Analysis
- max time kernel
152s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/11/2022, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe
- Size 358KB
- Sample221124-h6cdhsge35
- SHA256 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
- MD5 622c0e2308dd0b2104beed9c3113d751
- SHA1 81e90fb48f79cac3562c17642659df67afe4fee6
- SHA512 d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
- SSDEEP 6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2848 IpOverUsbSvrc.exe 1864 atiesrx.exe 3548 atiesrx.exe 972 IpOverUsbSvrc.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation atiesrx.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe" IpOverUsbSvrc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe" IpOverUsbSvrc.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe File opened for modification C:\Windows\assembly\Desktop.ini 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2372 set thread context of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 1864 set thread context of 3548 1864 atiesrx.exe 93 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe File created C:\Windows\assembly\Desktop.ini 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe File opened for modification C:\Windows\assembly\Desktop.ini 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4188 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe Token: SeDebugPrivilege 4188 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe Token: SeDebugPrivilege 2848 IpOverUsbSvrc.exe Token: SeDebugPrivilege 1864 atiesrx.exe Token: SeDebugPrivilege 972 IpOverUsbSvrc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4188 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 4188 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 90 PID 2372 wrote to memory of 2848 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 91 PID 2372 wrote to memory of 2848 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 91 PID 2372 wrote to memory of 2848 2372 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe 91 PID 2848 wrote to memory of 1864 2848 IpOverUsbSvrc.exe 92 PID 2848 wrote to memory of 1864 2848 IpOverUsbSvrc.exe 92 PID 2848 wrote to memory of 1864 2848 IpOverUsbSvrc.exe 92 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 3548 1864 atiesrx.exe 93 PID 1864 wrote to memory of 972 1864 atiesrx.exe 94 PID 1864 wrote to memory of 972 1864 atiesrx.exe 94 PID 1864 wrote to memory of 972 1864 atiesrx.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4188
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeC:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"4⤵
- Executes dropped EXE
PID:3548
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\IpOverUsbSvrc.exe.log
- Size 224B
- SHA256 677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a
- MD5 c19eb8c8e7a40e6b987f9d2ee952996e
- SHA1 6fc3049855bc9100643e162511673c6df0f28bfb
- SHA512 860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
- Size 7KB
- SHA256 218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
- MD5 7e50c731e4fcaac9f395aa1faae07674
- SHA1 4e347ae9b63a0d7d920e5f7a913825a2504b251c
- SHA512 397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
- SSDEEP 96:aS5ABH7AjlpXQQmgDXhtYx26shgPBFYfY2YswyalKUNe7Hp0MfZt9pFjt19sPRF1:aS5ABMkUhtYxUhgPBA5twya3ih5tkRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
- Size 7KB
- SHA256 218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
- MD5 7e50c731e4fcaac9f395aa1faae07674
- SHA1 4e347ae9b63a0d7d920e5f7a913825a2504b251c
- SHA512 397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
- SSDEEP 96:aS5ABH7AjlpXQQmgDXhtYx26shgPBFYfY2YswyalKUNe7Hp0MfZt9pFjt19sPRF1:aS5ABMkUhtYxUhgPBA5twya3ih5tkRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
- Size 7KB
- SHA256 218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
- MD5 7e50c731e4fcaac9f395aa1faae07674
- SHA1 4e347ae9b63a0d7d920e5f7a913825a2504b251c
- SHA512 397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
- SSDEEP 96:aS5ABH7AjlpXQQmgDXhtYx26shgPBFYfY2YswyalKUNe7Hp0MfZt9pFjt19sPRF1:aS5ABMkUhtYxUhgPBA5twya3ih5tkRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
- Size 7KB
- SHA256 218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
- MD5 7e50c731e4fcaac9f395aa1faae07674
- SHA1 4e347ae9b63a0d7d920e5f7a913825a2504b251c
- SHA512 397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
- SSDEEP 96:aS5ABH7AjlpXQQmgDXhtYx26shgPBFYfY2YswyalKUNe7Hp0MfZt9pFjt19sPRF1:aS5ABMkUhtYxUhgPBA5twya3ih5tkRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
- Size 358KB
- SHA256 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
- MD5 622c0e2308dd0b2104beed9c3113d751
- SHA1 81e90fb48f79cac3562c17642659df67afe4fee6
- SHA512 d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
- SSDEEP 6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
- Size 358KB
- SHA256 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
- MD5 622c0e2308dd0b2104beed9c3113d751
- SHA1 81e90fb48f79cac3562c17642659df67afe4fee6
- SHA512 d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
- SSDEEP 6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
- Size 358KB
- SHA256 70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
- MD5 622c0e2308dd0b2104beed9c3113d751
- SHA1 81e90fb48f79cac3562c17642659df67afe4fee6
- SHA512 d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
- SSDEEP 6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
- MD5 SHA1 SHA512 SSDEEP