Analysis
- max time kernel
1s - max time network
90s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 03:47
Behavioral task
behavioral1
Sample
4a5be414954dcf03646813f815811f9a.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a5be414954dcf03646813f815811f9a.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 4a5be414954dcf03646813f815811f9a.exe
- Size 126KB
- Sample240108-ecm2daaegj
- SHA256 1af2b29be3299ab755ae9cc7bd65892be012fa106683c530254a6201dfdc235e
- MD5 4a5be414954dcf03646813f815811f9a
- SHA1 7dafa4d0461a6ede85636efa1ba8bb4e08097880
- SHA512 0a93ad08b0ef04c11d4204bf9af9f449cbf32f786e5b39a8d60975bbea54eb24cdd2f17ba826de46a6836d1e58f7bb9900a5f8cc4671f2a2789624091cd5e3f9
- SSDEEP 3072:h4JbO0kqeoME17fbb4datl8cWQpyuOjYZb91:h4JaCeQlf3ztymqYZ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3388 SVCHOST.EXE 116 SVCHOST.EXE - Loads dropped DLL 3 IoCs
pid Process 5028 Regsvr32.exe 3388 SVCHOST.EXE 116 SVCHOST.EXE -
resource yara_rule behavioral2/memory/4996-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4996-17-0x0000000000400000-0x0000000000453000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Windows\\system32\\1024\\SVCHOST.EXE\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\svchost.exe = "\"C:\\Windows\\system32\\1024\\SVCHOST.EXE\"" SVCHOST.EXE - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 4a5be414954dcf03646813f815811f9a.exe File opened for modification C:\Windows\SysWOW64\1024\SVCHOST.EXE 4a5be414954dcf03646813f815811f9a.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" SVCHOST.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use FormSuggest = "yes" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "yes" SVCHOST.EXE - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 SVCHOST.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0" SVCHOST.EXE - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 Regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" Regsvr32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3388 SVCHOST.EXE 3388 SVCHOST.EXE - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3388 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4996 4a5be414954dcf03646813f815811f9a.exe 3388 SVCHOST.EXE 3388 SVCHOST.EXE 3388 SVCHOST.EXE 116 SVCHOST.EXE 116 SVCHOST.EXE 116 SVCHOST.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4996 wrote to memory of 5028 4996 4a5be414954dcf03646813f815811f9a.exe 26 PID 4996 wrote to memory of 5028 4996 4a5be414954dcf03646813f815811f9a.exe 26 PID 4996 wrote to memory of 5028 4996 4a5be414954dcf03646813f815811f9a.exe 26 PID 4996 wrote to memory of 3388 4996 4a5be414954dcf03646813f815811f9a.exe 44 PID 4996 wrote to memory of 3388 4996 4a5be414954dcf03646813f815811f9a.exe 44 PID 4996 wrote to memory of 3388 4996 4a5be414954dcf03646813f815811f9a.exe 44 PID 3388 wrote to memory of 4360 3388 SVCHOST.EXE 38 PID 3388 wrote to memory of 4360 3388 SVCHOST.EXE 38 PID 3388 wrote to memory of 4360 3388 SVCHOST.EXE 38 PID 3388 wrote to memory of 116 3388 SVCHOST.EXE 42 PID 3388 wrote to memory of 116 3388 SVCHOST.EXE 42 PID 3388 wrote to memory of 116 3388 SVCHOST.EXE 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5be414954dcf03646813f815811f9a.exe"C:\Users\Admin\AppData\Local\Temp\4a5be414954dcf03646813f815811f9a.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 /s C:\Windows\system32\MSWINSCK.OCX2⤵
- Loads dropped DLL
- Modifies registry class
PID:5028
-
-
C:\Windows\SysWOW64\1024\SVCHOST.EXEC:\Windows\system32\1024\SVCHOST.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Windows\SysWOW64\1024\SVCHOST.exe" "C:\Windows\system32\1024\SVCHOST.EXE"1⤵PID:4360
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Windows\SysWOW64\1024\SVCHOST.exe" "C:\Windows\system32\1024\SVCHOST.EXE"1⤵PID:3512
-
C:\Windows\SysWOW64\1024\SVCHOST.EXEC:\Windows\system32\1024\SVCHOST.EXE -sysrun1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1024\SVCHOST.EXE
- Size 49KB
- SHA256 3db08ea4bc5fc7141cc0d9d29815be43172ffdf46be06a481934fb29ac312421
- MD5 57e398935563605f2474ec14c41a931d
- SHA1 f9d1d960d68a6cf798d780b7c360ebbf22f550b9
- SHA512 15c6ef8a275b855e25c4ed9bdfb1b8ed05e4a7a90f9790bf40f89e5fb89463641535abb9ce3d56b3cfce963725357b02cc86c6614fd69f9f94c92bb69688454d
- SSDEEP 768:EKAWq8v6fEOiUU3IslGjZ11HhrwaQleEo4dsqC:EJWqIQEPzYslYrHWZleEvdsD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\1024\SVCHOST.EXE
- Size 64KB
- SHA256 6a12bf9016e12ce807dafe22f59e71568d5de36c3581610fb93867ff896ad5d1
- MD5 9c75f61955c3a1a6c472090765541a17
- SHA1 659d2978666f443190c14d9c6f82dc11282dc9bc
- SHA512 9a5d309cdc0df8c221d7a1a5e736db4dbfa91cff4afd651251ffc64a580932cbd5356b926fd235883b7530de25587736183c64a199a1648fd328b6a6eb13b895
- SSDEEP 1536:EJWqIQEPzYslYrHWZleEvdsV2/TtJNuW3uFt:uTnkYslY2mEve2/TtvuW3uFt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\1024\SVCHOST.EXE
- Size 32KB
- SHA256 5bac2cb9e0aa694949ca751c3206769e68f29326f5e7d7526de98c97ed5e5734
- MD5 9899ecdec32795100874fb46b0e3f091
- SHA1 8011249ac6537070c8a1e1f9fe46ed0edd8b3f34
- SHA512 af2326905e80ac59657bff755d15d24ab27c30b8ce2952893f7fe93219bfac238d00c20516d70f6ad180831e69978aa02bdf1d2aadbed30de30d85d73a6de353
- SSDEEP 384:EyYKAWqkM8voN3K6pmW+XOiURG3I/ow6JOiiN7j+xp4x75JQWHI5r:EKAWq8v6fEOiUU3IslGjZ11Hi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSWINSCK.OCX
- Size 60KB
- SHA256 1e554d0b8d2fa1553c6f2edf1a03c7ee445b343dbca5a2893029ec7d6cb023eb
- MD5 9624c09ecb148881b8e3abdb4feff948
- SHA1 b20a841a378fa316cd34face0eba084b56b2b389
- SHA512 3c5c4928882b94a7724c12ec6eb49de108bccd25ae403ad72a5f289e1c5d0e860933bf36a56bbf0cc0241d89b715ece83469f2350e74c2a61a194983fcbd218a
- SSDEEP 1536:UXqso+cSQinVq37RRkDRibFdRrqo0aRj4:R7ZSBYfkVoFdRrqo0aRU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSWINSCK.OCX
- Size 38KB
- SHA256 869d7ba1cad348472ac3d453bf98d20572ff57b7300b9d1749fc4c559795f8bb
- MD5 d1de00572a501ecc51b2636d4f274579
- SHA1 273b5ed323ff8fb1100dab9431b8bc3779120c3f
- SHA512 d2c07db26311609688eb2ab1c3d3506644dafc4171ff3a3f636b70bbc935c3cf7c62309dc1ec2723ebd75bc8e6334490da5ed2d8d747a7933dcb36904df6c05c
- SSDEEP 768:idh51IyinSno+9bO2TQinVuKMyAnzBN+oNRKD+OqHsfDtfb:UXqso+cSQinVq37RRkDRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSWINSCK.OCX
- Size 36KB
- SHA256 8aeda5fffdea52521bbbc08df8870bbc696419ea9b0eca21d9868538eea09a0a
- MD5 c1bf0fd156f40e238f293cee4df3b597
- SHA1 38b6c0cb2bd9bf6804cd5abe838112a71548c24d
- SHA512 7912b3a87fdcf22aa38d4a45fb2cce8d7fd11c5fa46edd8039db31ed057507fb88947d4007dcdeabd6f81c7d59018bb7e0ff3fe7b2f822ed7fa5a60bddb53fb0
- SSDEEP 768:idh51IyinSno+9bO2TQinVuKMyAnzBN+oNRKD+OqHsfDz:UXqso+cSQinVq37RRkDz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSWINSCK.OCX
- Size 19KB
- SHA256 35d99275116e4709f1c3f6c1d6b4f58983bb447b106a1ce9474967910da00664
- MD5 9b8011cfd868d2a23aa43fba64283264
- SHA1 b29ff128cba67faa140a0626e2aea408495add70
- SHA512 6335e59df53076c546780e5d73ea78d39bbdf0d7a6deca9b4ce5a9fda953510812fb0154c898da01e2cfdc177e0b7b5b0353373cb682b4be346b82cb1e8d2d3f
- SSDEEP 384:8DRv4Y+y7Pk+dFKoIkMOhiJJWbqF7gnayo0gsF6FcIYFMWu8FPIKO2TKQ:idh51IyinSno+9bO2Td
- MD5 SHA1 SHA512 SSDEEP