Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
18/12/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target file.exe
- Size 214KB
- Sample221218-jnp3bsba49
- SHA256 451ec0852088a55084102632e636204feef0989fabe57dc0cb602c4173dc48fa
- MD5 94ce7e3bc61e8f5825b3416dccd1c481
- SHA1 699b3330bbcdb08df4e5ee3c4e2343b33bb957bd
- SHA512 1caf1d8d4ebdf2caafa092484d03653823c85e394531cea2e00937f5b38c75fe17b1ba86d810bdc6f95f0e5b0d8f6b21afdad260f278331e211095262649f8e9
- SSDEEP 6144:Lf25OL4bdsVV2jEjxrxwRGgg3CwVpU0VB:Lf2AUxsVVQEjxfvSwVqO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
danabot
C2
-
23.236.181.126:443
-
123.253.35.251:443
-
66.85.173.3:443
Attributes
-
embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3928-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 44 1304 rundll32.exe 47 1304 rundll32.exe 75 1304 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3804 C9EC.exe 2568 uiidtww - Loads dropped DLL 1 IoCs
pid Process 1304 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1304 set thread context of 2816 1304 rundll32.exe 91 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1348 3804 WerFault.exe 86 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiidtww Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiidtww Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiidtww - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000092553946100054656d7000003a0009000400efbe6b55586c925541462e0000000000000000000000000000000000000000000000000058f7cf00540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3928 file.exe 3928 file.exe 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3928 file.exe 2568 uiidtww - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2596 Process not Found 2596 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2596 wrote to memory of 3804 2596 Process not Found 86 PID 2596 wrote to memory of 3804 2596 Process not Found 86 PID 2596 wrote to memory of 3804 2596 Process not Found 86 PID 3804 wrote to memory of 1304 3804 C9EC.exe 87 PID 3804 wrote to memory of 1304 3804 C9EC.exe 87 PID 3804 wrote to memory of 1304 3804 C9EC.exe 87 PID 1304 wrote to memory of 2816 1304 rundll32.exe 91 PID 1304 wrote to memory of 2816 1304 rundll32.exe 91 PID 1304 wrote to memory of 2816 1304 rundll32.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C9EC.exeC:\Users\Admin\AppData\Local\Temp\C9EC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 202093⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 4802⤵
- Program crash
PID:1348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3804 -ip 38041⤵PID:4940
-
C:\Users\Admin\AppData\Roaming\uiidtwwC:\Users\Admin\AppData\Roaming\uiidtww1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2568
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2108
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:2976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\MSBuild\Microsoft\license..dll
- Size 2.4MB
- SHA256 6f78d195080c2d192a329d1725c2be7a0d770fd4c918b3d51613ee7829471100
- MD5 5ca5707a8b51e7d74370eb290de91a8d
- SHA1 ea53e90aafbcb923baecb6d6da7faa8efd3e2e0b
- SHA512 0aa1386fa0b4ce677ea2b11c2c6ed2df72c74a853c8e15d8d4e331f95364764adc8b046c02fd5dddd8b042a07c37ed75c3eb1f0b7e5201fb10711ef077370097
- SSDEEP 49152:arqVHNsAsWe8AdaSTBfA3XGGuG+TN8LxZ:aaPenfA32Z8Lz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\MSBuild\Microsoft\license..dll
- Size 2.4MB
- SHA256 6f78d195080c2d192a329d1725c2be7a0d770fd4c918b3d51613ee7829471100
- MD5 5ca5707a8b51e7d74370eb290de91a8d
- SHA1 ea53e90aafbcb923baecb6d6da7faa8efd3e2e0b
- SHA512 0aa1386fa0b4ce677ea2b11c2c6ed2df72c74a853c8e15d8d4e331f95364764adc8b046c02fd5dddd8b042a07c37ed75c3eb1f0b7e5201fb10711ef077370097
- SSDEEP 49152:arqVHNsAsWe8AdaSTBfA3XGGuG+TN8LxZ:aaPenfA32Z8Lz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\C2RManifest.officemui.msi.16.en-us.xml
- Size 122KB
- SHA256 2669d714f126be033270a9f2919d6152f45c5bec970dc1ab8da09f41351234c0
- MD5 35acff0f35559eac959647a7501385f7
- SHA1 28e052e01fe4e0eac3eab461385460eff7efe271
- SHA512 f3fa4e7499e15a63d2503355705eb08d15be0a3736145c3b46cc79a4fcf7e00df871f62af769090aff7692b34d93365cf413be7b86b27a9df0ecb8f481898ed2
- SSDEEP 3072:U4hwSci3lHbi5rDSwuAVnoRLY+bqGwJ8ci34kdSTI5xemvX8lq3LgfGdEbcmw:U4hwSci3lHbi5rDSwuAVnoRLY+bqGfdN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp
- Size 2.3MB
- SHA256 9197f8d53e2e648a22d9e652ae22f5ae91e95bd686b1b4fc5450c9c76fa53f32
- MD5 887acb127f0aa79ae28a71a481d81289
- SHA1 f108748718844492a56686c53424fbe675359743
- SHA512 bb142431f89e847578c8a41e27ed40f70d15a5015357efc8b0e4e0a4eaf35f79524070d55a3906fca630caa7a5e78212e46fc45a37748408200bef962751846c
- SSDEEP 49152:HoyCSaqG4WCHqFjycNMz5W8PL7Ux9SqP6f/mFrvpPd8IzOJUu7RX:HwaHZ7Uxz6YrL8ISFRX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe.xml
- Size 9KB
- SHA256 bb39de067132d2ccbb7a3c066743010f070a3c3856f42ccc892da0b40012771e
- MD5 996f11041df0526341cebbbd40a98390
- SHA1 37f652515ef8c662840086d743f7f68d327cce52
- SHA512 6cafa4b3bd8c56d20859a4f8fb7109e3ca4c690d0746b13f9f2eaa19d88bfca469dc45d71fb91f5658f9cd300f285aafb9e212ebd7c1496aadb6046da4e56c03
- SSDEEP 192:KEmP0oyC2JDsDn/ZMZwZUEJWcBtMbZv0IKVptlONftrMBr9Imfipoaag+zysaZvJ:KEmP0oybOj/ZMZwZUEJWcBtMbZv0IKVu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe.xml
- Size 8KB
- SHA256 8e5dd7465c39d653c1ba79e4b154321413b4f3dd7b62f485848a5122fbb868b6
- MD5 53e4d87ce4e7b6a4c5b2d84c60a70984
- SHA1 ad381e6e2d67970b34c356259fa86fa8c3c1de78
- SHA512 2f984aa666cc9458450a6215d333ca3be4ba04a711d2bf4f257fca4e28007b25d0801cacdcd02f8f0b8d9f6f867a89478dd023faf672a88b95eda65091a03b71
- SSDEEP 96:nKAsEANUANKANgADxpADfDeyFUDkv8HETDfDJYlDfDJ56Fob2gu68mPGQDXu8Uhh:N0BLtLG82FobFupFQzudhLc6Rrac
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\resource.xml
- Size 1KB
- SHA256 fd5f68b59aa2b3e80b1a3d97b1dc5028e0fb512d26003fffce146209fedc814b
- MD5 66963736ebb1e54dc596701206eaed3f
- SHA1 18bc8dfc779d407398af193f3d265ff93f253bc2
- SHA512 96aef899ecfb48d1df6e8c7655d59fb80b3c65f18857692894598b78c14b5587433d5f58a2d9bbd74d635956a9e6f1948916bd354e6d438450f37ec11cc3b598
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\C9EC.exe
- Size 2.4MB
- SHA256 295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8
- MD5 0bb2b15ca73128dbc816ea4ed583119c
- SHA1 17d05964d9208ca1a27fd007ad5f41752cfa893e
- SHA512 d58afa63c04cb95576e9a7b5ae026dc28526cee7a26c5e829c091356179f4d255503914398dd209c506743ab78f16cb84d862e2f8ae5f43282bfe2a3e7afe375
- SSDEEP 49152:iXD0rCNQqajG67hoNMT2yt/bnrs/ddS972dXd43qq6auVL4/J+B:iXD0rCNq/Fn7mdS9ydNzpPVecB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C9EC.exe
- Size 2.4MB
- SHA256 295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8
- MD5 0bb2b15ca73128dbc816ea4ed583119c
- SHA1 17d05964d9208ca1a27fd007ad5f41752cfa893e
- SHA512 d58afa63c04cb95576e9a7b5ae026dc28526cee7a26c5e829c091356179f4d255503914398dd209c506743ab78f16cb84d862e2f8ae5f43282bfe2a3e7afe375
- SSDEEP 49152:iXD0rCNQqajG67hoNMT2yt/bnrs/ddS972dXd43qq6auVL4/J+B:iXD0rCNq/Fn7mdS9ydNzpPVecB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
- Size 2.4MB
- SHA256 3d95cd18fa999b60a32edcc761100f6fdb276c68f23dadc03c7173de7c6594c0
- MD5 2f2aafdd0fbd8d5e72ebee47f37fdf52
- SHA1 b0c823f7b2f8a567672dff368017ab7bbdf4aad1
- SHA512 f835ba1691110d744220202c11c9fcdaac7724b1018e1c3931a2407569ea5351c72dc33ec34e1f2c0c6691debcc40d0f7d3719dc83ac00fdf14fb095c4636525
- SSDEEP 49152:zrqVHNsAsWe8AdaSTBfA3XGGuG+TN8LxZ:zaPenfA32Z8Lz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
- Size 2.4MB
- SHA256 3d95cd18fa999b60a32edcc761100f6fdb276c68f23dadc03c7173de7c6594c0
- MD5 2f2aafdd0fbd8d5e72ebee47f37fdf52
- SHA1 b0c823f7b2f8a567672dff368017ab7bbdf4aad1
- SHA512 f835ba1691110d744220202c11c9fcdaac7724b1018e1c3931a2407569ea5351c72dc33ec34e1f2c0c6691debcc40d0f7d3719dc83ac00fdf14fb095c4636525
- SSDEEP 49152:zrqVHNsAsWe8AdaSTBfA3XGGuG+TN8LxZ:zaPenfA32Z8Lz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\uiidtww
- Size 214KB
- SHA256 451ec0852088a55084102632e636204feef0989fabe57dc0cb602c4173dc48fa
- MD5 94ce7e3bc61e8f5825b3416dccd1c481
- SHA1 699b3330bbcdb08df4e5ee3c4e2343b33bb957bd
- SHA512 1caf1d8d4ebdf2caafa092484d03653823c85e394531cea2e00937f5b38c75fe17b1ba86d810bdc6f95f0e5b0d8f6b21afdad260f278331e211095262649f8e9
- SSDEEP 6144:Lf25OL4bdsVV2jEjxrxwRGgg3CwVpU0VB:Lf2AUxsVVQEjxfvSwVqO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\uiidtww
- Size 214KB
- SHA256 451ec0852088a55084102632e636204feef0989fabe57dc0cb602c4173dc48fa
- MD5 94ce7e3bc61e8f5825b3416dccd1c481
- SHA1 699b3330bbcdb08df4e5ee3c4e2343b33bb957bd
- SHA512 1caf1d8d4ebdf2caafa092484d03653823c85e394531cea2e00937f5b38c75fe17b1ba86d810bdc6f95f0e5b0d8f6b21afdad260f278331e211095262649f8e9
- SSDEEP 6144:Lf25OL4bdsVV2jEjxrxwRGgg3CwVpU0VB:Lf2AUxsVVQEjxfvSwVqO
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\msbuild\microsoft\license..dll
- Size 2.4MB
- SHA256 6f78d195080c2d192a329d1725c2be7a0d770fd4c918b3d51613ee7829471100
- MD5 5ca5707a8b51e7d74370eb290de91a8d
- SHA1 ea53e90aafbcb923baecb6d6da7faa8efd3e2e0b
- SHA512 0aa1386fa0b4ce677ea2b11c2c6ed2df72c74a853c8e15d8d4e331f95364764adc8b046c02fd5dddd8b042a07c37ed75c3eb1f0b7e5201fb10711ef077370097
- SSDEEP 49152:arqVHNsAsWe8AdaSTBfA3XGGuG+TN8LxZ:aaPenfA32Z8Lz
- MD5 SHA1 SHA512 SSDEEP