Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
21/12/2022, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
General
- Target file.exe
- Size 220KB
- Sample221221-c21bwsbe45
- SHA256 37397d4daba951caf74ad3438dfaf81709fbb8e37df7f441ae38c515418ff0c9
- MD5 10284282f79b91bed875fde9f063739d
- SHA1 e10112f1ae9bf0eb94ec12446a3bb42f355834c1
- SHA512 8b47b8cc64b1a6f86b5f5032cdba44b974186e8c1e55034b4568f782d250927ded315889b831102f501d6df39e018d0c3b8802a739ddd5d29c9600a31e3cc078
- SSDEEP 3072:tLk7LiGf115+wMmmxBnYgdTb1T1EqeIVk2B1V7b/H4uNHCDml:l6LiGfgVX9Jflkyf4sCa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4388-134-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 39 4456 rundll32.exe 56 4456 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 4196 3B9.exe - Loads dropped DLL 1 IoCs
pid Process 4456 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4456 set thread context of 1796 4456 rundll32.exe 93 - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\DataMatrix.pmp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\cryptocme.sig rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\download.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Click on 'Change' to select default PDF handler.pdf rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Home.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-default.dll rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4340 4196 WerFault.exe 89 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000009555771c100054656d7000003a0009000400efbe6b558a6c95557c1c2e00000000000000000000000000000000000000000000000000a877df00540065006d007000000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2480 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4388 file.exe 4388 file.exe 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4388 file.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2480 Process not Found 2480 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2480 wrote to memory of 4196 2480 Process not Found 89 PID 2480 wrote to memory of 4196 2480 Process not Found 89 PID 2480 wrote to memory of 4196 2480 Process not Found 89 PID 4196 wrote to memory of 4456 4196 3B9.exe 90 PID 4196 wrote to memory of 4456 4196 3B9.exe 90 PID 4196 wrote to memory of 4456 4196 3B9.exe 90 PID 4456 wrote to memory of 1796 4456 rundll32.exe 93 PID 4456 wrote to memory of 1796 4456 rundll32.exe 93 PID 4456 wrote to memory of 1796 4456 rundll32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4388
-
C:\Users\Admin\AppData\Local\Temp\3B9.exeC:\Users\Admin\AppData\Local\Temp\3B9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141243⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 5282⤵
- Program crash
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4196 -ip 41961⤵PID:4540
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1008
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\back-arrow-default.dll",XCU3aFZB2⤵PID:4620
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-default.dll
- Size 797KB
- SHA256 6d886a5386770f3c33039943dd20817f03362a755419dbc09aa0c3c10767aec1
- MD5 5d7e190668edc0a6698cfad6a18afa58
- SHA1 9e35f54fc9c1b4b36c4d29c3158244e3b561e926
- SHA512 99391bd169b58777fbe6c0b60d4d0cb8fda4baa0f00509846d36bca5a32e054da018e46e58b85c27a00cdfedf0b527ded36b28fc6055ed66c62084e10375a065
- SSDEEP 12288:ChKaYc8qCnQb0IQz/FWnAeSnX+TEszp7feY/IXdgv18ywhz8uv0Ck51:UK3c8UQ5W9SX+XfeyF981z8Q0f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-default.dll
- Size 797KB
- SHA256 6d886a5386770f3c33039943dd20817f03362a755419dbc09aa0c3c10767aec1
- MD5 5d7e190668edc0a6698cfad6a18afa58
- SHA1 9e35f54fc9c1b4b36c4d29c3158244e3b561e926
- SHA512 99391bd169b58777fbe6c0b60d4d0cb8fda4baa0f00509846d36bca5a32e054da018e46e58b85c27a00cdfedf0b527ded36b28fc6055ed66c62084e10375a065
- SSDEEP 12288:ChKaYc8qCnQb0IQz/FWnAeSnX+TEszp7feY/IXdgv18ywhz8uv0Ck51:UK3c8UQ5W9SX+XfeyF981z8Q0f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\EventStore.db
- Size 32KB
- SHA256 0580713efb76985a3b2157d6f0b08665f8084243caad401a1faf53900564f935
- MD5 4e40dbba4bf3ea44a50ff74457aaf232
- SHA1 1b79ebb121abfb9c431852f0f783dfd89ec19f01
- SHA512 0fbd8723391dfc132e24068c2c79094cc788cd9e996eac81f07f7c6c44904cc483eedb4a6ae116cdbff8d35b769179635a71ef1a95882a356ce73e56f10a2790
- SSDEEP 48:THhL3FVbULdEbUrz4bKHakbKH6dObKH5MtebKH4EbcE:dL1Bz5wo2M2Oc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp
- Size 2.3MB
- SHA256 e347fda5fe266ffc80eb6a8b0f42a8d760e24a9163b68268fea075bdff84238d
- MD5 6b958c4a39a289fb50d1be3c67790743
- SHA1 cc5d65de72ef80f940f34349fd8edb6a123f2ff0
- SHA512 0d7f833d427d5330aaf2f85943db12d82923bc522d85e93d80dbc65539f8710966715d5f330ba6701449ca788971a84bf7605bc7263ee0793021a0eaeb956044
- SSDEEP 49152:G6IRfv7WM9xHDf3mCV+0rNAIkPfrK9cQPhg9fVIHZA6PoR:IFvhVjTM0rNAIqGWQ29f2HZAlR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
- Size 843B
- SHA256 dae20c31fd2cd68389b40f99cb7791c8d79d8d8aca2c417d90713ad6c926471f
- MD5 72d7dc9f57f3487a99e2f05c06274c28
- SHA1 ba789a0e8174327b30443f5b7131228f4ad40cf0
- SHA512 aa15897d32ee44cbb2a8d9dfbdbf32b7a6885150ca8fb5c715020310385e6f889612f80eb452ec73d444fdf03fef7eb920fe586662c2185c93a695e72d56362c
- MD5 SHA1 SHA512
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\print_queue.ico
- Size 55KB
- SHA256 4858a310c97817f76fd6430067ac3c0b54dc030f7547eb9fbdb082545e8cc261
- MD5 0f3c6d90637f0fdc57b1d303cf8d76cd
- SHA1 91cef4325b363b31e4555302a70321a2110b51cf
- SHA512 6f533242faef57f84c88ea6d5134f60f3fc8a9771a0106752d430875266698cd5d1d4beffd00abdd492d08d5f5365d905dd8869ced2ec0bc7c20be8430d73df5
- SSDEEP 768:eXsws/k6Fjspgmy8MypDEN15hqQMaptsJrSxbVDrYQ5F0lq/TX77GW54KE:l/bspgGZEdhqQMOtsCJYQ5FAqv7C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\scan_.ico
- Size 59KB
- SHA256 d3ba9eecc5e87b384242385078846cff82051194887ce2d7343bb7b60e7a26d7
- MD5 a161b3f9fd62c3931fbd79512810cffa
- SHA1 a63f1d8945b983356b66819b3aa5b0bd409995e4
- SHA512 f07776d386a39b20e3721b7450248e458ecd6f477197028aa42e2ab6a2731a002170a5415fb02fadac40b1b97acee3b5064ff76606ba2bcc14f7e7b674524299
- SSDEEP 768:OttO5RFvtvDoeYNTj3vJEk9YGGST9Ym3bD1ptnVIhmhB4LzwhsJFlJmT:wOPvrDu+khFTGmftVIh2aJFlJmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\setup.ini
- Size 214B
- SHA256 00b5526d5cffb22eb22eb663fd3863c3f287c5bfc951f1d45cdd0cf0b25c2301
- MD5 d8b2e1bfe12db863bdccdd49a5e1c8b5
- SHA1 9c979907f03887b270d4e87b0cdd5377cff3692c
- SHA512 3bf15a8620fa2269fb1fc7280bc203d62160f66d0cfcdc6422b0d33ab3745c6be864a8b51728f92b9e63ba3d7b1504ad8448996f14e866102369ea91b3ad7d41
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3B9.exe
- Size 1.1MB
- SHA256 f657d6f8f072dcf10f48e03b3b813cb9ab9c4b975dec12e9db8da868d3e50ab9
- MD5 7e9ce657b646e0ecff706bf6680061f0
- SHA1 8f576b573c55ba4b3a36b495e9ab0361270b0fd7
- SHA512 360890279533d6ad72f3640c31d7b7b69e5189ea65ca802e6855d6f874005838282b1caf0dde21ebcacc185d8db3229cf3c7fd4414a30660176ad4a6d352361d
- SSDEEP 24576:Hm7gvwjPpB5kd+TgBnFm4gi1pZzgBOkYFpfISXPvuLP:G0veRM4EBnF2ih7JpfIgPvuj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3B9.exe
- Size 1.1MB
- SHA256 f657d6f8f072dcf10f48e03b3b813cb9ab9c4b975dec12e9db8da868d3e50ab9
- MD5 7e9ce657b646e0ecff706bf6680061f0
- SHA1 8f576b573c55ba4b3a36b495e9ab0361270b0fd7
- SHA512 360890279533d6ad72f3640c31d7b7b69e5189ea65ca802e6855d6f874005838282b1caf0dde21ebcacc185d8db3229cf3c7fd4414a30660176ad4a6d352361d
- SSDEEP 24576:Hm7gvwjPpB5kd+TgBnFm4gi1pZzgBOkYFpfISXPvuLP:G0veRM4EBnF2ih7JpfIgPvuj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
- Size 797KB
- SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
- MD5 24925b25552a7d8f1d3292071e545920
- SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
- SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26
- SSDEEP 12288:ahKaYc8qCnQb0IQz/FWnAeSnX+TEszp7feY/IXdgv18ywhz8uv0Ck51:8K3c8UQ5W9SX+XfeyF981z8Q0f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
- Size 797KB
- SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
- MD5 24925b25552a7d8f1d3292071e545920
- SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
- SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26
- SSDEEP 12288:ahKaYc8qCnQb0IQz/FWnAeSnX+TEszp7feY/IXdgv18ywhz8uv0Ck51:8K3c8UQ5W9SX+XfeyF981z8Q0f
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\back-arrow-default.dll
- Size 797KB
- SHA256 6d886a5386770f3c33039943dd20817f03362a755419dbc09aa0c3c10767aec1
- MD5 5d7e190668edc0a6698cfad6a18afa58
- SHA1 9e35f54fc9c1b4b36c4d29c3158244e3b561e926
- SHA512 99391bd169b58777fbe6c0b60d4d0cb8fda4baa0f00509846d36bca5a32e054da018e46e58b85c27a00cdfedf0b527ded36b28fc6055ed66c62084e10375a065
- SSDEEP 12288:ChKaYc8qCnQb0IQz/FWnAeSnX+TEszp7feY/IXdgv18ywhz8uv0Ck51:UK3c8UQ5W9SX+XfeyF981z8Q0f
- MD5 SHA1 SHA512 SSDEEP