Analysis
- max time kernel
30s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/02/2026, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
- Size 19KB
- Sample260204-td8rssdz7a
- SHA256 e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0
- MD5 f017de2a359a2993859c342757f6ab66
- SHA1 5f8a9573823cd52614b337e1d2cd5e07796b7978
- SHA512 7b79e5c3dca730119519f6bd44fbe043fd2691b8e9738d054da87bf4eaad1aec43e2948659a702d1560fcf0b01344fcaf37db06a519f8cbe4c1c819d02b9de40
- SSDEEP 384:Y/wwN8zNJNFz/fpfXMPth+oOaB8BYsscDRk:MVOXflXWeoOXscDRk
- TLSH T19A925B17FB960AEEE41BD278C455642FD0B5341D2322E7FF87918A211E762D0AF3634A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Smert
Smert is a ransomware that has been active since 2024.
- Smert family
- Renames multiple (712) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File opened (read-only) \??\B: e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\WinBioDatabase\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\en-GB\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\he-IL\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ja-jp\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\MailContactsCalendarSync\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\nl-NL\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\OpenSSH\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\pt-PT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\CodeIntegrity\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\AdvancedInstallers\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\DDFs\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\icsxml\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\lt-LT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Sgrm\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sppui\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\bg-BG\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\hu-HU\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\it-IT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Keywords\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ro-RO\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\catroot2\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Dism\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\et-EE\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\migration\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\MSDRM\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\SecureBootUpdates\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ShellExperiences\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sl-SI\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fi-FI\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fr-FR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\hr-HR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ko-KR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\osa-Osge-001\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\tr-TR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\wbem\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\downlevel\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\es\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\config\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\DiagSvcs\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\oobe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\pt-BR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\si-lk\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sk-SK\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ias\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sru\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Sysprep\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ta-lk\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\th-TH\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ti-et\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\AppV\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Boot\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Bthprops\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\da-DK\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\dsc\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Recovery\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\F12\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ff-Adlm-SN\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fr-CA\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ras\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\restore\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ru-RU\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\WinBioPlugIns\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\appraiser\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\it\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\resources.pri.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\PointerIndicatorVertexShader.cso.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\clrcompression.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SphereGeometryShader.cso.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\History.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\clrcompression.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\clrcompression.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Curve25519Wrap.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\mfc140esn.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.Preview.winmd.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Text.Encoding.CodePages.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\igxim.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\mpvis.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\MsEdgeCrashpad\throttle_store.dat.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.Contracts.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\react.uwp.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Requests.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\SelectNew.ppt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\SharedUI.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Internet Explorer\fr-FR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Common Files\System\wab32.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Principal.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Media Player\ja-JP\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Photo Viewer\PhotoBase.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.js.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlookBackground.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase.Component.winmd.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.NetworkTroubleshooter.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\EntSyncFx.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Common Files\Services\verisign.bmp.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxManifest.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\resources.pri.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\FrameExtractorPage.xbf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Uci.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\DiagTrack\utc.allow.diffbase.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\comicz.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\jsmalle.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Boot\Resources\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\es-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\MSDTC\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-150_altform-lightunplated.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\Gaming.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\appxsignature.p7x.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_pin_l.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\cambriaz.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\DUBAI-LIGHT.TTF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ssee1256.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\ServiceModelOperation 3.0.0.0\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Logs\CBS\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\appcompat\Programs\Amcache.hve.LOG2.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_helpsel.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\larrow.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ega80866.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ega40857.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\mvboli.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-400_altform-unplated.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\arialbi.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\c8514sys.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\modern.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-100_altform-unplated.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\diagnostics\index\NetworkDiagnostics_6_DA.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ANTQUAB.TTF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\Gabriola.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\segoeuib.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\vga932.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Globalization\Time Zone\timezones.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\courer.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\courfr.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\appcompat\Programs\Amcache.hve{00b49be7-fdb4-11f0-a538-f6bc69445cd7}.TMContainer00000000000000000002.regtrans-ms.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\README.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Boot\EFI\kd_0C_8086.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ega80852.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\vga865.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\trebucit.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\Contact.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\cga40866.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\IME\ja-JP\SpTip.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-150_altform-unplated.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\pen_rm.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\MSUIGHUR.TTF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-150.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-100.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_busy_xl.ani.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\MISTRAL.TTF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\smaf1256.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\bcastdvr\broadcastpause720.h264.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_busy_l.ani.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_move.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\pin_l.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\diagnostics\index\NetworkDiagnostics_4_NetworkAdapter.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\corbeli.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\apppatch\it-IT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Branding\shellbrd\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\servicing\InboxFodMetadataCache\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\diagnostics\index\KeyboardDiagnostic.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\coue1256.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Fonts\ega40852.fon.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4432 4640 e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe" --foodsum2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4432
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.smert
- Size 4KB
- SHA256 1d73ef6466948588e619988ff4c0fc909fdc0ce173961a8424dcbe12392ed675
- MD5 68f2854f1cffbb0911c286e2663c9a11
- SHA1 4ff2f6249a36158ea1ba2950d55145fecb13a49f
- SHA512 888c1a9be46c5e4ffa15cd38879293ab0bd584437f129a197a03119e29c601695b883f2818e0c5a4dd84dff1f2590f0dcbb98999eab3a375c190c329c3a0f808
- SSDEEP 96:eFSNtC2CZvjD7ldktW+mQw/4mYA7HXdMuEobU+VpSM0I:eFWvCp/Zdkk+mtfYA7HCuEMU6SM0I
- TLSH T1E2917D960C8A39C57C62F0AD9D9483C953D0D09FFCA995B6A43B878170AC2C59DAB066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\README.txt
- Size 138B
- SHA256 9bb7976aebf8f689b9484d307655cc961a726a670c45ae2d63460fb0dac48aab
- MD5 ec6b6c531e95fcba2da4e24eb5523efa
- SHA1 838c4527c451d98e6f0f58fa1a306ef82e62d82b
- SHA512 919ab2b44163f5c51f8f133ae582c565ad7debbc0c322f8eeebec2c103354ca26102b8c94a1a39bfe9e37f1b59f0261a404e7c41213ea3dcad0a33e330903d0f
- TLSH T102C02B0FD51C3A0894100B1432015E60FB07491206D025660DCDD8707BE61E5A383852
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\StartEnter.MOD.smert
- Size 836KB
- SHA256 02ed81015d836cb147b6fc9cb4141dd327461bf27b1618790a741266aa6078d9
- MD5 e1b625b59ca40a25b6ec4b4d1f1a3902
- SHA1 bf76f3e4fbb8e7a6daa847bfda0715fed4df478b
- SHA512 7110e94f68010306d97a986844b4d0ef0a84456f43432c173271960ff3d641335ca028f91401bb4618bebe660db5ddc534451e7eae8b461b26f24504e443d0f5
- SSDEEP 24576:zqy4mVibGZEKyl1qxxEOk+RJG6g2SntVUFfEM8c2:2yVLAlrOkM62StVUFlM
- TLSH T18805338C9C727264F330466DA762FA5CD1D9B1673DF912C91B0E6C991AFAB089D4CCE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Fonts\sseriffg.fon.smert
- Size 88KB
- SHA256 a720741b84346c9c087be604187abf6fdd43b8e732efe6f9135fec1d9189bbc1
- MD5 b0d8a3090abc5a610c8f3914a57cb5b5
- SHA1 f1c388e37ec27ee0c5c6beef80b6768a9dbecf75
- SHA512 5d24051e7e2e910952d4929cf9e42cbbed61495df72754ac25cc75a3fe0766b262e7d920ab92edfbfd7dab098e3fa780a129edff1c1ee811dab3c3321363a853
- SSDEEP 1536:swv4w6wH8rw0XQOy36pLQVuysJjCTM2oyzYm9UDouel/q1xHLqAuCSLf:swv4Tm8rwvOy362VJcjUMATHTAHLqAut
- TLSH T18D9312C418E3C8C15097CF4734B47BA7A95DB93AEDD261A118B526C78606DEA843DB33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Media\Ring09.wav.smert
- Size 848KB
- SHA256 3b61aa60f1fd3ccc37ba39c7736dea6af503085318dac77ddedec4749e97d085
- MD5 e33d5608434e12d67bf831fbe46717fa
- SHA1 b77c224917091fa98b800ed61df91f2f050b999a
- SHA512 e2f4f8fca1e6300dc63ba7257083bfb78cb330d4ca855221ac9083629c79a7846d5135329e66fa64889db3473673cfeb7e8e271fef81a04a17afa4d28899574e
- SSDEEP 12288:zY9NLz2iXF/J1ySHhgjyIrXWn4zoxkC5p6ecnitFq5F3XwUhTxb6yg5J+RAH9EQS:w2qBypzrXoSWp+OkF3gUhR6ygSyijaUl
- TLSH T16805334CCFF18C711F8573D99A88B4A93830B3EA2001F4295652DA7AED72EB97C4D4D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\PolicyDefinitions\en-US\WindowsProducts.adml.smert
- Size 5KB
- SHA256 33cdd460259652b9c882137c0342659236c18e336a48d56de806155438f77a4b
- MD5 7c6e5b536cab0f4e6d6100638a2ca985
- SHA1 7d551e4492b7ae00b1b428a717cdcb3336ce9e0d
- SHA512 084491fdbf5066cdd97021016e838911c49903b11be64e5effee2ee804e5c32c12ffd4359c3f6af3a48f0bc468ceecd69611aa4a82845267c7e92b18d79d17f6
- SSDEEP 96:F0TdsBl9VkiCJqEyXBNVYxRujpKc2P9k2yZVxwFN0p+SysPWqZ5YpKcVZld9C5tf:FKdkXVuqE0VYTujpKjP9kV+n0p+gPYpw
- TLSH T1B4C19E013C59B97B6B0C111059E3AD1CD7696B1BE1D9D23EED32D320A2CF626D0B606D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\PolicyDefinitions\it-IT\CredentialProviders.adml.smert
- Size 8KB
- SHA256 19e6fd3a206e446fd5abe105fab9953ea7d2fe97cf0b0a2382770b7e7efd4b51
- MD5 41f7c80f53c7c6e76751ce968ad54613
- SHA1 6fa5c32fde0830635efeef221f97104a14db2be2
- SHA512 2799ae8f00cfeb10bbd46d2f19c1774fff9dbd46073014981d1316ac64ed6b4f1a23ac0d2626ef4461c4a95edcba3267fb7307aa619e3d0e123976fbcad8a1d2
- SSDEEP 192:YBK7sXy9JjwwA99vcT3DDuK68UL2jO1vz2iEaRBLl2Nub6AUfK51l:YBK7si7TK9vP52jYCAG3aP
- TLSH T11F12D095AC13D7D8978742A58C9FD88D09BD680F145477E078635811CB38F1B2F7C638
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\DRIVERS.LOG1.smert
- Size 128KB
- SHA256 6ea24f861c713fd5d9bb4b14e211ea200015a0bf1590039ff241b66ba59a050c
- MD5 8d6ac32ebe1983676773ef25b2bdcef8
- SHA1 98279c49d9d41d00bc689d89f9cb4984b2dfd04c
- SHA512 22e80cb14c4899fe647712ac6817cb68947a68b23f3d073b145ead08a39515892c348a45e7aab1a8f95b9d28b49eb02037319a5461216d1344e3d80fc34beace
- SSDEEP 3072:7yzS90Ai1M1IdZqI2EIhj6j1LOs+3l86weGxVFy72:7IsIdUlHRk9+1Gz3x
- TLSH T14ED312DAF101E129C56C2CFA614FE264104726D5C9FAB4FC02BBACF9EF6847C154A253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\de-DE\StorageContextHandler.dll.mui.smert
- Size 3KB
- SHA256 184e15cd28f2939a14e3b170f4a382ebea841755454b3605a70737b78c7001d8
- MD5 cc51ce922c143fdc4c6e45cf21daa6f2
- SHA1 f19d21409558bd7d74cdf26ae05caa7b4419b897
- SHA512 fd1a260222ab787f39d18cb23d9ed72d169e84f9682d53ccd6574de50873dd3af253591e80a35a4094a0873eaaccfa09b5cf11df13a1ef4d210b0e6c5d62376d
- TLSH T170515CAD4D805380768A7B0BDC0DBC8FB262E4286C6E40A0BD917F13E6FED0110155F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\de-DE\dsregtask.dll.mui.smert
- Size 3KB
- SHA256 85eed7a951473a443a9bdabe53fe527cc047fcd6a014e59efe50d675bf8fdd72
- MD5 0bf38e9aec3af726a1435163e611a8f8
- SHA1 a1c392fd4d5953b47d7fa37de3e9529e1c625896
- SHA512 92a10ab9ddcad629a2b1ba340562c8db6b5bde54ef9c04a6131cba6ae2d6973af1dbda67b0139661f7d76b01f174f46370ae4f6960a0a351b792ba2213169b8a
- TLSH T101514B98586BC8A928A001A7FD135CA728F542240102AFC2FDBD83A9654CE9B1F4E691
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\de-DE\scrnsave.scr.mui.smert
- Size 3KB
- SHA256 25de571346d37f3645b03c39a1d0e7ee5822770c577166c99e9f3c2a2d821c43
- MD5 d100ff6fdffe6e766dc00a64f5df50c5
- SHA1 230518a3d2710e77be15f20f3efa6a19d95c06e7
- SHA512 cb8006136742603f1ac3b093aa3cd68547cb1b8e3d0241c10e6b3726b3119be1a5d909e6489e7f8122000c961d792e1783d462d5c018e5b9dd264c814e974017
- TLSH T113515D960CC938D5B822F0BD4AC4874E47D0C18EBD69CB62E876D354319C6C5EDDF068
- MD5 SHA1 SHA512 TLSH