Overview
overview
10Static
static
10quarantine/a.exe
windows7-x64
7quarantine/a.exe
windows10-2004-x64
9quarantine/b.exe
windows7-x64
8quarantine/b.exe
windows10-2004-x64
8quarantine/c.exe
windows7-x64
1quarantine/c.exe
windows10-2004-x64
7quarantine/d.exe
windows7-x64
10quarantine/d.exe
windows10-2004-x64
10quarantine/e.exe
windows7-x64
7quarantine/e.exe
windows10-2004-x64
7quarantine/f.exe
windows7-x64
7quarantine/f.exe
windows10-2004-x64
7quarantine/g.exe
windows7-x64
10quarantine/g.exe
windows10-2004-x64
10quarantine/h.exe
windows7-x64
10quarantine/h.exe
windows10-2004-x64
10quarantine/j.exe
windows7-x64
3quarantine/j.exe
windows10-2004-x64
3Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
23/02/2025, 22:42
Behavioral task
behavioral1
Sample
quarantine/a.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
quarantine/a.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
quarantine/b.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
quarantine/b.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral5
Sample
quarantine/c.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
quarantine/c.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
quarantine/d.exe
Resource
win7-20241023-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
quarantine/d.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral9
Sample
quarantine/e.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
quarantine/e.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
quarantine/f.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
quarantine/f.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
quarantine/g.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral14
Sample
quarantine/g.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral15
Sample
quarantine/h.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
quarantine/h.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
quarantine/j.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
quarantine/j.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target quarantine/a.exe
- Size 13.6MB
- Sample250223-2mse6swpht
- SHA256 c1dd9242c70478030751af26c10b7e899156ca9c59940bf9b99f8fabe9462cfc
- MD5 13ea80f504c5af62897d7f90fea833cf
- SHA1 41f38037f1a68ffe501ab9fd69926606bf032766
- SHA512 90be7f94ea361beb26339d05725b5e952465013a56e86c4c28893d9b1793d6e439ddfef41ced7b1d95c6083ed9a0afee6f5aebcbb9545a360573da2eea03d204
- SSDEEP 393216:x4AqHlN/nP7eo/ZeL+3yggnLTmJ5EioLbNT5U:klN/P7eo/ZeL+C1nLTmJhot5
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3873) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\gmreadme.txt.continental continental.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt.continental continental.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.continental continental.exe - Executes dropped EXE 1 IoCs
pid Process 3588 continental.exe - Loads dropped DLL 43 IoCs
pid Process 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe 3588 continental.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\perfd010.dat.continental continental.exe File created C:\Windows\System32\perfh009.dat.continental continental.exe File created C:\Windows\System32\SvBannerBackground.png.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\unisharev4-manifest.ini.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSPWGR-manifest.ini.continental continental.exe File created C:\Windows\System32\GameSystemToastIcon.contrast-white.png.continental continental.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\MSAppMon-manifest.ini.continental continental.exe File created C:\Windows\System32\MSDRM\MsoIrmProtector.xls.continental continental.exe File created C:\Windows\System32\oobe\en-US\OOBE_HELP_Opt_in_Details.rtf.continental continental.exe File created C:\Windows\System32\slmgr\040C\slmgr.ini.continental continental.exe File created C:\Windows\System32\uk-UA\Licenses\_Default\Professional\license.rtf.continental continental.exe File created C:\Windows\SysWOW64\@VpnToastIcon.png.continental continental.exe File created C:\Windows\System32\perfh00A.dat.continental continental.exe File created C:\Windows\System32\SecurityAndMaintenance.png.continental continental.exe File created C:\Windows\System32\Snooze_80.contrast-white.png.continental continental.exe File created C:\Windows\System32\catroot2\dberr.txt.continental continental.exe File created C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt.continental continental.exe File created C:\Windows\System32\uk-UA\Licenses\Volume\Professional\license.rtf.continental continental.exe File created C:\Windows\System32\winrm\0411\winrm.ini.continental continental.exe File created C:\Windows\SysWOW64\MixedRealityRuntime.json.continental continental.exe File created C:\Windows\System32\perfd007.dat.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\Netwfw06.dat.continental continental.exe File created C:\Windows\System32\fr-FR\datadict.040C.dat.continental continental.exe File created C:\Windows\System32\winrm\0410\winrm.ini.continental continental.exe File created C:\Windows\SysWOW64\srms-apr-v.dat.continental continental.exe File created C:\Windows\SysWOW64\slmgr\0409\slmgr.ini.continental continental.exe File created C:\Windows\SysWOW64\winrm\0407\winrm.ini.continental continental.exe File created C:\Windows\System32\RemoteSystemToastIcon.contrast-white.png.continental continental.exe File created C:\Windows\System32\en-US\lipeula.rtf.continental continental.exe File created C:\Windows\System32\es-ES\Licenses\_Default\Professional\license.rtf.continental continental.exe File created C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-constraints.js.continental continental.exe File created C:\Windows\SysWOW64\license.rtf.continental continental.exe File created C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf.continental continental.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf.continental continental.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt.continental continental.exe File created C:\Windows\System32\HealthSystemToastIcon.png.continental continental.exe File created C:\Windows\System32\SecurityAndMaintenance_Error.png.continental continental.exe File created C:\Windows\System32\X_80.contrast-white.png.continental continental.exe File created C:\Windows\System32\AppV\AppVStreamingUX.exe.config.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSXPS2-manifest.ini.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\tsprint-datafile.dat.continental continental.exe File created C:\Windows\SysWOW64\ja-JP\lipeula.rtf.continental continental.exe File created C:\Windows\System32\perfd009.dat.continental continental.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\Netwfw00.dat.continental continental.exe File created C:\Windows\System32\es-ES\datadict.0C0A.dat.continental continental.exe File created C:\Windows\System32\fr-FR\lpeula.rtf.continental continental.exe File created C:\Windows\System32\migwiz\SFLISTLH.dat.continental continental.exe File created C:\Windows\System32\oobe\fr-FR\OOBE_HELP_Opt_in_Details.rtf.continental continental.exe File created C:\Windows\System32\Speech_OneCore\VoiceActivation\de-DE\VoiceActivation_HW_de-DE.dat.continental continental.exe File created C:\Windows\System32\winrm\040C\winrm.ini.continental continental.exe File created C:\Windows\System32\en-US\datadict.0409.dat.continental continental.exe File created C:\Windows\System32\Licenses\neutral\_Default\Professional\license.rtf.continental continental.exe File created C:\Windows\System32\oobe\ja-JP\vofflps.rtf.continental continental.exe File created C:\Windows\SysWOW64\es-ES\lpeula.rtf.continental continental.exe File created C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf.continental continental.exe File created C:\Windows\SysWOW64\uk-UA\lpeula.rtf.continental continental.exe File created C:\Windows\System32\@EnrollmentToastIcon.png.continental continental.exe File created C:\Windows\System32\InputSystemToastIcon.contrast-white.png.continental continental.exe File created C:\Windows\System32\RemoteSystemToastIcon.png.continental continental.exe File created C:\Windows\System32\RestartTonight_80.png.continental continental.exe File created C:\Windows\System32\RestartTonight_80_contrast-white.png.continental continental.exe File created C:\Windows\System32\es-ES\datamap.0C0A.dat.continental continental.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-100.png.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-200.png.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-black.png.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24_altform-unplated.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png.continental continental.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] continental.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_id.json.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-200_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-400.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-125.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64_altform-unplated.png.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png.continental continental.exe File created C:\Program Files\7-Zip\Lang\co.txt.continental continental.exe File created C:\Program Files\Mozilla Firefox\defaultagent.ini.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png.continental continental.exe File created C:\Program Files\7-Zip\Lang\ne.txt.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\Icons_Icon_Wind_sm.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_ReptileEye.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-fullcolor.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7ce.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ui-strings.js.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js.continental continental.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-125.png.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-125_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\3.jpg.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js.continental continental.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-125.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-150.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js.continental continental.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.continental continental.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-100.png.continental continental.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-24.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-125.png.continental continental.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] continental.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-unplated_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-150.png.continental continental.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-300.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png.continental continental.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_32x32x32.png.continental continental.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\SmallLogo.scale-100.png.continental continental.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_52d476a2172491b6\srms-apr.dat.continental continental.exe File created C:\Windows\INF\PERFLIB\0C0A\perfc.dat.continental continental.exe File created C:\Windows\INF\SMSvcHost 3.0.0.0\040C\_SMSvcHostPerfCounters_D.ini.continental continental.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\overflow.png.continental continental.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.contrast-black_scale-125.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\SmallLogo.scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.19041.1_en-us_1f2bb353038d1523\perfc.dat.continental continental.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-72_altform-lightunplated.png.continental continental.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-16.png.continental continental.exe File created C:\Windows\Web\4K\Wallpaper\Windows\img0_768x1024.jpg.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-400_contrast-white.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeupdatesettings-page.js.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SplashScreen.scale-150.png.continental continental.exe File created C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-black_scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.746_none_e6778e5b0114e5b0\GameSystemToastIcon.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\enterpriseNgcEnrollment.html.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\r\oobeautopilotupdate-page.js.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-16_altform-unplated_contrast-black.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-125_contrast-white.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.contrast-white_scale-150.png.continental continental.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Dark_Scale-140.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\addXHRBreakpoint.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\editorDefinitions.js.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeWide310x150.scale-400.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\WideTile.scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\Icon_MMXresume.contrast-white_scale-125.png.continental continental.exe File created C:\Windows\WinSxS\wow64_addinprocess_b77a5c561934e089_4.0.15805.0_none_9e89016ae7b9c52d\AddInProcess.exe.config.continental continental.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-125.png.continental continental.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\6.js.continental continental.exe File created C:\Windows\Web\Screen\img105.jpg.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\PhishSiteStyles.css.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\ReadingViewStyle.css.continental continental.exe File created C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_es-es_765c3c4b51e37b49\DropSqlPersistenceProviderLogic.sql.continental continental.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\memoryAnalyzer\images\i_snapshot.png.continental continental.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\CellularToast.scale-125_contrast-white.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\f12host.css.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\dnserror.html.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechrecognizer-de-de_31bf3856ad364e35_10.0.19041.1_none_7fbfebf874c1a645\l1031.ini.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Ignore.scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Square44x44Logo.targetsize-256_altform-unplated.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\headerclose.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Badge.contrast-white.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Wide310x150Logo.contrast-white_scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-125_contrast-black.png.continental continental.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\SqlPersistenceProviderLogic.sql.continental continental.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\controls\Ruler.css.continental continental.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobedevicepairing-page.js.continental continental.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\AddInUtil.exe.config.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeprovisioningstatus-vm.js.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\eventBreakpointConditional.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-96.png.continental continental.exe File created C:\Windows\INF\BITS\0411\bitsctrs.ini.continental continental.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreSchema.sql.continental continental.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-400.png.continental continental.exe File created C:\Windows\WinSxS\amd64_dual_prnms012.inf_31bf3856ad364e35_10.0.19041.1_none_a3feabb281faa7e4\Amd64\MSIPP-manifest.ini.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\StoreLogo.Theme-Light_Scale-100.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\helloEnrollmentPage.js.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-white_scale-100.png.continental continental.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\OfflineTabs\OfflineTabs.html.continental continental.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-256_contrast-white.png.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..learnmore.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a4159ed16c134bad\OOBE_HELP_Cortana_Learn_More.rtf.continental continental.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\debuggerPrevTab.png.continental continental.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3588 1148 a.exe 87 PID 1148 wrote to memory of 3588 1148 a.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exeC:\Users\Admin\AppData\Local\Temp\quarantine\a.exe2⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ecb.pyd
- Size 10KB
- SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
- MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
- SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
- SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5
- SSDEEP 192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ofb.pyd
- Size 11KB
- SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
- MD5 19e0abf76b274c12ff624a16713f4999
- SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
- SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e
- SSDEEP 96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA1.pyd
- Size 17KB
- SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
- MD5 556e6d0e5f8e4da74c2780481105d543
- SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
- SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1
- SSDEEP 384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Protocol\_scrypt.pyd
- Size 12KB
- SHA256 eb2950b6a2185e87c5318b55132dfe5774a5a579259ab50a7935a7fb143ea7b1
- MD5 3b1ce70b0193b02c437678f13a335932
- SHA1 063bfd5a32441ed883409aad17285ce405977d1f
- SHA512 0e02187f17dfcfd323f2f0e62fbfe35f326dcf9f119fc8b15066afaeee4eb7078184bc85d571b555e9e67a2dd909ec12d8a67e3d075e9b1283813ef274e05c0d
- SSDEEP 192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_strxor.pyd
- Size 10KB
- SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
- MD5 f24f9356a6bdd29b9ef67509a8bc3a96
- SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
- SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b
- SSDEEP 96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
- Size 84KB
- SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
- MD5 057325e89b4db46e6b18a52d1a691caa
- SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
- SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
- SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
- Size 82KB
- SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
- MD5 69c4a9a654cf6d1684b73a431949b333
- SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
- SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
- SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
- Size 178KB
- SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
- MD5 ce19076f6b62292ed66fd06e5ba67bba
- SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
- SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143
- SSDEEP 3072:A20jYjQ80NV96LE2fU6CosjLEmMPi1ba+VRJNI7IM/H9o/PCrXuII4oFIDL7Riz:500rklqU6CoJ9PijTT4o8W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
- Size 290KB
- SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
- MD5 234d271ecb91165aaec148ad6326dd39
- SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
- SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
- SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
- Size 122KB
- SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
- MD5 501b867c424a8e3a41a9be4ab22dbeed
- SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
- SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
- SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_Salsa20.pyd
- Size 13KB
- SHA256 1ece1dc94471d6977dbe2ceeba3764adf0625e2203d6257f7c781c619d2a3dad
- MD5 f19cb847e567a31fab97435536c7b783
- SHA1 4c8bfe404af28c1781740e7767619a5e2d2ff2b7
- SHA512 382dc205f703fc3e1f072f17f58e321e1a65b86be7d9d6b07f24a02a156308a7fec9b1a621ba1f3428fd6bb413d14ae9ecb2a2c8dd62a7659776cffdebb6374c
- SSDEEP 192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_cbc.pyd
- Size 12KB
- SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
- MD5 40390f2113dc2a9d6cfae7127f6ba329
- SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
- SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1
- SSDEEP 192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_cfb.pyd
- Size 12KB
- SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
- MD5 899895c0ed6830c4c9a3328cc7df95b6
- SHA1 c02f14ebda8b631195068266ba20e03210abeabc
- SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7
- SSDEEP 192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_ctr.pyd
- Size 14KB
- SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
- MD5 c4c525b081f8a0927091178f5f2ee103
- SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
- SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555
- SSDEEP 192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Hash\_BLAKE2s.pyd
- Size 13KB
- SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
- MD5 d54feb9a270b212b0ccb1937c660678a
- SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
- SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f
- SSDEEP 192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Hash\_SHA256.pyd
- Size 21KB
- SHA256 16bea322d994a553b293a724b57293d57da62bc7eaf41f287956b306c13fd972
- MD5 cde035b8ab3d046b1ce37eee7ee91fa0
- SHA1 4298b62ed67c8d4f731d1b33e68d7dc9a58487ff
- SHA512 c44fdee5a210459ce4557351e56b2d357fd4937f8ec8eaceab842fee29761f66c2262fcbaac837f39c859c67fa0e23d13e0f60b3ae59be29eb9d8abab0a572bb
- SSDEEP 384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_ctypes.pyd
- Size 131KB
- SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
- MD5 2185849bc0423f6641ee30804f475478
- SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
- SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee
- SSDEEP 3072:gt2Y/2//P+H9SUNn8LBBhc5Nvf/FH3ofTvaZIDyPn3f2:gst/GH9SUCBIf/FH3ITire
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_hashlib.pyd
- Size 63KB
- SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
- MD5 cf4120bad9a7f77993dd7a95568d83d7
- SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
- SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
- SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_lzma.pyd
- Size 155KB
- SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
- MD5 3e73bc69efb418e76d38be5857a77027
- SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
- SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
- SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_queue.pyd
- Size 33KB
- SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
- MD5 59c05030e47bde800ad937ccb98802d8
- SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
- SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d
- SSDEEP 768:AkTQ6rDvtxZID9UiiQ+Eyobo+Y7N2Ip4SCxf1mljr8VMj:AqhTtxZID9Ui77yo47Q93fI38VMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_wmi.pyd
- Size 39KB
- SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
- MD5 e3213cf44340d7b4cb65f7231a65e3a4
- SHA1 815e5809a01905ecaa463f6827f657c11b95d243
- SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a
- SSDEEP 768:/oEkKVVgWOZbY7Ect6PlFIDLiTQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/oE9vjk0EctcFIDLi07yo47Q98fIW44w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\charset_normalizer\md.pyd
- Size 10KB
- SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
- MD5 480b5eb45af69a315bd2c3b1b34459d1
- SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
- SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
- SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe
- Size 16.8MB
- SHA256 11e8a2973e47efe62e7da025436e535fb2457283221a9b1e790ee61f9ffe1550
- MD5 d18c1f0bd16f3280edb0c7c1ed4262be
- SHA1 fca291f5e8cddfe9e3446956182ba33a9cb1241b
- SHA512 f49c6719ebbfe2a7d98cfb68dda50b0e1bb0d4ff6f4b19667411a90eb84c08cf670317ee4bc2605cde847808d82a0f60c4dd15cddb41343c28b2527cc80494f6
- SSDEEP 196608:L0qK8JAYQ1Hgfi/HvZTyGu/gDHY+JJjK3k:vsPvHvZT1RZJjKU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\libssl-3.dll
- Size 774KB
- SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
- MD5 4ff168aaa6a1d68e7957175c8513f3a2
- SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
- SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
- SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\python313.dll
- Size 5.8MB
- SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
- MD5 501080884bed38cb8801a307c9d7b7b4
- SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
- SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
- SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\select.pyd
- Size 31KB
- SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
- MD5 2663e22900ab5791c6687a264473ae1e
- SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
- SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
- SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\unicodedata.pyd
- Size 694KB
- SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
- MD5 c0b4c55ce3711af914b2015f707e4452
- SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
- SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
- SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\vcruntime140_1.dll
- Size 48KB
- SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
- MD5 68156f41ae9a04d89bb6625a5cd222d4
- SHA1 3be29d5c53808186eba3a024be377ee6f267c983
- SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
- SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\zstandard\backend_c.pyd
- Size 508KB
- SHA256 0b494d168a67f2eb2d75593714a4db65fe0f000b66388ab3c721a67515a2fefc
- MD5 23266e25821ce9e162f050db8b81c6f9
- SHA1 fd1049338e304d7688562991091d59c310999b23
- SHA512 e118531a6bf5354bf082d4ceaaf5247fea3305a9add399ecbbe08ab083d39ab760f3ca28a0dd2b4d5d8400f3e88ec3decd696e3987fb9f2264a5b8b16f66a61b
- SSDEEP 12288:AL1TGmvt0Vwyow0k1rErgw25rDjEA0Z7k45sWOC:A5lvt0Vw9fk1rErV25rE57k
- MD5 SHA1 SHA512 SSDEEP