Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
05/01/2023, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
- Target file.exe
- Size 209KB
- Sample230105-hlxtqaef31
- SHA256 ebfcf679363659ae76c7194c1866c37e2308d4ce27276f2ec7ff6aebb4f245f0
- MD5 88acb7ebda96ae4b5b0ebfd4ecfec8b4
- SHA1 a6e16fbf8e620d519e5b10df24936d14cea975c3
- SHA512 fb6c39f997247fa78b461a80ee79fdaf137bdbad58e63f1aa7e3129a6d4c07bc918b1ad8941c85aec6490f2453877b809c2184d6f17d0845a9d382a1ace7bc02
- SSDEEP 3072:iXKXfvOILkcfh+2/45kzeWcXiqsfhTrejEDZp8mcTdxZvPArl:ii7LkN2/sbXiqsfInFI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4212-133-0x00000000005A0000-0x00000000005A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 37 2660 rundll32.exe 40 2660 rundll32.exe 65 2660 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4200 CEAF.exe 1064 103D.exe - Loads dropped DLL 1 IoCs
pid Process 2660 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2660 set thread context of 1380 2660 rundll32.exe 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 1664 4200 WerFault.exe 84 4484 1064 WerFault.exe 90 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000025565b3e100054656d7000003a0009000400efbe6b557d6c25565b3e2e00000000000000000000000000000000000000000000000000c322e000540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2184 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 file.exe 4212 file.exe 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found 2184 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2184 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4212 file.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found Token: SeShutdownPrivilege 2184 Process not Found Token: SeCreatePagefilePrivilege 2184 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1380 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2184 Process not Found 2184 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2184 wrote to memory of 4200 2184 Process not Found 84 PID 2184 wrote to memory of 4200 2184 Process not Found 84 PID 2184 wrote to memory of 4200 2184 Process not Found 84 PID 4200 wrote to memory of 2660 4200 CEAF.exe 86 PID 4200 wrote to memory of 2660 4200 CEAF.exe 86 PID 4200 wrote to memory of 2660 4200 CEAF.exe 86 PID 2184 wrote to memory of 1064 2184 Process not Found 90 PID 2184 wrote to memory of 1064 2184 Process not Found 90 PID 2184 wrote to memory of 1064 2184 Process not Found 90 PID 2660 wrote to memory of 1380 2660 rundll32.exe 93 PID 2660 wrote to memory of 1380 2660 rundll32.exe 93 PID 2660 wrote to memory of 1380 2660 rundll32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4212
-
C:\Users\Admin\AppData\Local\Temp\CEAF.exeC:\Users\Admin\AppData\Local\Temp\CEAF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp",Uprsprhaot2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239453⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 5362⤵
- Program crash
PID:1664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4200 -ip 42001⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\103D.exeC:\Users\Admin\AppData\Local\Temp\103D.exe1⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 12082⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1064 -ip 10641⤵PID:2056
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4088
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:3116
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\fulltrustnotifier.dll",ZD0nNA==2⤵PID:4180
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\FullTrustNotifier.dll
- Size 784KB
- SHA256 8f73f4d6178cbbfefba46bb5b2fc0b336ba9f9e94664a7953b950056fdd6178d
- MD5 03fc397b7640dc5583901e1bdb2c5cba
- SHA1 99573df56f902cf003f139d3472667b90d6c3cad
- SHA512 d411f0d7f230922e6af1dab783a217f00982154d50092ab80d39de3bbf66b8c47c120cac97c3d1a3f1550399792d7440bec1c63af8d057d4a480caf85eb78972
- SSDEEP 24576:c8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:jJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\FullTrustNotifier.dll
- Size 784KB
- SHA256 8f73f4d6178cbbfefba46bb5b2fc0b336ba9f9e94664a7953b950056fdd6178d
- MD5 03fc397b7640dc5583901e1bdb2c5cba
- SHA1 99573df56f902cf003f139d3472667b90d6c3cad
- SHA512 d411f0d7f230922e6af1dab783a217f00982154d50092ab80d39de3bbf66b8c47c120cac97c3d1a3f1550399792d7440bec1c63af8d057d4a480caf85eb78972
- SSDEEP 24576:c8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:jJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
- Size 15KB
- SHA256 5aa9e0d9f982ffa00c39ee9070a398e64f33959181ebfe9d2ee497f59ea10c12
- MD5 c79d743dc754585c49ffc41a15c33c71
- SHA1 15df899dde702aa45be8f2fdc936cc03cf3d3016
- SHA512 5ba9c252c91bce7d9e6dbdc64c513e4aa6a9938502ff4c08dcf47025e03625d933aedbc0ca55ad6145fc6f86a00740edfcf48c58902a843c75e98cdf1af487a6
- SSDEEP 192:0xvBRjJSDUCdEm/DUCdEma6Y2whyM3hARUCjbEmNo:y31PIgIa6YRvh3mPNo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\CiPT0000.001
- Size 64KB
- SHA256 c10595f1ade2f1adced14a578b437e6958adf631c01a4c167b14b6904eaf2680
- MD5 08c1446a011937f5608e5f2448443304
- SHA1 53e7291e9b33e46a17d9514a6005302e79a36407
- SHA512 a7a339940faba59e5a07b715ae39df9de39a4e69913d8d347cd696709a3191483537d1c011a1bea2d5faa222bf768e33dbde5791d04458b7e14a3db494eb6b07
- SSDEEP 384:j6uuKCAGwWIKSy+ulyi+mEi+Sm6oO4eWWSVCCe8SOtEStPtYAmx0doh0OHsQrbb4:vEStPtYAssc4YT8D9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xml
- Size 2KB
- SHA256 c8c2ac11232a448dd5d78c34752f56b8f5b8e18fe79b3176fdd88759d5b703d5
- MD5 1f8001c5a3ab09524c8185d2657e471c
- SHA1 2297cd6ba695d3fa72f2a70a7db95f2e241116ab
- SHA512 d038b9b97a96b267684ba1a7d2458ddf63d3fd3ea8c58a213b5085196da9c7001fe1dbadfc75d2364befc09c9618c133b331ed487fcb043b6a923f3951be0b37
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\EventStore.db
- Size 32KB
- SHA256 0580713efb76985a3b2157d6f0b08665f8084243caad401a1faf53900564f935
- MD5 4e40dbba4bf3ea44a50ff74457aaf232
- SHA1 1b79ebb121abfb9c431852f0f783dfd89ec19f01
- SHA512 0fbd8723391dfc132e24068c2c79094cc788cd9e996eac81f07f7c6c44904cc483eedb4a6ae116cdbff8d35b769179635a71ef1a95882a356ce73e56f10a2790
- SSDEEP 48:THhL3FVbULdEbUrz4bKHakbKH6dObKH5MtebKH4EbcE:dL1Bz5wo2M2Oc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe.xml
- Size 29KB
- SHA256 7117f778c590d79b5a434edaa09448f23332d1db26676db2c9463b0d2c2ddfb6
- MD5 0edf0ff4a8a9986d080992dd07e8a177
- SHA1 bd58bb41baf5418a8ffaa8f75fb8fe412cf012a8
- SHA512 faa4c4fe982301ba2f5f2e239889c964bdb9f70b3939516e480987067a2b6482f6803bc06a514e6aac407be1306534b216dc2a801027722e985d1a2f41c01704
- SSDEEP 768:r7ykGLJrgbroiTN/7ykGLJrgbroiTNo7mV7/27T7rN7147X/7br7so8E7Rg7U7Kt:Rx+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe.xml
- Size 9KB
- SHA256 bb39de067132d2ccbb7a3c066743010f070a3c3856f42ccc892da0b40012771e
- MD5 996f11041df0526341cebbbd40a98390
- SHA1 37f652515ef8c662840086d743f7f68d327cce52
- SHA512 6cafa4b3bd8c56d20859a4f8fb7109e3ca4c690d0746b13f9f2eaa19d88bfca469dc45d71fb91f5658f9cd300f285aafb9e212ebd7c1496aadb6046da4e56c03
- SSDEEP 192:KEmP0oyC2JDsDn/ZMZwZUEJWcBtMbZv0IKVptlONftrMBr9Imfipoaag+zysaZvJ:KEmP0oybOj/ZMZwZUEJWcBtMbZv0IKVu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe.xml
- Size 15KB
- SHA256 0543ea8c8efce3d69431f57affc2cfa44df1b9244a25ed080e4b2014d0419026
- MD5 2f71d0396b93381c1fd86bf822612868
- SHA1 d0801700dd00a51276f32c6ed19f5b713b5db825
- SHA512 67022ce5c41641799abff9e68cb3f049c5d932aea5c6fd8748469e2e7f51f987f1bdfc7d831a8d11a69d99a77cc363c51db8be6ad50e4014eb63a15c1f25a722
- SSDEEP 384:nEPQZK3DvtwWHklQoiOudyrPm6bzon4llt+G9blyv1ygUmAvpCsMRQvxvvsvX9SD:fK3Dea/qvFZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\MicrosoftInternetExplorer2013Backup.xml
- Size 2KB
- SHA256 37e639679abd36b5b59324eea7aa1d602ff9c287e5c07dfd335ee1a85b68fc50
- MD5 16fa6bd16573d544916a2cb3335a1f13
- SHA1 479c5b9375b5b351d7dc217deb159fe92da03f75
- SHA512 9a871284356b2217fc8dbd568c6731def7781cac4550e77824f5c683b29313cd46e444760413ec730e8f70669ff08b62ab9b73c8099115a71eb84d7d728e2873
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\MicrosoftOffice2013Office365Win64.xml
- Size 10KB
- SHA256 3fae1d780e8a63d73847dc38412952c238d0e3ca01a97caee718489a3d424893
- MD5 46353bb25b4eb2e9d26a25744c716563
- SHA1 a9a9c2a1260542b5246fd642425dcc2a29a098c1
- SHA512 09027ff22d03712258dbd10d6fe2cafbefd90e974210b09d20008d8eb6b569915064c65a7403187b0d78e79c96838cc0bba49b089acc7c7ab790866359719197
- SSDEEP 96:d2eMx87B4ZlSlElSlq8PelSlElSlq8OOr4lSlElSlkf78v0lSlElSlq8GilSlElK:oLXsrg75Ev9HSV04h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\MicrosoftWordpad.xml
- Size 1005B
- SHA256 214762acb145e4bbfabd685705707097bd5f5b8dc739c1c18b200d50c5c2f303
- MD5 576da3ac22d84c085a753ad324e5af0f
- SHA1 1ce9245047e7da3eb4e81356434ca190fe4f924f
- SHA512 dde20be02f91f438350752ff98bc6cd21dd9f2cb057fcc3f08d90ea889a69e0bb3e7f7a8fb554a7767d5a3ab74de3e8c090943730e5e197b07304221c2a8b9c0
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Oreqhqoupyrw.tmp
- Size 3.5MB
- SHA256 620416713c57d510a4544ae8bb9f9be90395ce5afb99a61183083eea03d1d906
- MD5 a7a5cabc47a76e4fe23261fe331505a8
- SHA1 f73296e5a74fea72f1b5fbbd0b479682468ad5bb
- SHA512 c54ae93c33a9cb2a8098f2577be553548e0cf9929c336aa4880aa8bcf7f58ce8608bc1ba97408a8e5e05f825d79fe19a319e02d8d1aadebe2d33351c4027fe6a
- SSDEEP 98304:6k+jMy5cDDKB933r/oXqKBbPJFbR/siRsfag052W/FFYv:F+YUeDKBhoX5FNsyAaTMuUv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\edb.chk
- Size 8KB
- SHA256 c2cbce1f9f9bce0fb7dc1c423710d214b8fbf8ac6e34000ccf154c63715a8b53
- MD5 a1fdabb43891c22b3e6811dd0729e867
- SHA1 834a25d28e9b445cf0f9b6e4a02df63ffae8630c
- SHA512 bda00a40748332cdf8a5186445e909436d4e7d18a2e79644992a74388cc746ffd3348ddf545639dcf0f3ebbc1611826b0af05499c031868276ef4562343544ab
- SSDEEP 6:/liqoaaXOXaaXO3QmDsil8l7liqoaaXOXaaXO3QmDsil8l:/lyaakaaIQQrl8l7lyaakaaIQQrl8l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\edb.log
- Size 64KB
- SHA256 e0d93bd993ec25486d9b4b5bbedc65bc2769a0cd98e62c9995b3915466c223df
- MD5 fd4e5cc327244d9f12f8e9f52846525e
- SHA1 6acd348821e2b603a82250b1ac0abcd3864ba659
- SHA512 01270e0aaeb61d214a97f90d2a7b4151f7676b3560c80777cb5f0aba3ff31c5357e4726af211ac79573bfed54f691735141c3c49e9462c177d8d5eaaaec1ed34
- SSDEEP 12:wsjjURgaakaaIQQrl20mklMjjB/bFD05NDT2DC6oUk/v:HjggtktIkJzFD05hkyU6v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\osver.txt
- Size 10B
- SHA256 4906553c99e9225413bacd029603f2549fe8d972bf389770063f3e932b623d80
- MD5 bea59a2f25178d677087edde21c60be7
- SHA1 56844a00adee7f8d2c161808de19ce6fd191fb61
- SHA512 008622e6bf66c3cc4bdfc9cda7dc10376e310b560321ee0d7040f7c6da7673cd04799ee04b9e22bb45de378fa0791dc0b6bbf43efed1366d0520c26d803d7400
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\stream.x64.x-none.hash
- Size 128B
- SHA256 cea19b915390806a9677165794194c66b19e3198a342d51e5a880e7b55768ac7
- MD5 2b4d6d3b95916f9810449019372fbbde
- SHA1 2c9f59c51fc6b290f758aed25a899dba37459fc6
- SHA512 5cbb012b89989d53a7814dcb9f0391a761ebea6a7c9d1dcaae0efb476e61b30ce678387c4ff6fcebea0643f96d2f3bf126cff9511a75c1780ec89b51ba79c8db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\103D.exe
- Size 246KB
- SHA256 7bd7346f3ef17dd2c0cc405b6754ddcd7effd90619b94a1715fa90f9a5fea9ac
- MD5 0976a42399d372caa48da798822365e3
- SHA1 be612ffc4a8cfd2db7e7f3c4a4702d0f1b42fabf
- SHA512 2392de9736ae71e48e8bbaffef7056881795b23e6e1622e67a5155da3c9faaebdf37ebf760165161acabde35402693dd7da2a0bdbeda6c2ef93ba01e20a59027
- SSDEEP 3072:nXCIWyfLLKbGWBAP5zIcwR28ri1NYU7g0cD5+j7TZfGPTmcTdMdJ0mAl:XNLLfWBAZ4OcD5+jYPKdJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\103D.exe
- Size 246KB
- SHA256 7bd7346f3ef17dd2c0cc405b6754ddcd7effd90619b94a1715fa90f9a5fea9ac
- MD5 0976a42399d372caa48da798822365e3
- SHA1 be612ffc4a8cfd2db7e7f3c4a4702d0f1b42fabf
- SHA512 2392de9736ae71e48e8bbaffef7056881795b23e6e1622e67a5155da3c9faaebdf37ebf760165161acabde35402693dd7da2a0bdbeda6c2ef93ba01e20a59027
- SSDEEP 3072:nXCIWyfLLKbGWBAP5zIcwR28ri1NYU7g0cD5+j7TZfGPTmcTdMdJ0mAl:XNLLfWBAZ4OcD5+jYPKdJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CEAF.exe
- Size 1010KB
- SHA256 f5717aef9a4323816387603920b652a94ac0d9cedef36391cedd9cdcbfef7f60
- MD5 3ccd6b369eb1dde57d181e7550bd7268
- SHA1 aee399e263c838570c00133feab275b81009e12a
- SHA512 00bd3bb981e2a5bd4c30241025f352e9e528d76300e67fcdbe89ee9e12ecbba73b291aebd9b73f73a8aaa32e2a8b2d1b4d49796cdc11a1b891a313cf0a9dcc03
- SSDEEP 24576:RFOWvM7bZBFpXlDpRjJ5JAXVm359Ov9UIrczuX:RguWRNpRjJPgAp9ucz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CEAF.exe
- Size 1010KB
- SHA256 f5717aef9a4323816387603920b652a94ac0d9cedef36391cedd9cdcbfef7f60
- MD5 3ccd6b369eb1dde57d181e7550bd7268
- SHA1 aee399e263c838570c00133feab275b81009e12a
- SHA512 00bd3bb981e2a5bd4c30241025f352e9e528d76300e67fcdbe89ee9e12ecbba73b291aebd9b73f73a8aaa32e2a8b2d1b4d49796cdc11a1b891a313cf0a9dcc03
- SSDEEP 24576:RFOWvM7bZBFpXlDpRjJ5JAXVm359Ov9UIrczuX:RguWRNpRjJPgAp9ucz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\fulltrustnotifier.dll
- Size 784KB
- SHA256 8f73f4d6178cbbfefba46bb5b2fc0b336ba9f9e94664a7953b950056fdd6178d
- MD5 03fc397b7640dc5583901e1bdb2c5cba
- SHA1 99573df56f902cf003f139d3472667b90d6c3cad
- SHA512 d411f0d7f230922e6af1dab783a217f00982154d50092ab80d39de3bbf66b8c47c120cac97c3d1a3f1550399792d7440bec1c63af8d057d4a480caf85eb78972
- SSDEEP 24576:c8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:jJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP