Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
05/01/2023, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target file.exe
- Size 213KB
- Sample230105-vejdzacf29
- SHA256 f04fbfcb6c3dc95153ecb44d83d1ddb80de24f52f1f74c0b26cdfc78514dba00
- MD5 c83b27d727ec5275faf091df4f12dc90
- SHA1 43de2b9a462377524f63fb2f9a21b22830f3c6c2
- SHA512 5af89a257aa350f5292dbd0491bf8a521528dc9f18801240f6301b86893cb9d42a876fae0ca6a1c60d97300a290f210703fa3cceaad7df73d203e791879b6545
- SSDEEP 3072:p6aXhJXDZLHR9lScVfbJAvcP5knqXSlmDvfHQF4MWzMK2:c6lLHRaEfbJAvpqXSqvf7PI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4372-133-0x00000000048D0000-0x00000000048D9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 67 2028 rundll32.exe 116 2028 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 4944 F1D7.exe - Loads dropped DLL 1 IoCs
pid Process 2028 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2028 set thread context of 4984 2028 rundll32.exe 96 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4028 4944 WerFault.exe 88 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002556d88e100054656d7000003a0009000400efbe6b55586c2556dc8e2e000000000000000000000000000000000000000000000000000c149b00540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2632 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 file.exe 4372 file.exe 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4372 file.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4984 rundll32.exe 2632 Process not Found 2632 Process not Found - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2632 Process not Found 2632 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2632 wrote to memory of 4944 2632 Process not Found 88 PID 2632 wrote to memory of 4944 2632 Process not Found 88 PID 2632 wrote to memory of 4944 2632 Process not Found 88 PID 4944 wrote to memory of 2028 4944 F1D7.exe 92 PID 4944 wrote to memory of 2028 4944 F1D7.exe 92 PID 4944 wrote to memory of 2028 4944 F1D7.exe 92 PID 2028 wrote to memory of 4984 2028 rundll32.exe 96 PID 2028 wrote to memory of 4984 2028 rundll32.exe 96 PID 2028 wrote to memory of 4984 2028 rundll32.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4372
-
C:\Users\Admin\AppData\Local\Temp\F1D7.exeC:\Users\Admin\AppData\Local\Temp\F1D7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp",Uprsprhaot2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239753⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\c16a1422.exeC:\Users\Admin\AppData\Local\Temp\c16a1422.exe3⤵PID:4500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 5282⤵
- Program crash
PID:4028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4944 -ip 49441⤵PID:4176
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2500
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\adobelinguistic.dll",CQMGc1RuYUc=2⤵PID:4732
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵PID:1412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeLinguistic.dll
- Size 784KB
- SHA256 51b0cc190a3b07c13cf2271692ca1b78d6275b9c77c3d23c0671b8bb60cd8094
- MD5 85c34e9932e5b786d72cb016c4c9a09c
- SHA1 790dfc81a94454e1be47c0fa9b1788473a1cb7f3
- SHA512 32be951ca7a9aba0a5da82ed56956defd3fa248cc9712881bef7af180db1ddf4a71c852a3adf8c9bde7b7961da267b129d1ce37d29e222e74cdd5d3fb96ce0f6
- SSDEEP 24576:d8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:mJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeLinguistic.dll
- Size 384KB
- SHA256 43d732a8141c12c9872a2140d9e8262d904ef65cf766c5d771d539ac007d1eba
- MD5 0e1c74176d66d208f8010db742e996df
- SHA1 aaaf4b5dd29bf4b3c4a248c2af1c3b9c8209b613
- SHA512 4f70a4d53ce580b94060e2a0cacfbececca4238c3a94fef7d2a979d8f3b21f855b5bcf18c7336a001cbbb53fddde34c54789375b4883195aec2d24a20b8dced1
- SSDEEP 6144:22rYq/yft1VIvagFQ6aeIdQ7naAcMdrmvxRdJjts4gFa5iVB/XbLuMdzWQwGEIH4:drYq6rVISg4e4mGt35UB/VdYZmze
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml
- Size 2KB
- SHA256 838e2cd11573dfcbb74c47621b30c5a7b62b2a063a41282a8e117b7b8fd5ebbc
- MD5 e52262399745fe981a7fba69c55f09dc
- SHA1 795a06836db2ead992013b55d2d5a87420be43e7
- SHA512 4b146141538edc8428d0bb0c8f314e3cc2f87e9888a82471f5c870a0779655944f8cfc34f5bc7bb2769d08d3ef3bac2cdf4f428d970bc1b480bce722a3b0291e
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\DiagnosticLogCSP_Collector_DeviceProvisioning_2022_11_11_13_34_40.etl
- Size 256KB
- SHA256 26cf983a78b3aee8b55f4f5dfb5a7ac24185feb354a005f3f27d2f295581764e
- MD5 46008821bfeb0d9899ddd4875f746d03
- SHA1 4be203208c4df83d7a6dd4bb1541e08a6bdf6bd2
- SHA512 97b989caf342e349df374e4763ba21286377e6ca96ef5108fb967d3ba05a02fa7b28bf9a7e888f9d0c33e99e375f7566a084e58f3312bc0a7e04ec21c36c3abe
- SSDEEP 768:sHpa+WHEtk9yTv9aTlXuqQV8a6caKsMzSO5E2X1yqty38DoK:m8GFX95DH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
- Size 839B
- SHA256 6893a54cc402ac94a278294c20918a5a6d15f8bf11995a8b2388dbe9fce5b966
- MD5 2f6bc19cc3de731b8eaec46910edaf83
- SHA1 61fd41f1fd1e4c6d7178a204c8ab68add839a199
- SHA512 841a7777d1cf45ae391a101a44a25407023dd66e539e303057f0bfd01db8b37f56f9047eeccb920a5cdaa3ce44779d1703235a2db510594f70bbd2eff441b15a
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Oreqhqoupyrw.tmp
- Size 3.5MB
- SHA256 ae96c901d373cc9123483d85dccf986c0d38891602e20999d241a21e08cff12c
- MD5 ac6b194e166627dcd57f8886c0a281a2
- SHA1 6c153feb6d65e57f05acff10817ba71e1cb2e0e8
- SHA512 348bfc46aa6d5de7ff6dbb2c21f1345bdb878ac876103b4860aad702014806d3ed6ae63e87acb626d1580817eb1a4349982a61cb83e87407d797cb7a644bbbdd
- SSDEEP 98304:6k+jMy5cDDKB933r/oXqKBbPJFbR/siRsfag052W/FFYp:F+YUeDKBhoX5FNsyAaTMuUp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\background.png
- Size 126KB
- SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
- MD5 9adaf3a844ce0ce36bfed07fa2d7ef66
- SHA1 3a804355d5062a6d2ed9653d66e9e4aebaf90bc0
- SHA512 e6988737153a0996b14e6baa45e8010ff46714fe7679d05a2676cc18e1c653e99227e7507cdae4f2b6a99b3c31478630e7e1ae13d0f7c12525406d8cf9867ca5
- SSDEEP 3072:fyUCC0XrT/ltzUKWzzsnQjjEWHUZ/HIO5tg9MlHuPPDF:fdoT/ltIXnsnQjjE4I/HIOrtOP7F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\resource.xml
- Size 1KB
- SHA256 50ce5d2f9497955246143e7bb7d7584f221c15574a910c7cc11af87537711d25
- MD5 9e3d2d6830eba41e31e8558da30ddccd
- SHA1 f5fbe0dfef87a30a9898cd6e1e7691c7dd9a9b99
- SHA512 d1f3774e8c2bdfb6acbb8b9429f59fce5048b5adc4ddc7ecacf7bf52862715db35aee04884a24a8e329e8d10aa5fd06cac5360aad9dd296582453fadadf4d7ee
- MD5 SHA1 SHA512
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\utc.tracing.json
- Size 41B
- SHA256 65961d7a83a876885a76d0afba18b9d4e516f784faea0fa8aa3cd800adec26ac
- MD5 15d46171ae3e6edc8839a02bbdb326a3
- SHA1 c618c841e768a2a2cec2d35184951011fa58cec5
- SHA512 9cecf542993b5469093e1227a3a414afde89e8d0111f4855cc9b99b13ff2628bf27cdd0d444aa29c5874a81c0954bdfc9fb730c072857a51875b46f0a68790a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\F1D7.exe
- Size 1013KB
- SHA256 fcdc00b6a7b07ff7d78d289e1995e819041bcae13fa2a42395d35040e5183238
- MD5 3f04522f1f7dbeca36de021d8ccad4b2
- SHA1 59185e48028afe5df2449fafa7222c4d87942443
- SHA512 0cb67a5b3bccb52f3ea9b816c820e75bdc4b6619c8e54736f3c7e797b3e5a0c324c0eda2cef76c4feefe03d75893f402254b3005897435fff87c44be446e6b86
- SSDEEP 24576:93BqlON7GPjZNqlv1Z66VjclYk3kzeTGQq:93ssCPjZmz6zPUzdf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F1D7.exe
- Size 1013KB
- SHA256 fcdc00b6a7b07ff7d78d289e1995e819041bcae13fa2a42395d35040e5183238
- MD5 3f04522f1f7dbeca36de021d8ccad4b2
- SHA1 59185e48028afe5df2449fafa7222c4d87942443
- SHA512 0cb67a5b3bccb52f3ea9b816c820e75bdc4b6619c8e54736f3c7e797b3e5a0c324c0eda2cef76c4feefe03d75893f402254b3005897435fff87c44be446e6b86
- SSDEEP 24576:93BqlON7GPjZNqlv1Z66VjclYk3kzeTGQq:93ssCPjZmz6zPUzdf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\adobelinguistic.dll
- Size 784KB
- SHA256 51b0cc190a3b07c13cf2271692ca1b78d6275b9c77c3d23c0671b8bb60cd8094
- MD5 85c34e9932e5b786d72cb016c4c9a09c
- SHA1 790dfc81a94454e1be47c0fa9b1788473a1cb7f3
- SHA512 32be951ca7a9aba0a5da82ed56956defd3fa248cc9712881bef7af180db1ddf4a71c852a3adf8c9bde7b7961da267b129d1ce37d29e222e74cdd5d3fb96ce0f6
- SSDEEP 24576:d8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:mJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP