Analysis
- max time kernel
151s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2022, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target file.exe
- Size 220KB
- Sample221024-aygdhadfbl
- SHA256 0615fb67bb773330ed47419ab7dc989d0879eccc2681f29605ecf6996fc205e8
- MD5 b1ca42a519b29f0c8eadf8354b7cdc68
- SHA1 482d2d3cc013f07c19279da4e9875ea2d3aba2ae
- SHA512 3774044247bac18fc2af994a3dc0d7c96e4fe9b259a988937a291c8c74197a6dbb347843f0ba058db7189ea4a785b059a29f01666ce9c79562d5a0a08879067c
- SSDEEP 3072:3XBGLadDO50lohvoBLqNnMMC4Pf19Sn5:ngL+DBlse8nhPGn5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
49.0.50.0:57
-
51.0.52.0:0
-
53.0.54.0:1200
-
55.0.56.0:65535
Attributes
-
embedded_hash
569235DCA8F16ED8310BBACCB674F896
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1940-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1288 D381.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1288 set thread context of 3908 1288 D381.exe 119 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 12 IoCs
pid pid_target Process procid_target 1884 1288 WerFault.exe 89 1592 1288 WerFault.exe 89 2320 1288 WerFault.exe 89 2232 1288 WerFault.exe 89 388 1288 WerFault.exe 89 1472 1288 WerFault.exe 89 2104 1288 WerFault.exe 89 2896 1288 WerFault.exe 89 2272 1288 WerFault.exe 89 5092 1288 WerFault.exe 89 5004 1288 WerFault.exe 89 3292 1288 WerFault.exe 89 - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe - Checks processor information in registry 2 TTPs 51 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier D381.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision D381.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor D381.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 D381.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz D381.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet D381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString D381.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings D381.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2560 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 file.exe 1940 file.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1940 file.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 3568 svchost.exe Token: SeShutdownPrivilege 3568 svchost.exe Token: SeCreatePagefilePrivilege 3568 svchost.exe Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3908 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4684 OpenWith.exe 2560 Process not Found 2560 Process not Found - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2560 wrote to memory of 1288 2560 Process not Found 89 PID 2560 wrote to memory of 1288 2560 Process not Found 89 PID 2560 wrote to memory of 1288 2560 Process not Found 89 PID 1288 wrote to memory of 2676 1288 D381.exe 91 PID 1288 wrote to memory of 2676 1288 D381.exe 91 PID 1288 wrote to memory of 2676 1288 D381.exe 91 PID 1288 wrote to memory of 3908 1288 D381.exe 119 PID 1288 wrote to memory of 3908 1288 D381.exe 119 PID 1288 wrote to memory of 3908 1288 D381.exe 119 PID 1288 wrote to memory of 3908 1288 D381.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1940
-
C:\Users\Admin\AppData\Local\Temp\D381.exeC:\Users\Admin\AppData\Local\Temp\D381.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:2676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 6522⤵
- Program crash
PID:1884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 9402⤵
- Program crash
PID:1592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 9882⤵
- Program crash
PID:2320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 9682⤵
- Program crash
PID:2232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 11322⤵
- Program crash
PID:388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 11402⤵
- Program crash
PID:1472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 11762⤵
- Program crash
PID:2104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 13042⤵
- Program crash
PID:2896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 10802⤵
- Program crash
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 14442⤵
- Program crash
PID:5092
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 14522⤵
- Program crash
PID:5004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 14282⤵
- Program crash
PID:3292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ec 0x3201⤵PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 12881⤵PID:5108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1288 -ip 12881⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1288 -ip 12881⤵PID:3960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1288 -ip 12881⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1288 -ip 12881⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1288 -ip 12881⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1288 -ip 12881⤵PID:3196
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1288 -ip 12881⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1288 -ip 12881⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1288 -ip 12881⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1288 -ip 12881⤵PID:2644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1288 -ip 12881⤵PID:4748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\D381.exe
- Size 8.4MB
- SHA256 111b5a2d2bcffa46c8603d6f67a7abe98a5086cbd2d381cd01c694e6722538aa
- MD5 e85369fc4d14b579b280161525978cdb
- SHA1 c73bbcfe90a829cf8125a54d264f088b638e6faf
- SHA512 c1b32c0c8f73adcf3e11d1eb168fd72a838baea9c1e58b0dd43f5752276281e7f37d04b13adadf145f177370a9210d35e50d2bb35451d9a29e1c41ac24bb006a
- SSDEEP 196608:Z70IzzYn2NehFsJp+u66ijwGD3Wb01I5O01YC:Jbon2QhFsJbWD3g0CI01
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D381.exe
- Size 8.4MB
- SHA256 111b5a2d2bcffa46c8603d6f67a7abe98a5086cbd2d381cd01c694e6722538aa
- MD5 e85369fc4d14b579b280161525978cdb
- SHA1 c73bbcfe90a829cf8125a54d264f088b638e6faf
- SHA512 c1b32c0c8f73adcf3e11d1eb168fd72a838baea9c1e58b0dd43f5752276281e7f37d04b13adadf145f177370a9210d35e50d2bb35451d9a29e1c41ac24bb006a
- SSDEEP 196608:Z70IzzYn2NehFsJp+u66ijwGD3Wb01I5O01YC:Jbon2QhFsJbWD3g0CI01
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
- Size 25KB
- SHA256 c3db936d22f55c93214a38a5cc2b7a042b298822db68af0b4a574df37a1820db
- MD5 81afc5fdc60ea77324d4d8c4438e6510
- SHA1 4b21359d6a24d7096bd1f5afe2c100cb06829352
- SHA512 87e49d7bcf9f7d383ccf98ec4125402749db4bf954b8dc7c64177dd1ed254916a5b9a03903ccc01f0fc6bf635dc8640d3f9961156cd23882896c9b23fb472dcc
- SSDEEP 768:2/cTG175pcvVJgBBBBB3LJOgSs3MOPULIobKL3nZZZZZsQt:5TG19pfBBBBB3L6OPUMoMZZZZZsQt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
- Size 3.3MB
- SHA256 db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
- MD5 13d0ff809f24a408728fd6fe00241020
- SHA1 fde8484da982eceb86cf6959460ffc4ce33271a9
- SHA512 38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768
- SSDEEP 98304:SxlplP5DXkQtCgfAKRToMtYwEh1D33K6m:SxnlRlCg/ToSMDnKr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TMKNGOMU-20220812-1924a.log
- Size 181KB
- SHA256 ec82e4d884101d5d621ce4ff44a53f2114f73498bb0628479f67c37ec19124e8
- MD5 aa50dd7e6959589fc3fea20fe137bc6f
- SHA1 6db450ce52e3163161e1b90af4074a9d3bf47447
- SHA512 1e40a678922d3119ea6328b90e0a19d0f56a8498aca0aaeb5773336d292002352f7efdce467c09fc29acfc91bbc5bb6de3ba11d1ba2e1d46c1d0159f7ad17eb4
- SSDEEP 1536:1AoUPQeWtbOSbO0Wjh9WshcPnsPNmimxLKH9EW91Wng2009+TIcG3YtWu9WRx/8x:NFmY009+TIcG3p/C/2/jI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aria-debug-1700.log
- Size 470B
- SHA256 9c5a7d9152e24a699bb5d058d978b5eec9aa309d8a73f4dc74fa18cb5900ef13
- MD5 afbde07b463b84a12621ff8a45aaae1b
- SHA1 1f78c7b3bae0de87727605cb0764d13ac58abc5d
- SHA512 019e7ab616dd89b1764cddfe89d2cd3414195615e62c2dca200980fac31ce13b5bf33f0b5801c2f2eb27c16f849306a7d9bf2dbbd224ee6beb80f41fd8d0e70d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 833a02f36dfa5affbce525ec3c8ff76f17884fa6f058a31247aae3a5afc4f447
- MD5 807032b7314049329ebd06853899378d
- SHA1 5b92011b163eb80836c163163d7350731fac9bd8
- SHA512 2737573f6f344754cfd0d2562458743608a626fd03e21f728f459f49d2f529b85ae7f4be83cf91f0365e7275681458bf1baefc0e100c46a9ec07fe1638803241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI50B8.txt
- Size 426KB
- SHA256 37c69c02974b85d856e00765ff6b978bc55f03f1254b5f50754d5acd7c32c296
- MD5 cd406b2d2202bec1d657b0042c2a2cb8
- SHA1 87d639c4dc350106f0e2cd2364d78df223aac7e4
- SHA512 09a482f2fe99f4b6a45f8acb8953705cc834a8e92be2f579f62e5aa784d972b63e1dc8d0a4bf25442623a3f251f9a675121c3a402e1b5748424acceeaf547ee0
- SSDEEP 1536:D0LrTEvCMI7DIWv2+2fDGw1NWNw8wzfnFNeYTJ3ERsIvPEm6JJNlZ+KdzbjZsRL9:D0NTj7XprZUoBNr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI50E6.txt
- Size 414KB
- SHA256 2ef99443f8f086c52cb2c4b525a767fd0ad0de8b4996bd6c9161bf8073a884fb
- MD5 e6c01c79db3f332fe871fa31fde76177
- SHA1 aebe59988fce2cdc4e95ea5937365421538c9a05
- SHA512 6cec8a23a7468d42deed895e4f1277fd7d33430dc122fbe020ee865a319c14a73d29ab1f6c9af40127f19c683ff7dfa36689b43b309b3b6aa0d76fee68ed5fd5
- SSDEEP 1536:enoPrmPI+il9j0Rwf3Er+6QY5hvcLHLLEcjBfwLQV4czLAa21NxfZQEHZRZTC7N/:enCdjXvUxsQBn91GB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
- Size 3KB
- SHA256 dad5b6d0b662cfad2be7ff91c9fae6df5560d8c060945c2e500161dec02e7c3d
- MD5 9ff44423a176ce26a4c7a07b31228885
- SHA1 4fc43105c7c45af784e366d70186909dae5e3d60
- SHA512 d650e64ef28bc8da2fcbf686fd1fda891e2d5d4f22ee2bfa69bcba01cd4369eacfcb362f4d8e8f69bab317eaa5b4d0644da0fe5ee5935c9d284ce625ddbcc5bf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\sa.9NXQXXLFST89_0__.Public.InstallAgent.dat
- Size 123KB
- SHA256 3141626a68fe932635b551c6c779023d03dd8244c67e1c14c7b10ad6e094c149
- MD5 6fa88eb60d3724434d1901e14b45ac54
- SHA1 f9c633c011ad3dfed94b06ec62cf1b7f87f1487a
- SHA512 e0a045c099fd79e6de04cdc8d21f4a35f910f29cc4473d98ed3fd66fa512430ccc69a8c206c5435d3e04dabae171082a9d951901ff360066a4895e86c4e9ce08
- SSDEEP 3072:RsvUQZnU9Zxylm+6hLA7qMUQZnU9Zxylm+6hLA7qGUQZnU9Zxylm+6hLA7qX:f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wct5D7C.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wctA1E8.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wctC4C7.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 697B
- SHA256 3b113453a1a98b0d6b6e07bd35eca1f0a1992f2c2d69ab22c80ae54d194bc9dd
- MD5 97135e1ef652cacbca26f832ec7c2ee2
- SHA1 b2691d8e35a78fa4bbf86a480638da8f48b169aa
- SHA512 fd3180cac2443538ea32868fe5169148554923cae0e296a0863c46dfa5326495b8dc75a0b0fb52639149f38c01cd569b340db9956ba96159c825124cb23633a5
- MD5 SHA1 SHA512