d56efae6dd6861b26bbeaf2f36596ca843403f7fbf2e4ac93e88ddb805938
MD5 020c12230c8769debe993107c6e4f158
SHA1 ed89dbe3e842e96eb62a268f7a0d9eaccbce5a4f
SHA512 9ce2156b38a22122f9c6a5f01e4a9dd54783d4bdd3369a75e361e552cff93fd941f1e5fb3d336fd5896683f3164dc4ce2e644db39ac12b56c7f24b15159abb8a
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 cc8da6944054431b5c2a2a69bc8f610740811d4d6f5c0e94aba9362d913acbe4
MD5 702e3bbfb3814367ca9a8a3ae2050be8
SHA1 1cca86cdaed6f6d3247854af8b5d42a1337a26f1
SHA512 8108189f00e40dbc7dc7d33684d6ab5ccd9d29452a021f367ecd2f683e74f753840af3c0578ab79ed586f537fc26574e595994b6da2bbf89b431a2a5c1d7a550
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 be60865c9b09e1870179f8352945e5e3c1a9215e285e0aefb623758438c15594
MD5 7e6b1955e24209ab0e3bf07c72669087
SHA1 de6b4468ce80a5523d0a49b91385a0b0bfd02463
SHA512 b4f59fc5f511d717163e26dd01c23e710833f6c78bf16992f3b94f594c8044035a07bd44b8e06e5c5461af68a9337b8d5da098e0bc11eac5aa97273e27c22b49
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 23dc41b0ab6fc1bbf5835c869a781dc5b959d0886a0a6e2b7efb35f11339d51d
MD5 a61be8ab2bc1c88c45f36092cda73302
SHA1 44521aa0e4893384b2f330ffb54fb53ce604bc02
SHA512 ce1a05b4a91add89ad46cc0c1d8ca3dcaa20f8e2750330e29f748e285627bab47b3c30168b0fecbee5615c9b9273c3d68530963a1b557c24467994be92cfd523
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 224967841711637028bb8ad776d5950ef828cdaca55fe401e3d943270a4c6a15
MD5 26f23b73ec75f2541241c47f71e0b07a
SHA1 2ab50bf3a63abe141820ccdb9fa067a2533eabb7
SHA512 80d8d6c741054186cf4d1809055824761c3100852579efd245e3b842b607f8ddeda4a328ae9cb79c1e7575e4ed055a10b333a81435f2d5c5c1e65ed5b862caa4
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9abc000985a7c110c46a8ede00fd1d35a71b39c68b75d3e5e7434f03dc16a114
MD5 698a781a83c87f86e5564aa10aab5fde
SHA1 41d9b8de9dcf42c40eabe5a372f0c442b72937a0
SHA512 a626313e30556af7ccf25394785ce177ee0e0f53b373ce16bc56102adac8576a6951a4c3d56bca1636a79ed52134ddff55e0ae87fb133953fb128191129507d2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 196a41ff98b9e5434a3903000e25ed3608adf7e20e87a8823e682dc81f2a279f
MD5 adc86621d17318fc3e5ea846f4001a41
SHA1 fd20516490db055d74d4d4b3018b240877e94875
SHA512 8a125d2e170f85d29283740936df41eb40efffe3216fd906f45c0df444549bae42360d752b52331e24c52d6f895bdd4f79181571838188730d75a02e257cea83
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9fc18a7fa6837245e1c540825de93313b264a0c5c286db7a1e7fb424bbaef61b
MD5 ddb77901f547f9ab9c7067009ab45a01
SHA1 94042ae8153ab1878c35397e9d8a35e283089792
SHA512 512632eecda4eb12a07cc593e98236a55d04d8a8769cc6f78a3f4788e67f4c3c46b7ea0d7b65ec15b8bffeba9f11bbaab1779b3926becf084de11aa83146bd4d
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 d0114d9e0741a7af848b90ee05f523027f5e0bff10196bb4b9e8c504b728b75e
MD5 4c66d9cda6390e46336672a793640630
SHA1 10715f09d50974ae1d815c25ac5727a925161b61
SHA512 d4ed7c4b3b03d15d88004b1e1fcd275abc7635b317d85d879d2f2ea8f4e82f81400fb7ca959c2dd80709397f66e9ef2b969f88132997189c5987895ba8b0aca7
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 6ca862e5ac045adbd9b693d016e3e6cb31f5626faea2c4a47b6ed80473e63cd1
MD5 e7bb72a35b0c7d1a256e7fee048ebe0c
SHA1 5d686ca94aec1009a4df8969ac101ccde58ce620
SHA512 d72bf968a8fc477264ca8bce7897f80262ca4f7b65a836d0a9a5d7cc2e28aa5d0691d16a67c7c9348021bcf2286cd1b789f667db163644518c0953ccc0dae976
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 eea24886466f5fa4379d45780e646370d5f861cbc00feffff52fc2c696f7fcff
MD5 50ac64b2b2a524ab8b12cee6592576fd
SHA1 b62ecb897dbd8acd9a4fdf1bfa00cb9810f19d52
SHA512 a2d6933f483b870317f8dccc04f9fc7b15158d44920c149b4476dfd762a485b39832a13d3594bce84b339f60e8e63ef9f97b328b5c246d0777f54704c6f8ab0e
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 67fe5b47655bb5ddddf0a4b7b65dd7691031d5b08eb070016af72d4ccba470c8
MD5 bfb3f7d0717dc02e66554f1067afafb0
SHA1 575463bbab0ca565c53e0b5b416e8835d290e174
SHA512 b45ce7bd911aea16bd0925a73323fe765d49bd378be0246b616ce9c26e0618daddae9ce5e8eb00cf9c57a133ef9eb64fc9602920b5b2f9e1c01f69b73660bb78
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 30455a1510efdda96a4fb1a2553b1b383175b450d522f12ca1e8348b55a975fc
MD5 323c1212d1b0ba58df9fa11d3d79ca6b
SHA1 424ce5d46a83a9d48599e12aae19314c4c8a051f
SHA512 e30b69809b2a292408759140eae5de5aae18ea444eef8fa0e52270f7fd1204b842125aa88f41a88dba259f441a6f78af3539c8fc3c4a66cd085c5a360b468f02
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3fcff8d2f34f8756c957f2397f52832cd51a72250d9918de2039979cbcc43987
MD5 e855fb182574d59fd349a759590c0f69
SHA1 441e0469dea1a9a1c5a73a92ab726a44aab746b8
SHA512 171d069431b4eebfc2c84d83bae5e2e72bd60b2952ea38262fdb60dc6d39e97cefc043414382c198896206a28342e656cb5269465e56b2f25709c11c6a23292e
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 eab853509f2896e15745b3bd45a4d52ab8fa435408b32769597f777eafd6ede5
MD5 440147cbb70660aea2b6bb917d8025ff
SHA1 ad09fa77703ae0acc6e04f3793ed3bf104ac1117
SHA512 bc6440f60c316dc22f6e3238f6287bad9b8fe3e3b5c9ac1fbf952b8197ef764e06b694e38e405a86faf9d81599f2666a3d1bf24a6bd585e07833e129c91a09f2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 671614f6b939adf420caee2a47bb84185c6f5c583f0815429b8ec6ae3cd61850
MD5 d878af0f21fdf47037d22f8724e38fbf
SHA1 ee9273b2bb8b6ec7fe67f9de3378f13a47f66b75
SHA512 0c00dca3863ed013015d5732e37fc32e5fa93583eaba145261b786463ca2f94a5466083c5e2ef5e328d7da97bb95c81239bf35a7916d8ee137ed0ca34d692ed2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 db572631e9b6d5036d194ef9ebfdea68bd2126f4de00475c5774758296850fbf
MD5 f22451e3d8e155b180f5c2acfdc82240
SHA1 5b8040f025558b3d4018b7d04c14e21b0a3e28cc
SHA512 3e10c2451016e63588aa59874d733799d6c988462b8638e79ed78bf086e8243f2761dd8b035ed133731e3189d067f77dce0c56dba7ef80eb45be59d0201500bd
MD5 SHA1 SHA512

Submit Download

DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
Size 471B
SHA256 9d2ce1c032646d2a3381b68bc9201e3dcd53b764e83a0d356d67cc4926ece015
MD5 a50b718c3518b630251fb54b92bde360
SHA1 a9582222b6f4df2b4e3e4ee5fe91d25ff086b943
SHA512 95e0676e3177262d29c4105edd4ce1fa1c2a2da5cd3289ab0f873fba782a0185e4bbede5d64fae1f6c4cea5ca3ae0697d7113e6ee63f229431bfaf3f8990c517
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 9ebc694d4895efc802ea27714a71986f293edf4b63e9918c27d65871b06f43a9
MD5 80be6efdf5a776659777bf07d4aff891
SHA1 1f98e7ba8de8c6b39f4b202739ca71fa2629fd6d
SHA512 03a5434f25209a74a0abc6045c66a45e098d487227cab71004363c8c823840b49596857e8f757f42b8953f9bc2066209b1e8f52104d1837705828cb2676119cc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\CURRENT
Size 16B
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
MD5 f5cfd73023c1eedb6b9569736073f1dd
SHA1 669b1c85ecbafe23c999100f55a23e06bf59ead7
SHA512 5d8c1aa556fc17d6dc28d618f521aee37fc0e1826fdbcf8d106e456fc3bcd3c76e712d23fef3378bd2be17b80eb5bfd884ccd89b67490b63c7bd118eaac471d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
MD5 b203621a65475445e6fcdca717c667b5
SHA1 c17fd92682ca5b304ac71074b558dda9e8eb4d66
SHA512 ed68f5f49945dcd0d81dfebe2f2fd1fcfe016807d5c64ee0377d046efeb0a7fd9b4b9589b3df8a14194d51dcffbd89c8aaa072cea2ad4e7976bdf53528ea90cc
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 bb7907518ae9e1f695e7188b7b22ae2535497428c8fc7ef112adea04514db95b
MD5 443e36e2a145d6a6dfa8fb6f120f0e1b
SHA1 6620de659b70f25890a99ab129753b1f052805a8
SHA512 785b5fd21cc10c738952ef708dadaad16880b782885c16027b404f91f1b582522193544ce6fe6497eae4b457768e8ce6ec814d693c7cfe1ee9daf0f03b7cef47
MD5 SHA1 SHA512

Submit Download

77457d45c9d9cc4b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\77457d45c9d9cc4b_0
Size 380B
SHA256 08c3e5bbea4fba57201a69d4bf70a0d255df921fdef4924c22da087f9338c2bc
MD5 9ed1bb09f1363bd8feca8a5702f45b5b
SHA1 7b1d042c4522032622690060957dbdbb5eb1b805
SHA512 47e2f52d8233d0429680445cd307d1124dc2236678f0575bc82c811c669790abe8f8161da9c40e1ab45812f3ec1eeb2687f61f0dd7dbf3eb23a22842f49ab8ce
MD5 SHA1 SHA512

Submit Download

d0c785cf7bd14d98_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d0c785cf7bd14d98_0
Size 293B
SHA256 62267e61783482d0db21699ab92de9a2cce4efb9fe9306137406a277afb7a5ad
MD5 3d5bc884d137ccd86a25f978a7800818
SHA1 b5a16bb9ab7be5deaeb6a56daae13ef450e8e307
SHA512 1daf543de4ea6c16f308256a107077a69f920b7a67d669cdd0dffb62af4c261cb145872ebf55a728ba123606c1faa6108b62a7ce9afffbf6d469378ec42a8fc6
MD5 SHA1 SHA512

Submit Download

defef86dd0449b2e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\defef86dd0449b2e_0
Size 257B
SHA256 6c934d0cdf9dba94b474d6d1929f16739bd9a8ed31d0c3bcaf82c283fb7a3568
MD5 9b7eeab7d5643bb97d4595d6b3ba7c6a
SHA1 5ee50d675c809fe59e4a7762c54b65837547eafb
SHA512 bc5bfa962850742a502759b477df26cd53716fbd3864a53f3eb726530b535e8074bc55b5d95a8b516c835564037b6c4a8dc41b561ec5e1a8b8f01d4a0b765ada
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log
Size 33B
SHA256 7f9c9e31ac8256ca2f258583df262dbc7d6f68f2a03043d5c99a4ae5a7396ce9
MD5 099a150e83972a433492a59c2fbe98e0
SHA1 01ec548baccbe69625b54206ef7100f5ed03719f
SHA512 3d4321d657903224b06051eb2fe69f0e1bd5b1e12f1976f09b39fa5ed2705228b2f384fd98ef1f221081730da2ce1cb2fbbf4854260def49998b429facece3ba
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old
Size 319B
SHA256 5ae57b4b565d5727d851bc4deabc291fb9b7e4d06967324d9a7897da6a8c40b8
MD5 05292ae368555ae1dbde635f071b0369
SHA1 57e083ab3eb5ba9912d9c0f46aa108d0b09c73d1
SHA512 ddcfb299e378bdef1d01cba9814e45238fec7ec65997f305fa7fc086579bf45c67178744d3a902caf624c6eba19aa332b86031ef1c0639fd26fe1db7eace5abf
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old
Size 323B
SHA256 e1ce337635c2684f43024a67656880ad3cc19cd94aecb2b47c18f13312067508
MD5 c4a74966fcbe9818f465c7d7d8665695
SHA1 23d3c9d891e7058882d254d4b28018ada42a4f3a
SHA512 e445849325a268d0d59f6a110db96cd048e4ef79747e1462859311505723a1774893136be36798af8938ac5936063fbfdbe0445cfbaa471b64211229ffed2c4f
MD5 SHA1 SHA512

Submit Download

chevron.svg

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg
Size 295B
SHA256 7ad890fffffbfc85658865ec18f2e988f49b1432a521bf3e0253d382e5ecc00e
MD5 cd712d66af0c4cb9679423c976a2ca45
SHA1 d3dbb809cbc873b4b50d2b6f22423600327549ba
SHA512 92ae2c26460f93f1db561286aab16ed2a0272005e80f72c62f677640ac713be685125b6e6c673883d195c9785ffb50f5d55286ea77f62f7fa9a96a6a40b62317
MD5 SHA1 SHA512

Submit Download

header

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\header
Size 72B
SHA256 834a709ba2534ebe3ee1397fd4f7bd288b2acc1d20a08d6c862dcd99b6f04400
MD5 ac3b5a19643ee5816a1df17f2fadaae3
SHA1 0d0e47938f6e00166e7352732ddfb7c610f44db2
SHA512 5ec97cc048a3cb5da03093bc6d2b63cf5252abab6a72b24214ff885c062f58dc43c6cc05c0dc428a1a4e4b95ea84140a8883d81795416281b4ac4fd52290e0a1
MD5 SHA1 SHA512

Submit Download

social-track-digest256.sbstore

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0dqsscpq.default-release\safebrowsing\social-track-digest256.sbstore
Size 298B
SHA256 314f47cf9b9e4e05c5e965e82dd2751a934c094b481a00291e9e11f21d0ec4ee
MD5 f8604af8f8b94ba9236cadbbcf392cf8
SHA1 7720bd804ab353ae41f553f998fffea14764a79a
SHA512 403c7e18334b038f0943ab55ab9a338b3ce8efd0f25f4520e9a184f1c4948303e535ec9c1d9fef0f27c086281f0ed0112f396e8fb2e289da666f0dc94b4ca6d6
MD5 SHA1 SHA512

Submit Download

~fs_intro.gif

Path C:\Users\Admin\AppData\Local\Temp\~fs_intro.gif
Size 2.1MB
SHA256 244818306b5dcbe50657a4186e3b49abb63a97f9cbed884a00be92d243b334e5
MD5 9bd6a2413d92562db9479c004272f7bf
SHA1 2746f4b97ccbddd2709afb3ffb1377c3b363499d
SHA512 7746eba16839d57cfad70892d38873f3235948d076cc82dfb8b0e956969e93cea6bf62b346a0bb747ee85b4c76b0ab4aae425538416cd1fd067efa1418eff134
SSDEEP 49152:NN+ij2klKm9QQRkxpO2C4cYRYzPDpKQnP4AW15yO9afF/:X+i6m6QRIQPCe/
TLSH
T10DA53397977F618B4D0C743C50E9BF324698F8A6F1D8B988926CFAA1419F44D73B4260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_l.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_l.bmp
Size 57KB
SHA256 966987027f6a9e0d9320a0f081514a546fed2367ad783557aae24edd33f68149
MD5 fde2e95ea1d0a2e351dfe861301fffea
SHA1 3e17cb409feb498a9ffaf714b9916714dfc01ada
SHA512 19271ad92ffc3eaa10c2953af3f8b9a74d4ae2263250806ace6df016863bc1a6b4ed01f18e7b798d4226fb150c58cc2c18ca543ebdec2053e6f79908c1cf5efc
SSDEEP 768:waVUkM//1uzBqsDSOZ4/RNW6g0DFGB+GS:RKvl4ch/R8z+V
TLSH
T1C0436BF8E655CC979869F4A3E3C2ECECD82239364911BCFB112706CC08E53D5996EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_sk.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_sk.bmp
Size 27KB
SHA256 0107733c1766851db84df696fcd760ea651369cfbd36a675e1217e68cf1f73bd
MD5 b305413489e78c48825a48359bb58f7b
SHA1 7e9351367a2b761b7e36c15b5bbaddb95d0963c6
SHA512 c10f78b15d97cffd180bf7f559db32b4cc7e8cd52b10426eabe159469d64040b0041fd1e2215774fe204885ae01d510c5177354c658e69b0ab6e5a131400b96d
SSDEEP 192:id8JS4vU0JESveiYCd5Om6LsyfZLXCpM9qqo70+Wom2E1/WG8sqb9at3Wqg6fclg:+iTfzoswe70+krz3JUlVMBwOUjzZoaG
TLSH
T15EC20743BF089A44F8222D3590F21719BBA4EAE82369D3876745E436FCC21DC6D762CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_w.jpg

Path C:\Users\Admin\AppData\Local\Temp\~fs_w.jpg
Size 23KB
SHA256 6418e352bc431b3df0db043ab94880fc1bfe915ea46947d45952294fd8f316b1
MD5 b8ed50397c20cbae4198cb91e8f0f5ac
SHA1 78ec6f04d74cb1686d04eae557ec39f255006ccc
SHA512 fd6d7eb785a2fc3da8c02cf23e9d44e73dead35c984b8aaecac6a974990bfe5cec0867a063c6e62ea5d10da8c9d9077bd6dadf8aa99219e826923edc10abc1cb
SSDEEP 384:ox/r25BIVxVSYIKF52cK1C6b1BDvH/qHaWRHIu5K+aXhgKObJALF4EVQU6xUEjd/:oxTyBIVnDjAzGXxaRglaO+UCZPIX
TLSH
T19FB2E1193D70A04BFD8C8A3612CEAB7B023B74784880065D3476D399FFD75A2C6699F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteConnect.ps1xml

Path C:\Users\Admin\Desktop\CompleteConnect.ps1xml
Size 881KB
SHA256 23d3cb3134abf63cd0a60a3aa9bdbebd53463cde1cee1bbf0775941655da2dba
MD5 6a84b7cace51c199f3cc8a573108b59b
SHA1 c9a68f2844140356ffb47213c0d429e7913980cc
SHA512 49ffd3031bda029cbe0e1c8b97e10b1aaaa3d7b1ec786095769b817a6f53f977c2ecb6f98c72c8388ffd6263d33950d715d36ac19176a93f93a5987be5d50332
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlockBackup.rm

Path C:\Users\Admin\Downloads\BlockBackup.rm
Size 442KB
SHA256 0648c22232389ba47b2ba3849cac9b4457c8f1f80d40371aeddc83d01a5aec7b
MD5 1f6eb0ff37453f104db4a06afadbd78b
SHA1 114aa7c3d8355c350e136cccfacd76b198c53d2f
SHA512 b87074c0bcf44bac543a7c925d50ad5e23cfa55a0ad252bef3ab130ff5101149a629bf61acdc785bdf4a3007219758c48257b52f42eee4f2747455b343f71a6b
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlockBackup.rm.lockbit

Path C:\Users\Admin\Downloads\BlockBackup.rm.lockbit
Size 442KB
SHA256 d532f89b1bd3d4587879cc5af33c34e2c41de0220b0efa85cc4a4a5aa82f34f4
MD5 23e17b8c034e85fa041555294a471da4
SHA1 74a403a99f6579a9a5bb890cd6e9fc8284fd9f9b
SHA512 ca1a6fb781afc07eda85167f525ed38601d2b401d5c52ebf04df0822b83a92070009993bb73b721e36a033ee794a3065a61d3aeb67fe7643474d835baa62209b
SSDEEP 12288:rhsZdguRd8+tYhwC4QoS5xAClBzfmJkihqQpAtES54:t+guRohROS5qujmJki8AO4
TLSH
T1E1A4232FFF6B2067E255B93338E46256E5D1187D7D5362F258C3C0A093A3948E679C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointStop.xlsm.lockbit

Path C:\Users\Admin\Downloads\CheckpointStop.xlsm.lockbit
Size 805KB
SHA256 fcdb638c247d20076cfa2b7fa507552e6ac978c727d5ace7ec44156ab39ac10d
MD5 84881300e1ce681c7dd5579b44d9c5b8
SHA1 b2fb8ea8b6c47d484b01728480f701184466e480
SHA512 124fa2b075623770327879db858325d6f7bce1780aa66852fff1c5a795e8ed725663dbdc8da064b340452ab5be6a0797b0918cf239c57821ef681c50aa319c10
SSDEEP 24576:ZoaMLpaG2IQ+0DnQ5sQlDPbWLXF8w7hXce0Wow:ZoBtYjXGsQl/zM
TLSH
T1600523FCCA41B849E8F87495A5D16BCBB98AE328C094D9505B542A12F4CCB2CDFF5B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 696bda342649ec9268da57b6a279df6f24b0e857d5e6d0605fd25af95adc3cee
MD5 5d2a33958ebe530732fd9c258850c5aa
SHA1 8a1d854c73b0a9adb04dc4db317a0b9dd1708b76
SHA512 561c0480b0cc5f75acd24f9ea36f4e6ddee35261a0fd75ec2c495e940b6e7d41fa024110b58aa9bc2f6c69736cceb6cfbbb6198d9c50ad8965d6d30067bb52eb
MD5 SHA1 SHA512

Submit Download

memory/4564-5439-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-0-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5681-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-4981-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-2017-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5047-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-887-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5113-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5617-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5179-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5571-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5246-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5505-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5313-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-4871-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4564-5373-0x00007FF6B61D0000-0x00007FF6B6319000-memory.dmp

Download

memory/4948-4951-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5020-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5484-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5286-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5551-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5219-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5352-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5153-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5418-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5087-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5604-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-4823-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5656-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-4950-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

memory/4948-5722-0x00007FF748280000-0x00007FF7483C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads