564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
COPILT.exe
Size 89.0MB
Sample261012-3fagfssxay
SHA256 564f23a904b3811e430a394dcc40699d66e1210f9810d4ae1fe26a93ad4a39b8
MD5 e5b888cf4f3084163c64f0608741a634
SHA1 75e19d26637e16046ebcbeb30953393220bdb5dd
SHA512 0c76e3f564c41e4ee698137ccd05c104443951b826ad5baaac3246ac877db5ad48a6a0e59b4e708e1dbe0c89022d64378459a69e6d66f25ae087f2d4c623f405
SSDEEP 1572864:jUBcVqw0hW83VmEPqb8iu6E6HvqwtizGtVKP0OiuB+laGRu:Av30EPqb8i3Hviz0a
TLSH
T1F918333FB894C981B18D91BCC5421CDECE41DA9F69EF9DC41B5EFE42A425A4E8E93403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3320	wevtutil.exe
5228	wevtutil.exe
1720	wevtutil.exe
6216	wevtutil.exe
5876	wevtutil.exe
3744	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (1876) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	COPILT.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	COPILT.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	SecurityHealthService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	COPILT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	COPILT.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com
11	discord.com

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	COPILT.exe
File opened for modification	F:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	COPILT.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	COPILT.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	COPILT.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	COPILT.exe
File opened (read-only)	\??\M:	COPILT.exe
File opened (read-only)	\??\N:	COPILT.exe
File opened (read-only)	\??\T:	COPILT.exe
File opened (read-only)	\??\Y:	COPILT.exe
File opened (read-only)	\??\K:	COPILT.exe
File opened (read-only)	\??\P:	COPILT.exe
File opened (read-only)	\??\Q:	COPILT.exe
File opened (read-only)	\??\W:	COPILT.exe
File opened (read-only)	\??\D:	COPILT.exe
File opened (read-only)	\??\I:	COPILT.exe
File opened (read-only)	\??\J:	COPILT.exe
File opened (read-only)	\??\L:	COPILT.exe
File opened (read-only)	\??\V:	COPILT.exe
File opened (read-only)	\??\X:	COPILT.exe
File opened (read-only)	\??\H:	COPILT.exe
File opened (read-only)	\??\O:	COPILT.exe
File opened (read-only)	\??\R:	COPILT.exe
File opened (read-only)	\??\S:	COPILT.exe
File opened (read-only)	\??\U:	COPILT.exe
File opened (read-only)	\??\Z:	COPILT.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
10	api.ipify.org
1	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	COPILT.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/960-0-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/960-11-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/960-10-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/960-3822-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-3824-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-3934-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-3949-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/4876-3950-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4013-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4021-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4080-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4087-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4146-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4153-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4212-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4219-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4278-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4286-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4345-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4352-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4411-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4418-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4477-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4484-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4543-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4551-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4609-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4617-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx
behavioral2/memory/960-4676-0x00007FF79D550000-0x00007FF79D699000-memory.dmp	upx
behavioral2/memory/4876-4683-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6244	cmd.exe
4932	cmd.exe
708	cmd.exe
1112	cmd.exe
4636	cmd.exe
5716	cmd.exe
3376	cmd.exe
4900	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	COPILT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	COPILT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5028	vssadmin.exe
1424	vssadmin.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit	COPILT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBitEncryptedFile"	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon	COPILT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	COPILT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBitEncryptedFile"	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\icon.ico"	SecurityHealthService.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4000	WMIC.exe
4000	WMIC.exe
4000	WMIC.exe
4000	WMIC.exe
6200	WMIC.exe
6200	WMIC.exe
6200	WMIC.exe
6200	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4264	vssvc.exe
Token: SeRestorePrivilege	4264	vssvc.exe
Token: SeAuditPrivilege	4264	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4000	WMIC.exe
Token: SeSecurityPrivilege	4000	WMIC.exe
Token: SeTakeOwnershipPrivilege	4000	WMIC.exe
Token: SeLoadDriverPrivilege	4000	WMIC.exe
Token: SeSystemProfilePrivilege	4000	WMIC.exe
Token: SeSystemtimePrivilege	4000	WMIC.exe
Token: SeProfSingleProcessPrivilege	4000	WMIC.exe
Token: SeIncBasePriorityPrivilege	4000	WMIC.exe
Token: SeCreatePagefilePrivilege	4000	WMIC.exe
Token: SeBackupPrivilege	4000	WMIC.exe
Token: SeRestorePrivilege	4000	WMIC.exe
Token: SeShutdownPrivilege	4000	WMIC.exe
Token: SeDebugPrivilege	4000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4000	WMIC.exe
Token: SeRemoteShutdownPrivilege	4000	WMIC.exe
Token: SeUndockPrivilege	4000	WMIC.exe
Token: SeManageVolumePrivilege	4000	WMIC.exe
Token: 33	4000	WMIC.exe
Token: 34	4000	WMIC.exe
Token: 35	4000	WMIC.exe
Token: 36	4000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4000	WMIC.exe
Token: SeSecurityPrivilege	4000	WMIC.exe
Token: SeTakeOwnershipPrivilege	4000	WMIC.exe
Token: SeLoadDriverPrivilege	4000	WMIC.exe
Token: SeSystemProfilePrivilege	4000	WMIC.exe
Token: SeSystemtimePrivilege	4000	WMIC.exe
Token: SeProfSingleProcessPrivilege	4000	WMIC.exe
Token: SeIncBasePriorityPrivilege	4000	WMIC.exe
Token: SeCreatePagefilePrivilege	4000	WMIC.exe
Token: SeBackupPrivilege	4000	WMIC.exe
Token: SeRestorePrivilege	4000	WMIC.exe
Token: SeShutdownPrivilege	4000	WMIC.exe
Token: SeDebugPrivilege	4000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4000	WMIC.exe
Token: SeRemoteShutdownPrivilege	4000	WMIC.exe
Token: SeUndockPrivilege	4000	WMIC.exe
Token: SeManageVolumePrivilege	4000	WMIC.exe
Token: 33	4000	WMIC.exe
Token: 34	4000	WMIC.exe
Token: 35	4000	WMIC.exe
Token: 36	4000	WMIC.exe
Token: SeSecurityPrivilege	5876	wevtutil.exe
Token: SeBackupPrivilege	5876	wevtutil.exe
Token: SeSecurityPrivilege	3744	wevtutil.exe
Token: SeBackupPrivilege	3744	wevtutil.exe
Token: SeSecurityPrivilege	3320	wevtutil.exe
Token: SeBackupPrivilege	3320	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	6200	WMIC.exe
Token: SeSecurityPrivilege	6200	WMIC.exe
Token: SeTakeOwnershipPrivilege	6200	WMIC.exe
Token: SeLoadDriverPrivilege	6200	WMIC.exe
Token: SeSystemProfilePrivilege	6200	WMIC.exe
Token: SeSystemtimePrivilege	6200	WMIC.exe
Token: SeProfSingleProcessPrivilege	6200	WMIC.exe
Token: SeIncBasePriorityPrivilege	6200	WMIC.exe
Token: SeCreatePagefilePrivilege	6200	WMIC.exe
Token: SeBackupPrivilege	6200	WMIC.exe
Token: SeRestorePrivilege	6200	WMIC.exe
Token: SeShutdownPrivilege	6200	WMIC.exe
Token: SeDebugPrivilege	6200	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
960	COPILT.exe
960	COPILT.exe
960	COPILT.exe
4876	SecurityHealthService.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
960	COPILT.exe
960	COPILT.exe
4876	SecurityHealthService.exe
4876	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 4636	960	COPILT.exe	90
PID 4636 wrote to memory of 5028	4636	cmd.exe	92
PID 960 wrote to memory of 5716	960	COPILT.exe	95
PID 5716 wrote to memory of 4000	5716	cmd.exe	97
PID 960 wrote to memory of 3376	960	COPILT.exe	98
PID 3376 wrote to memory of 4532	3376	cmd.exe	100
PID 960 wrote to memory of 4900	960	COPILT.exe	101
PID 4900 wrote to memory of 5876	4900	cmd.exe	103
PID 4900 wrote to memory of 3744	4900	cmd.exe	104
PID 4900 wrote to memory of 3320	4900	cmd.exe	105
PID 4876 wrote to memory of 6244	4876	SecurityHealthService.exe	108
PID 6244 wrote to memory of 1424	6244	cmd.exe	110
PID 4876 wrote to memory of 4932	4876	SecurityHealthService.exe	111
PID 4932 wrote to memory of 6200	4932	cmd.exe	113
PID 4876 wrote to memory of 708	4876	SecurityHealthService.exe	114
PID 708 wrote to memory of 5316	708	cmd.exe	116
PID 4876 wrote to memory of 1112	4876	SecurityHealthService.exe	117
PID 1112 wrote to memory of 5228	1112	cmd.exe	119
PID 1112 wrote to memory of 1720	1112	cmd.exe	120
PID 1112 wrote to memory of 6216	1112	cmd.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\COPILT.exe
"C:\Users\Admin\AppData\Local\Temp\COPILT.exe"
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6244
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:5316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    PID:1720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    PID:6216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 60b7e6c7eb7edbe98ca9466616de7a903d8606e2f7bc48954d79fd4a9b6d86fd
MD5 2b06ba0ad6ec9838ed107b2e3b965bcf
SHA1 ab2aea5c62f3c14ede47067f5c5fae07d6ba8458
SHA512 4924ec9619fe66cbf9e7bb974c0c224acb2350a9fb670fbf2416e24739f626b3dc85db67045027b72145bc5eb2140ff4d05294e9697cac8bbe34f72fcaf1facb
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 fb0c2ec15516a8de0e1830e5e8fbcc21af066271abbb6e1a264180cc4cc04d41
MD5 8fb02b50865941bab2abdd2602464bb2
SHA1 a8a30bd0f39f10f40ce302f5467aa66cdff845cb
SHA512 29ca8f9e4f65d1bd0e3065e0a9cdc428dcf0e84c254dfcc74cd2f327a16369afe249f9a2f25051cf913ec9afb853dcdf26fe971ae69e0fff9dc53efb0cb989de
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 6b30ff4fc6fd98dc7986a8c93fd697ae83df6ba8350924a8b839a4d692e183ea
MD5 a87b8751fd54725bf6246bb4c9e05a8a
SHA1 fd6dbdbd25eb622651bc36f003f066708fdc8235
SHA512 9c6072299392819b7401679b7cd1d81bde466c312008154ce618fb7e2c214e82facce3cbd4d3104d305f9ea539ba4828e5ddec2755838b361a44ae760c8e74ba
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 16af440e8be8334ebb3ae0216d916aa5afddf93c7106a97abc88f409f3f118f8
MD5 46dccd0aa59a74727c4bcda48a3746d5
SHA1 ac03be4b0dfed56fa44dd1066355e4c22f87807e
SHA512 221413e11b7cf84aac1d9f70610af724c8ebe5997a779b983c7d20d414c8052c5fd25694d0007d28de7b8632d10acdf4d561167a494c0891355b5f80eb6b87b7
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9984f4fd7f6f6656361b08058193a5edb9f1d31ca8116ccf5834022af48c7459
MD5 7671883435a62b9771c17b49add68e5a
SHA1 dd6845386debfe27248e30d2c102d2957da39fa0
SHA512 0dec4311fc5f5de3a37fc4d4b671ec7d47a04771467422af97eb91c7b8b41bbbc819fe55739575a97ec1213c7339ba5df400ad0ed0281775c073bf2563e04231
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 2292f0242dda54d5cdbae4e28d7501efcf948bdae3f4038b2fd5653d1c82fe66
MD5 bc4b9cc9175a387511b78d162a8d16ad
SHA1 962c4f7ee8afd3d2fc51f4171c3b23a83353ee3c
SHA512 a2a9dc0e8a794668372334eb7c50cb084179d3624dec7968e63f7b26ff3663ddcf2549216bbdc5e619b1e859d765feed04c80d2a27268c286d657a3ae285e654
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 f4d12ff0db1784ca490f0170633a8f259d271e3f290a1d7ed0b262c78a41a6b4
MD5 06db456addff301485e9794b9f5237b4
SHA1 c2b83b78173f79b40175fcde1c8df3c1b4502883
SHA512 cdae75011071224f4807a489608460f5e446665351acad161cb1316d993bc8a7c3e0f10b1435f1ab04be8cd27a15c4d79e58ace861edc230e1b597da9fee4388
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 2e063d64b762ff7ab9eaea019ca30228d18601a91807ce9da865b70f429c53b5
MD5 6ab09e905b1ef67066c74fac3c2f6c41
SHA1 71dc2ff0ca0a17074a9c0c34b025d52f88ad26f8
SHA512 92c7cdb90d703177b939a69ed093a34a7839f90d15b5cf9420c7fa2f4b2ddc385b942c6ee0a8368b139cc7f4d1c30bbdc920dc2bb2026df325501ba07f62b8ca
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3b3ca68553ded637ddaf03b69e02e9b8b8a4f56b187d17426d88acfe3ec4d091
MD5 a1df49551214f71cb4132489d31a1c45
SHA1 ef734b144a8cd8e2754b22b17ac413868ce2ac15
SHA512 13e0a407850e158cf0c2002d5279b5d2b019a2c9ceb14b5ca6346fb29e801d3c483a05139701fbb584fa9772a300e76f357f92ce61946a3484dcdcce7968caad
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 b4a9251b86e8073dfe7bdcc49aab176137d825f5a4ca359f176a8adb107a8a53
MD5 edcaba1b11f2b6eab5c58f7cfa1187f0
SHA1 6b3053516d31ac7bc952a14e77e6c8e8d5c6e332
SHA512 8e07982cb6426c9fb05ade1aeeb3d8ff657099632b251309f3006e0d456be035e1bccd5073eebfc6fab32a34f489f1ad872f133a83604a66e9ceab793daf7b9f
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7f4c202c44253005df36ab09b4e5af63758126eeaba46c159092b523bb3ae43b
MD5 3ce70a84b94e200c4ce202ded37f890c
SHA1 40c10a27f71f1c89b8d32d5e27b2ef2e4ad19973
SHA512 90cdefb9c4b1dba5ba43631b124fab7db508acc05a6ed9b2b9a3b69408f86b6c3b1f6b51aee45cbf7fb8ed5582c0f82a6ef216fa80a79a2f6fe23a4be431ca16
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 d889ff8bd7e622904e0f32a9319ca7e9a099d729cfff9cb8df3bc7392efb444a
MD5 bdaab9e1638496bbfa8d21d0aab88bed
SHA1 baab8e4792f8768ca1c4f0390024dadce3194b49
SHA512 a6f039ea4cd09e05338a05893e85e32d36e3e6be633df3241e0c94bffd4f7e63f7adc1ce8ec3793981547778afd2a31f6607b71592bc7cbe1a8cf18bce9b0f09
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 faa4e263b951d77fb79c5e9ba07e760a00ba5adfbb7f852f442dfd11a523a130
MD5 8468403b9ff7ae200757fc6c5fda6d8b
SHA1 101af75093606515cf2eb5bd55b4200499c9ca7e
SHA512 48f6f7afb742785dfe7e861e23deb9e89608c3c80d3090faca052e5dc200c0b056bb7394cd0ee2f9be850e48b99548b30b41a84f1be5bda68d490f5de75bc21a
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 48bdb5cabcedc7bc473274d3bba32779586b2e9a166543fb285fdbb85521caa8
MD5 11ce28c8a34862a85265e768906c1a5b
SHA1 1d7c0042deccaea8de369092432e8d9609a26e8c
SHA512 47a86c7d04a9106b6c2770a83c0b5883d16ae32de5aee79ad166f919d73fc4b9e6184740472f5f808f7b16eee233bc6774d717f8dc5c5a94cda863be15662fd0
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 938637cb174afd233b2529aaefc9dc9a1950b517fbf04bd730441a2aa1c81c94
MD5 bd2d50b9da7c2d6b5784b1d95f7af6b1
SHA1 83b9e80622d60ee49d28f9bf6835620d9fce5127
SHA512 0b78933e45fa59ca0825823f1f12eb08eb84d00a4ec28f1f51bda6bc90dc76e568499e204d4a0abb237dc1742bd38c0dca9b6c1c3bce21a4cca95d0e5c190ea2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 999c43317d27acec463ac472cc87a83d036cf0ba4e19cb12f91d2269038ebae2
MD5 aec1dbe7718eed59dff17d274c0186c0
SHA1 7ddf2dd051cc151521370f05ea1c232bbad62136
SHA512 13f4fc2ca2e7d7e3333169d4b366c06e79a970ee7c336b8adef8c8e36d90584a6ece34d894d28364a840afb71d54e7b9f2e9263752a147dc416faa75c2b9b98d
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 3124d652c93b5da65d0edb2543b1a7b11df3aa165adf795f37386c011add027a
MD5 797f44e148c7b5deabdaef8cb78f9ed1
SHA1 5993ea45bf55f5d6f1d8cb6a71dad6777dcae136
SHA512 0b44ae6dadd2d7caccb78c2592fa16c0aaed7c778fbafaf8be37f64d5deb2b8a2e53a7fd1fd89b0e1de9c92cd8386193980732110eab07949171b56f59b29e8c
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 ce4d56efae6dd6861b26bbeaf2f36596ca843403f7fbf2e4ac93e88ddb805938
MD5 020c12230c8769debe993107c6e4f158
SHA1 ed89dbe3e842e96eb62a268f7a0d9eaccbce5a4f
SHA512 9ce2156b38a22122f9c6a5f01e4a9dd54783d4bdd3369a75e361e552cff93fd941f1e5fb3d336fd5896683f3164dc4ce2e644db39ac12b56c7f24b15159abb8a
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 cc8da6944054431b5c2a2a69bc8f610740811d4d6f5c0e94aba9362d913acbe4
MD5 702e3bbfb3814367ca9a8a3ae2050be8
SHA1 1cca86cdaed6f6d3247854af8b5d42a1337a26f1
SHA512 8108189f00e40dbc7dc7d33684d6ab5ccd9d29452a021f367ecd2f683e74f753840af3c0578ab79ed586f537fc26574e595994b6da2bbf89b431a2a5c1d7a550
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 be60865c9b09e1870179f8352945e5e3c1a9215e285e0aefb623758438c15594
MD5 7e6b1955e24209ab0e3bf07c72669087
SHA1 de6b4468ce80a5523d0a49b91385a0b0bfd02463
SHA512 b4f59fc5f511d717163e26dd01c23e710833f6c78bf16992f3b94f594c8044035a07bd44b8e06e5c5461af68a9337b8d5da098e0bc11eac5aa97273e27c22b49
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 23dc41b0ab6fc1bbf5835c869a781dc5b959d0886a0a6e2b7efb35f11339d51d
MD5 a61be8ab2bc1c88c45f36092cda73302
SHA1 44521aa0e4893384b2f330ffb54fb53ce604bc02
SHA512 ce1a05b4a91add89ad46cc0c1d8ca3dcaa20f8e2750330e29f748e285627bab47b3c30168b0fecbee5615c9b9273c3d68530963a1b557c24467994be92cfd523
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 224967841711637028bb8ad776d5950ef828cdaca55fe401e3d943270a4c6a15
MD5 26f23b73ec75f2541241c47f71e0b07a
SHA1 2ab50bf3a63abe141820ccdb9fa067a2533eabb7
SHA512 80d8d6c741054186cf4d1809055824761c3100852579efd245e3b842b607f8ddeda4a328ae9cb79c1e7575e4ed055a10b333a81435f2d5c5c1e65ed5b862caa4
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9abc000985a7c110c46a8ede00fd1d35a71b39c68b75d3e5e7434f03dc16a114
MD5 698a781a83c87f86e5564aa10aab5fde
SHA1 41d9b8de9dcf42c40eabe5a372f0c442b72937a0
SHA512 a626313e30556af7ccf25394785ce177ee0e0f53b373ce16bc56102adac8576a6951a4c3d56bca1636a79ed52134ddff55e0ae87fb133953fb128191129507d2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 196a41ff98b9e5434a3903000e25ed3608adf7e20e87a8823e682dc81f2a279f
MD5 adc86621d17318fc3e5ea846f4001a41
SHA1 fd20516490db055d74d4d4b3018b240877e94875
SHA512 8a125d2e170f85d29283740936df41eb40efffe3216fd906f45c0df444549bae42360d752b52331e24c52d6f895bdd4f79181571838188730d75a02e257cea83
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 9fc18a7fa6837245e1c540825de93313b264a0c5c286db7a1e7fb424bbaef61b
MD5 ddb77901f547f9ab9c7067009ab45a01
SHA1 94042ae8153ab1878c35397e9d8a35e283089792
SHA512 512632eecda4eb12a07cc593e98236a55d04d8a8769cc6f78a3f4788e67f4c3c46b7ea0d7b65ec15b8bffeba9f11bbaab1779b3926becf084de11aa83146bd4d
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 d0114d9e0741a7af848b90ee05f523027f5e0bff10196bb4b9e8c504b728b75e
MD5 4c66d9cda6390e46336672a793640630
SHA1 10715f09d50974ae1d815c25ac5727a925161b61
SHA512 d4ed7c4b3b03d15d88004b1e1fcd275abc7635b317d85d879d2f2ea8f4e82f81400fb7ca959c2dd80709397f66e9ef2b969f88132997189c5987895ba8b0aca7
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 6ca862e5ac045adbd9b693d016e3e6cb31f5626faea2c4a47b6ed80473e63cd1
MD5 e7bb72a35b0c7d1a256e7fee048ebe0c
SHA1 5d686ca94aec1009a4df8969ac101ccde58ce620
SHA512 d72bf968a8fc477264ca8bce7897f80262ca4f7b65a836d0a9a5d7cc2e28aa5d0691d16a67c7c9348021bcf2286cd1b789f667db163644518c0953ccc0dae976
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 eea24886466f5fa4379d45780e646370d5f861cbc00feffff52fc2c696f7fcff
MD5 50ac64b2b2a524ab8b12cee6592576fd
SHA1 b62ecb897dbd8acd9a4fdf1bfa00cb9810f19d52
SHA512 a2d6933f483b870317f8dccc04f9fc7b15158d44920c149b4476dfd762a485b39832a13d3594bce84b339f60e8e63ef9f97b328b5c246d0777f54704c6f8ab0e
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 67fe5b47655bb5ddddf0a4b7b65dd7691031d5b08eb070016af72d4ccba470c8
MD5 bfb3f7d0717dc02e66554f1067afafb0
SHA1 575463bbab0ca565c53e0b5b416e8835d290e174
SHA512 b45ce7bd911aea16bd0925a73323fe765d49bd378be0246b616ce9c26e0618daddae9ce5e8eb00cf9c57a133ef9eb64fc9602920b5b2f9e1c01f69b73660bb78
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 30455a1510efdda96a4fb1a2553b1b383175b450d522f12ca1e8348b55a975fc
MD5 323c1212d1b0ba58df9fa11d3d79ca6b
SHA1 424ce5d46a83a9d48599e12aae19314c4c8a051f
SHA512 e30b69809b2a292408759140eae5de5aae18ea444eef8fa0e52270f7fd1204b842125aa88f41a88dba259f441a6f78af3539c8fc3c4a66cd085c5a360b468f02
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 dc6bf738ae50ae7f383b9801e1562979dbeef8759b6dcced8f24aa1a28722374
MD5 2876f6185422fbe7410923e1f0ae4fad
SHA1 723bbd2677779de363fff03640b14d80bf417836
SHA512 c2ad293da98f40143576442910d74d0775e87d5a03bc9efb691ecd888021136f3158ab7fde5b18340c32a789c3820b4f17ce1db890b50c7a1a56edc0cbd5b5f2
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 04837d3e9793be8df880384e88f533685209a51a8f64f745f3c2ce69a9000a41
MD5 ed1f6b0f4a2b277474f00df94a1f61da
SHA1 22dc74e55bec925131727a11bfb0f15c282e33ae
SHA512 32eebd36e7caef69620babb33c03d0297fb3405041ade794e17237252b2bbf0f0764f5e2f4d9860b5a38d3c6436a331bda19e9ebed83ba84e8c18ba64bd59018
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 fb41c04a07b4261721dc2801da0746c306c5070a04caa31a292a9963c1b1823f
MD5 995cda2f0f9e44347f88de9b0d8668dc
SHA1 7bd91415f787765e2e75b665cadc69162ed3a9b9
SHA512 0c8856f65fc7634718b481333f1cda2223e3c5c01a0d4e18de4608bdefee9341ff7d63eb2143a0a555629466ec6b942422cc2df89d62e7335d01117d055c2598
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
MD5 f5cfd73023c1eedb6b9569736073f1dd
SHA1 669b1c85ecbafe23c999100f55a23e06bf59ead7
SHA512 5d8c1aa556fc17d6dc28d618f521aee37fc0e1826fdbcf8d106e456fc3bcd3c76e712d23fef3378bd2be17b80eb5bfd884ccd89b67490b63c7bd118eaac471d8
MD5 SHA1 SHA512

Submit Download

05b7b58901c86afb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\05b7b58901c86afb_0
Size 380B
SHA256 08c3e5bbea4fba57201a69d4bf70a0d255df921fdef4924c22da087f9338c2bc
MD5 9ed1bb09f1363bd8feca8a5702f45b5b
SHA1 7b1d042c4522032622690060957dbdbb5eb1b805
SHA512 47e2f52d8233d0429680445cd307d1124dc2236678f0575bc82c811c669790abe8f8161da9c40e1ab45812f3ec1eeb2687f61f0dd7dbf3eb23a22842f49ab8ce
MD5 SHA1 SHA512

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Size 33B
SHA256 7f9c9e31ac8256ca2f258583df262dbc7d6f68f2a03043d5c99a4ae5a7396ce9
MD5 099a150e83972a433492a59c2fbe98e0
SHA1 01ec548baccbe69625b54206ef7100f5ed03719f
SHA512 3d4321d657903224b06051eb2fe69f0e1bd5b1e12f1976f09b39fa5ed2705228b2f384fd98ef1f221081730da2ce1cb2fbbf4854260def49998b429facece3ba
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\946854b7-844e-4309-9c61-a036ad29d309\index-dir\the-real-index
Size 48B
SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
MD5 b203621a65475445e6fcdca717c667b5
SHA1 c17fd92682ca5b304ac71074b558dda9e8eb4d66
SHA512 ed68f5f49945dcd0d81dfebe2f2fd1fcfe016807d5c64ee0377d046efeb0a7fd9b4b9589b3df8a14194d51dcffbd89c8aaa072cea2ad4e7976bdf53528ea90cc
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 68b138c89671b1f8435c3ebeeff7720bc4ee002e907fe77787caed1d35d40e07
MD5 b43e3b0286664b420fa6ac3fe4cbff8b
SHA1 e228d2fc712a98603e69bec71ca7dd6fb950a56e
SHA512 cfad2fa8990f41c91f37244767bacdfcc24db8688dc6305fd8c6c2f9dd9795d87fc69213254965f622c7551bf1a6d3fa9e0d18aedec5eaef540d9ef7b16dc08e
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 2c34ce1df23b838c5abf2a7f6437cca3d3067ed509ff25f11df6b11b582b51eb
MD5 fd4b38e94292e00251b9f39c47ee5710
SHA1 b80de5d138758541c5f05265ad144ab9fa86d1db
SHA512 1080f871e39cc839e5bcc9f852f9a8f3ddc03cf7e72e9fd1d6e4a71d7e74936f58adc646c9a9dc382fde85c5d281c2a44a459caf6afa58272d7fa006152e4cb1
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old
Size 340B
SHA256 480c52f030d9e55cec53a16e454ffe8f12b56b9d93a0dadd28f226af89393195
MD5 f129cbd00a7078a50655d1145feac97b
SHA1 cac04499074ed54e382ee370bd1d39f6f317dbad
SHA512 5ab6bc4ad83f0f393e480e42f95e86c65b9c113392a85c40a2f4d5e8335b602bd6ae373d15775500b20e6199b129d6a0bbfe544dd5f029450026e289a5c18014
MD5 SHA1 SHA512

Submit Download

chevron.svg

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg
Size 295B
SHA256 7ad890fffffbfc85658865ec18f2e988f49b1432a521bf3e0253d382e5ecc00e
MD5 cd712d66af0c4cb9679423c976a2ca45
SHA1 d3dbb809cbc873b4b50d2b6f22423600327549ba
SHA512 92ae2c26460f93f1db561286aab16ed2a0272005e80f72c62f677640ac713be685125b6e6c673883d195c9785ffb50f5d55286ea77f62f7fa9a96a6a40b62317
MD5 SHA1 SHA512

Submit Download

social-track-digest256.sbstore

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\safebrowsing\social-track-digest256.sbstore
Size 298B
SHA256 314f47cf9b9e4e05c5e965e82dd2751a934c094b481a00291e9e11f21d0ec4ee
MD5 f8604af8f8b94ba9236cadbbcf392cf8
SHA1 7720bd804ab353ae41f553f998fffea14764a79a
SHA512 403c7e18334b038f0943ab55ab9a338b3ce8efd0f25f4520e9a184f1c4948303e535ec9c1d9fef0f27c086281f0ed0112f396e8fb2e289da666f0dc94b4ca6d6
MD5 SHA1 SHA512

Submit Download

~fs_intro.gif

Path C:\Users\Admin\AppData\Local\Temp\~fs_intro.gif
Size 2.1MB
SHA256 244818306b5dcbe50657a4186e3b49abb63a97f9cbed884a00be92d243b334e5
MD5 9bd6a2413d92562db9479c004272f7bf
SHA1 2746f4b97ccbddd2709afb3ffb1377c3b363499d
SHA512 7746eba16839d57cfad70892d38873f3235948d076cc82dfb8b0e956969e93cea6bf62b346a0bb747ee85b4c76b0ab4aae425538416cd1fd067efa1418eff134
SSDEEP 49152:NN+ij2klKm9QQRkxpO2C4cYRYzPDpKQnP4AW15yO9afF/:X+i6m6QRIQPCe/
TLSH
T10DA53397977F618B4D0C743C50E9BF324698F8A6F1D8B988926CFAA1419F44D73B4260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_l.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_l.bmp
Size 57KB
SHA256 966987027f6a9e0d9320a0f081514a546fed2367ad783557aae24edd33f68149
MD5 fde2e95ea1d0a2e351dfe861301fffea
SHA1 3e17cb409feb498a9ffaf714b9916714dfc01ada
SHA512 19271ad92ffc3eaa10c2953af3f8b9a74d4ae2263250806ace6df016863bc1a6b4ed01f18e7b798d4226fb150c58cc2c18ca543ebdec2053e6f79908c1cf5efc
SSDEEP 768:waVUkM//1uzBqsDSOZ4/RNW6g0DFGB+GS:RKvl4ch/R8z+V
TLSH
T1C0436BF8E655CC979869F4A3E3C2ECECD82239364911BCFB112706CC08E53D5996EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_sk.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_sk.bmp
Size 27KB
SHA256 0107733c1766851db84df696fcd760ea651369cfbd36a675e1217e68cf1f73bd
MD5 b305413489e78c48825a48359bb58f7b
SHA1 7e9351367a2b761b7e36c15b5bbaddb95d0963c6
SHA512 c10f78b15d97cffd180bf7f559db32b4cc7e8cd52b10426eabe159469d64040b0041fd1e2215774fe204885ae01d510c5177354c658e69b0ab6e5a131400b96d
SSDEEP 192:id8JS4vU0JESveiYCd5Om6LsyfZLXCpM9qqo70+Wom2E1/WG8sqb9at3Wqg6fclg:+iTfzoswe70+krz3JUlVMBwOUjzZoaG
TLSH
T15EC20743BF089A44F8222D3590F21719BBA4EAE82369D3876745E436FCC21DC6D762CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_w.jpg

Path C:\Users\Admin\AppData\Local\Temp\~fs_w.jpg
Size 23KB
SHA256 6418e352bc431b3df0db043ab94880fc1bfe915ea46947d45952294fd8f316b1
MD5 b8ed50397c20cbae4198cb91e8f0f5ac
SHA1 78ec6f04d74cb1686d04eae557ec39f255006ccc
SHA512 fd6d7eb785a2fc3da8c02cf23e9d44e73dead35c984b8aaecac6a974990bfe5cec0867a063c6e62ea5d10da8c9d9077bd6dadf8aa99219e826923edc10abc1cb
SSDEEP 384:ox/r25BIVxVSYIKF52cK1C6b1BDvH/qHaWRHIu5K+aXhgKObJALF4EVQU6xUEjd/:oxTyBIVnDjAzGXxaRglaO+UCZPIX
TLSH
T19FB2E1193D70A04BFD8C8A3612CEAB7B023B74784880065D3476D399FFD75A2C6699F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyWatch.pptm

Path C:\Users\Admin\Desktop\DenyWatch.pptm
Size 327KB
SHA256 d514075dc2e41c5e1c9223016a614a264c96b5eeb07a721ab1f1449855598deb
MD5 97290ed0dceeadc6f4d1d6e4eb9f766c
SHA1 dbc7914dcead85d455da77e4e493c9f3f9b81f42
SHA512 918dae6b7ae8cf71f92f73910fa42635e5987966e5f5803f74a4adc0f793ee6dfcc70e3c5f845b06880952ee1f5c3194ec5fcadbd0d3b2b6eca26f5ee4322db7
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupRemove.i64

Path C:\Users\Admin\Downloads\BackupRemove.i64
Size 444KB
SHA256 578428f7881df6696ad7c4587c9cc41d637a8b88d73ff0205f81f19a138a9782
MD5 68f3c69c9ee87c111daf992cb9484c92
SHA1 017c57be9d4ed1516924f20e5f6df64e4107b56d
SHA512 e367f1f2f3fc5664a71115d12f5814f05a52e35e2ae2a61c7ebaef42fea245872a73d2e34054024e104e5b14c7dcff4d0ab39ff5852488b734e89c66bb543728
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupRemove.i64.lockbit

Path C:\Users\Admin\Downloads\BackupRemove.i64.lockbit
Size 444KB
SHA256 1d37e7ed1a927ce56e8eaa76b55135e52a72d710a8702a461c68c0fdec1305e7
MD5 243ca355f387682b0adfb16ac64bd630
SHA1 ee2c4cb2e92990de9ea3fe5f67f5a0991db763a2
SHA512 00f785f3eb85260b6f4c6c2100356ac177080edff7d8f368ca14e844274464844967e2d9d83ed35ac6a8bf6abbf53ab14ad594b34082cb40e6527ed93c5d9529
SSDEEP 12288:GfPLdq8wr0xQ2a3mDKoLCMKNNuC3o0oR5j1:x83xlKoVYuzJR5h
TLSH
T166A42382CE3A250F1C6279B0BE16D1379BDCE19382A546BC43F4C566135A1BDCDBA63C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmSplit.vbe.lockbit

Path C:\Users\Admin\Downloads\ConfirmSplit.vbe.lockbit
Size 331KB
SHA256 09029599ad1380aebf115c6a166b85b3b094cb918300dd01eac409340dfa92bf
MD5 1d73bcc01410ef714abb1d7b95ff4871
SHA1 36a9468e40a2805bdeffce46ed593436d97d0235
SHA512 7be5d8148e86ef191184da7c91353f6a4bcd05b292e6e35416edcd3893f34a3bb8cd851a2ae6a22f9144941100846d0e05d4f3c87f0f4a0f6cefe713ea8819bc
SSDEEP 6144:G0ryWuUJZRhynJ4J8w3eV8u8bdVOucSDCxSo916Y8ZrREsAoR4CRO:JryWuEVyJhw0edwuPeSo9X8ZNFAoc
TLSH
T13B742315CB8EACA235881B7D602801AF3C2E572BC31CF376E55D57E26694A7E48F3B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 696bda342649ec9268da57b6a279df6f24b0e857d5e6d0605fd25af95adc3cee
MD5 5d2a33958ebe530732fd9c258850c5aa
SHA1 8a1d854c73b0a9adb04dc4db317a0b9dd1708b76
SHA512 561c0480b0cc5f75acd24f9ea36f4e6ddee35261a0fd75ec2c495e940b6e7d41fa024110b58aa9bc2f6c69736cceb6cfbbb6198d9c50ad8965d6d30067bb52eb
MD5 SHA1 SHA512

Submit Download

memory/960-3822-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4477-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4676-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4609-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4543-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-0-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-10-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-11-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4013-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-3934-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4080-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4411-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4146-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4345-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4212-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/960-4278-0x00007FF79D550000-0x00007FF79D699000-memory.dmp

Download

memory/4876-4219-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4286-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4153-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4352-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4087-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4418-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4021-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4484-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-3950-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4551-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-3949-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4617-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-3824-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download

memory/4876-4683-0x00007FF6252A0000-0x00007FF6253E9000-memory.dmp

Download