Analysis
- user interaction
yes - max time kernel
85s - max time network
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 19:09
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target XClient.exe
- Size 81KB
- Sample261027-xtvfwsec89
- SHA256 661a9e70489e80ee8fe41d184c5969d7d900149d56f8df1c949d6fedfa3c52ed
- MD5 bfc9736c8ed84ba2574ffe0a9d50b3bd
- SHA1 b321409a6539375ad3416d6d35bc6021da4921d3
- SHA512 42479e347181183a711ea7b178ae0f9471171d15f7a6209c044a5c71503187f7571585ac60175ad4073907f0d6ae6b25dfec353ad84f691dd5215191415f8e24
- SSDEEP 1536:1mM/+76kM2hV3GdHfaa3XjhNztdYLjh79b74WCaDUackgOitOKt7L0g3SG/:dS6kthJG9RThdgjPb7d3Aac0OOKtL0K/
- TLSH T140837C2C37E94425E1FFEFB05DE57153CA39F7222803959F24D6028A1B27A88CD516FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
33.tcp.cpolar.top:12896
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3292-1-0x0000000000B80000-0x0000000000B9A000-memory.dmp family_xworm behavioral2/files/0x000b00000001a145-8.dat family_xworm - Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} reg.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe - Executes dropped EXE 2 IoCs
pid Process 4436 XClient.exe 3492 eugcrz.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 eugcrz.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\winlogon.exe eugcrz.exe File opened for modification C:\Windows\System32\csrss.exe eugcrz.exe File opened for modification C:\Windows\System32\wininit.exe eugcrz.exe File opened for modification C:\Windows\System32\ntdll.dll eugcrz.exe File opened for modification C:\Windows\System32\advapi32.dll eugcrz.exe File opened for modification C:\Windows\System32\services.exe eugcrz.exe File opened for modification C:\Windows\System32\lsass.exe eugcrz.exe File opened for modification C:\Windows\System32\smss.exe eugcrz.exe File opened for modification C:\Windows\System32\kernel32.dll eugcrz.exe File opened for modification C:\Windows\System32\gdi32.dll eugcrz.exe File opened for modification C:\Windows\System32\dllhost.exe eugcrz.exe File opened for modification C:\Windows\System32\user32.dll eugcrz.exe File opened for modification C:\Windows\System32\shell32.dll eugcrz.exe File opened for modification C:\Windows\System32\ntoskrnl.exe eugcrz.exe File opened for modification C:\Windows\System32\svchost.exe eugcrz.exe File opened for modification C:\Windows\System32\dwm.exe eugcrz.exe File opened for modification C:\Windows\System32\spoolsv.exe eugcrz.exe File opened for modification C:\Windows\System32\ole32.dll eugcrz.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 XClient.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4840 cmd.exe 4824 cmd.exe 1948 cmd.exe 2428 cmd.exe 5524 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname XClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain XClient.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe - Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\IETld reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\25 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\ProtocolExecute reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Services reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\14 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\16 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\3 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\33 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\11 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\12 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\19 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\23 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\35 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\PageSetup reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\TypedURLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\URLSearchHooks reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LinksBar reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\29 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Zoom reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Desktop\General reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Document Windows reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\6 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\55ba165d_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d99f01ab_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\powerpoint reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\IntelliForms reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\31 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\34 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\7 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-powerpoint reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Settings reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Toolbar reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\GPU reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Help_Menu_URLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Setup reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Download reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\36 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\39 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\InternetRegistry reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ee6c26b7_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\18 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\BrowserEmulation reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\17 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\38 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\word reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\IETld\LowMic reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\20 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\21 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\22 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\4 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\excel reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\International\Scripts\13 reg.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ADT\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aif\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.669 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.AAC\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accdt reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aifc reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\IExplore.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.7z reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accountpicture-ms reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\pintohomefile\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.AAC reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx\PropertyHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\Excel.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DropTarget reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acl reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aiff reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.all\OpenWithProgids reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3ga reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\CryptoSignMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\notepad.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\Winword.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.386\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a52 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ai reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aif reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{1f2e5c40-9550-11ce-99d2-00aa006e086c} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList\AcroRd32.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithProgids reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3fr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt\command reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 4428 reg.exe 3260 reg.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4144 schtasks.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3292 XClient.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3292 XClient.exe Token: SeDebugPrivilege 3292 XClient.exe Token: SeDebugPrivilege 4436 XClient.exe Token: SeDebugPrivilege 3492 eugcrz.exe Token: 33 5876 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5876 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3292 XClient.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3292 wrote to memory of 4144 3292 XClient.exe 90 PID 3292 wrote to memory of 3492 3292 XClient.exe 96 PID 3492 wrote to memory of 2428 3492 eugcrz.exe 97 PID 3492 wrote to memory of 5524 3492 eugcrz.exe 100 PID 3492 wrote to memory of 4840 3492 eugcrz.exe 102 PID 5524 wrote to memory of 4428 5524 cmd.exe 104 PID 3492 wrote to memory of 4824 3492 eugcrz.exe 105 PID 2428 wrote to memory of 5276 2428 cmd.exe 106 PID 3492 wrote to memory of 1948 3492 eugcrz.exe 108 PID 4840 wrote to memory of 3260 4840 cmd.exe 110 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\eugcrz.exe"C:\Users\Admin\AppData\Local\Temp\eugcrz.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
- Modifies registry class
PID:5276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCU /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\system32\reg.exereg delete HKCU /f4⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry key
PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKLM /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\system32\reg.exereg delete HKLM /f4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry key
PID:3260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKU /f3⤵
- Executes a command shell one-liner
PID:4824 -
C:\Windows\system32\reg.exereg delete HKU /f4⤵PID:2796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCC /f3⤵
- Executes a command shell one-liner
PID:1948 -
C:\Windows\system32\reg.exereg delete HKCC /f4⤵PID:4968
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
PID:5876
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:3104
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵PID:4408
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵PID:3068
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:1116
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2400
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:3472
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2036
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:3544
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:4476
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1944
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2616
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"1⤵PID:5600
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:4852
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\O97Z0TLM\microsoftwindows.client[1].xml
- Size 97B
- SHA256 1c8128d8317a62aa4efcec09fb6f60c5d3fd94fe02fc40bf8af1d3b7146bac5a
- MD5 e64500468773bdee3d62c3070a29e680
- SHA1 5f13dcd39658dbc4d15bb3b9966fe90574a2da1a
- SHA512 d25972afaad5e8e638a4f2cc39138dcac1eb470ae4437d1e8cb05be6044b8b8f4187296560c6be025d1c5e158e46634604246ee7db8b5e3eb8f616bd5a6ac72e
- TLSH T18EB012513A8A4C1C07404AF63D1D20E032FE0083F205B87834E4FE05F5D5E4AC012CF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\eugcrz.exe
- Size 11KB
- SHA256 fab19c1edfb80bfc16bb9ec79802981acde65a78bf2f9ecf4838c80da1b8a761
- MD5 495b6b9f4c7ad46cdc2ed02ff1e8ae0b
- SHA1 2375c72190234b87331035bd91e2d77f597a369a
- SHA512 093a2a604b1abfa2fca777dc5ff5f302eaa9d5db424d3730b1d38ed75fce1b0e1d517928ed760cd2cbd9823a6140ffe122970786a143258982c560ed15214b09
- SSDEEP 192:lEUdBKqoWELQaknowE8ptL97X0n0E49w6+QAj3+w+:DDDoWEdjwNptpX+0j93uS
- TLSH T13632E64DB3D88624D5BE4B3218B7D21087B0F4138E2BCB4F1DE958FD2D2772469A6B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\XClient.exe
- Size 81KB
- SHA256 661a9e70489e80ee8fe41d184c5969d7d900149d56f8df1c949d6fedfa3c52ed
- MD5 bfc9736c8ed84ba2574ffe0a9d50b3bd
- SHA1 b321409a6539375ad3416d6d35bc6021da4921d3
- SHA512 42479e347181183a711ea7b178ae0f9471171d15f7a6209c044a5c71503187f7571585ac60175ad4073907f0d6ae6b25dfec353ad84f691dd5215191415f8e24
- SSDEEP 1536:1mM/+76kM2hV3GdHfaa3XjhNztdYLjh79b74WCaDUackgOitOKt7L0g3SG/:dS6kthJG9RThdgjPb7d3Aac0OOKtL0K/
- TLSH T140837C2C37E94425E1FFEFB05DE57153CA39F7222803959F24D6028A1B27A88CD516FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Contacts\desktop.ini
- Size 412B
- SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
- MD5 449f2e76e519890a212814d96ce67d64
- SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
- SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
- TLSH T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\desktop.ini
- Size 402B
- SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
- MD5 ecf88f261853fe08d58e2e903220da14
- SHA1 f72807a9e081906654ae196605e681d5938a2e6c
- SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
- TLSH T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\desktop.ini
- Size 282B
- SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
- MD5 3a37312509712d4e12d27240137ff377
- SHA1 30ced927e23b584725cf16351394175a6d2a9577
- SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
- TLSH T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Links\desktop.ini
- Size 504B
- SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
- MD5 3b960da228cc489b622697659c885d64
- SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
- SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
- TLSH T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Music\desktop.ini
- Size 504B
- SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
- MD5 06e8f7e6ddd666dbd323f7d9210f91ae
- SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
- SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
- TLSH T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Pictures\desktop.ini
- Size 504B
- SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
- MD5 29eae335b77f438e05594d86a6ca22ff
- SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
- SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
- TLSH T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Saved Games\desktop.ini
- Size 282B
- SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
- MD5 b441cf59b5a64f74ac3bed45be9fadfc
- SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
- SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
- TLSH T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Searches\desktop.ini
- Size 524B
- SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
- MD5 089d48a11bff0df720f1079f5dc58a83
- SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
- SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
- TLSH T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Videos\desktop.ini
- Size 504B
- SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
- MD5 50a956778107a4272aae83c86ece77cb
- SHA1 10bce7ea45077c0baab055e0602eef787dba735e
- SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
- TLSH T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\AccountPictures\desktop.ini
- Size 196B
- SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
- MD5 2971c89bfb3b06e591694b9a78e467b9
- SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
- SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
- TLSH T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
- Size 174B
- SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
- MD5 8f91870452433a5555c9d453f714698c
- SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
- SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
- TLSH T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
- Size 174B
- SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
- MD5 e0fd7e6b4853592ac9ac73df9d83783f
- SHA1 2834e77dfa1269ddad948b87d88887e84179594a
- SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
- TLSH T17FC0801892E9311041718D12FC749001DBB1B8216C17CF5E07C0518B04A0605E631747
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
- Size 1024KB
- SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
- MD5 1d41d647faf0c99af43c89459acc8e9f
- SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
- SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
- SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
- TLSH T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
- MD5 bbe70a516ccc8b65668330f36fc864a1
- SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
- SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
- SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
- TLSH T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
- Size 24B
- SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
- MD5 ae6fbded57f9f7d048b95468ddee47ca
- SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
- SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
- MD5 SHA1 SHA512
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 7KB
- SHA256 8a6884eb9ee9f425d73e83acab47a3c2ec0cb65727d1c5ebff441556b531774f
- MD5 9d119a900c9be616a1c38eb4cfd7f938
- SHA1 ee1dc5fb35c0175847bcfd71c7ab9acc62f91368
- SHA512 4a5e54cb153dd063717e69570ac503a4685b9d69ce7697983a3f897843bc9c183a8477b6a3dee006350add364d1ff98583f4340c598d76ea7d9cab1d6de2e497
- SSDEEP 3:tn4lQlF:aw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
- Size 196B
- SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
- MD5 08e1b7b2fd872cdcc42af67707dc2a98
- SHA1 512644da4aa90a3919bc29f65e878e9870874f67
- SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
- TLSH T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
- Size 163B
- SHA256 f8b3ef049a601338cfdec8cbcdf9108418988b474cae3577a7390fe7104464aa
- MD5 a3e17b45f8d424a9d27ae6a179b86d41
- SHA1 9d1ebac99b48aba05ada473ca5ffa1386ce256b1
- SHA512 12bb29b554261e63e30503f6f4090e464b5dac9ead07d8b63d505d5e242b5112b36956b2f552d3a6ec5af558e9a2847ec9456366e6a90fe7fdea9f54f2adbd2d
- TLSH T11BC01239820A4330F6D065E96A19720A443F60891043E20044F612A6F8AA0098230EF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
- Size 302B
- SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
- MD5 99d72adf4e683fa1e6f1a435ff5be9b3
- SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
- SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
- TLSH T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
- Size 432B
- SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
- MD5 f107d0270e21a2fe91099fdc15918d44
- SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
- SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
- TLSH T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
- Size 174B
- SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
- MD5 548b310fbc7a26d0b9da3a9f2d604a0c
- SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
- SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
- TLSH T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
- Size 174B
- SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
- MD5 7f1698bab066b764a314a589d338daae
- SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
- SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
- TLSH T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
- Size 174B
- SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
- MD5 17d5d0735deaa1fb4b41a7c406763c0a
- SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
- SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
- TLSH T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
- Size 174B
- SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
- MD5 a2d31a04bc38eeac22fca3e30508ba47
- SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
- SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
- TLSH T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
- Size 176KB
- SHA256 6ea25d299adb39df40212749727988f5f4bd1daba2b02fafb970fa2d1dbec7a7
- MD5 90e4cfb342009eaaae50e1e7ccfd6729
- SHA1 a92ec924cc7e55f7ced198b3c3406935f7c90e62
- SHA512 3bc4c4aa96b72c6a5ecafed98f7c679866ba09f99a71683d13f1205e809700199b3150197477bcefc8f6a65c663073b61b7a27c59748b1721b82f58b210f7e6c
- SSDEEP 3072:bxsJvlkwIJFCaup/yNOas8WY1hKKbfef8zob71T57kLq+Crt3CaEBqwbDpxp:1sJvGwIJ8N/yjs8WY1hKKbmf8e6LVCr8
- TLSH T151041263157FEE51B31B6E199B4B12FFA081B546362B391E74C7E9B32D23108A2C41B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
- Size 282B
- SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
- MD5 9e36cc3537ee9ee1e3b10fa4e761045b
- SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
- SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
- TLSH T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
- Size 418B
- SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
- MD5 93c8b5c191bdcf8aca86d7463d77e6c8
- SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
- SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
- TLSH T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
- Size 298B
- SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
- MD5 819c27ae07898f1a5efda4e146dbb174
- SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
- SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
- TLSH T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
- Size 402B
- SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
- MD5 881dfac93652edb0a8228029ba92d0f5
- SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
- SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
- TLSH T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
- Size 520B
- SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
- MD5 af5909700768a888173cbd32998cf3da
- SHA1 194ed60ed8923749078816fc2c69614d975ba325
- SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
- TLSH T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
- Size 520B
- SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
- MD5 7a985a80859ee46e35031543cf0d142f
- SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
- SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
- TLSH T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
- Size 520B
- SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
- MD5 a882cf89da04eb72950e65080a5cf857
- SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
- SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
- TLSH T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\RGI17A0.tmp
- Size 24KB
- SHA256 04a0fbd0b5c3e4f7e3558a3871fe3f3cce5013a330941c3e72b4cdb19c81f2ad
- MD5 033649d7b623b2f8cd29854ccb6d6a4b
- SHA1 9772f7b7b11625fc3dea7598cdf5b6d0fc511ae6
- SHA512 90df8c97c8d8062970d76af2235c3ab78208c95c332bbc04e72e2782cb926ab12dbb1098914f453eb7b095ee7dc50f80d4cb96c5931a51a25efb5d91a3c50989
- SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
- TLSH T1CAB2BF295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
- MD5 SHA1 SHA512 SSDEEP TLSH