Analysis
- max time kernel
52s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/02/2026, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
- Size 19KB
- Sample260204-td8rssdz7a
- SHA256 e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0
- MD5 f017de2a359a2993859c342757f6ab66
- SHA1 5f8a9573823cd52614b337e1d2cd5e07796b7978
- SHA512 7b79e5c3dca730119519f6bd44fbe043fd2691b8e9738d054da87bf4eaad1aec43e2948659a702d1560fcf0b01344fcaf37db06a519f8cbe4c1c819d02b9de40
- SSDEEP 384:Y/wwN8zNJNFz/fpfXMPth+oOaB8BYsscDRk:MVOXflXWeoOXscDRk
- TLSH T19A925B17FB960AEEE41BD278C455642FD0B5341D2322E7FF87918A211E762D0AF3634A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Smert
Smert is a ransomware that has been active since 2024.
- Smert family
- Renames multiple (1662) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\drivers\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File opened (read-only) \??\B: e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\F12\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\appraiser\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\es-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\F12\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fr-CA\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\it\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\MSDRM\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\id-ID\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\it\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Dism\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sppui\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\bg-BG\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\es-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\ko-KR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\WinMetadata\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\downlevel\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\AdvancedInstallers\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\bg-BG\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Boot\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ro-RO\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\th-TH\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\Bthprops\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\ca-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ja\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\wbem\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Keywords\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fr\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\gl-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\id-ID\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\downlevel\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\pl-PL\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\zh-TW\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\el-GR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\en\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\en-US\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\HealthAttestationClient\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\hu-HU\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\sl-SI\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\DiagSvcs\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\fi-FI\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Com\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\es-MX\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\SecureBootUpdates\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\SleepStudy\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\uk\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\config\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\OpenSSH\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\zh-TW\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\AppV\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\en-GB\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\migwiz\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\en-GB\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\fr-CA\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\it-IT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\da-DK\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\eu-ES\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\ko-KR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\lt-LT\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\pl-PL\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\et-EE\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SysWOW64\ru-RU\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\Bthprops\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\System32\fi-FI\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\swidtag\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\de-DE\shellext.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Uci.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\resources.pri.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\offlineUtilities.js.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.winmd.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SegXbox2.ttf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxManifest.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\id.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\ne.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Runtime.Numerics.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\mfc140u.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\da.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Microsoft.Apps.Stubs.winmd.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.ObjectModel.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\SimpleProgressBarTheme.xbf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.2012.21.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\react.uwp.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WebviewOffline.html.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\AppxManifest.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows NT\Accessories\WordpadFilter.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Mozilla Firefox\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\fr-FR\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\it.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\BuildInfo.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Media Player\WMPNSSUI.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Runtime.Handles.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Security.Claims.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\FrameExtractorPage.xbf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\KnownGameListRS4.bin.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Google\GoogleUpdater\updater.log.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\RestoreUninstall.cab.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Modalities.xbf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\7-Zip\Lang\sw.txt.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files (x86)\Windows Media Player\Skins\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Newtonsoft.Json.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\clrcompression.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Private.DataContractSerialization.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Runtime.Extensions.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Threading.Overlapped.dll.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\InboxApps\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\netjme.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\wvmgid.PNF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_mdmnttte.inf_31bf3856ad364e35_10.0.22000.1_none_abf88496ef9456fd\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-eventlog.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_f1bc9a784933b4df\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Logs\WindowsUpdate\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Panther\UnattendGC\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_hyperv-isolatedvm-svc-extension_31bf3856ad364e35_10.0.22000.1_none_9bab453eb3e4132b\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\move_rl.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\microsoft_bluetooth_a2dp.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_adp80xx.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_7fa401f86f93c437\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_swdevice.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_fb7568303a1c959d\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dc1-controller.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_5532cd0db58206e3\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_bthlcpen.inf_31bf3856ad364e35_10.0.22000.1_none_4c364ebd9b3e54d6\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_nvmedisk.inf_31bf3856ad364e35_10.0.22000.1_none_a8f115f5e438cbc9\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\en-US\DmaGuard.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Cursors\aero_pen.cur.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\msports.PNF.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Media\Speech Sleep.wav.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_amdgpio2.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_a735142ae2de1a07\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\DeviceGuard.admx.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\en-US\RPC.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\es-ES\DFS.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_intelpep.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_b68794deb4823c7f\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\de-DE\AVSValidationGP.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_scmdisk.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_7a4d216b647e1d1c\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\es-ES\WinInit.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\FileRecovery.admx.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\fr-FR\Radar.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\phone.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\mdmcm28.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_iagpio.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_e2a4d1c65833b0cc\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_ialpss2i_i2c_glk.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_cb1d6cc009bc06ef\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_lsi_sas3i.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_78cae59222fb7fed\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.22000.120_none_9268b7169b04c4a6\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Media\Focus1_48000Hz.raw.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_bth-cpl.resources_31bf3856ad364e35_10.0.22000.1_it-it_a0d10e5c813b5ff3\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_extension.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_170b40dac6505847\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_fsencryption.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_5599f1c30f152428\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_scmbus.inf_31bf3856ad364e35_10.0.22000.258_none_4e61e04ed94c3f63\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\en-US\CredUI.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\pnpxinternetgatewaydevices.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-200.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\netwew01.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\AutoPlay.admx.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_cpu.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_4d6173f84a2b2422\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_wpdmtphw.inf_31bf3856ad364e35_10.0.22000.1_none_42eb726b50c3c305\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_hidspi_km.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_96a615bbe699358d\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\UpdateRestore.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-125.png.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\hidir.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\mdmagm64.inf.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\INF\WmiApRpl\WmiApRpl.ini.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_adp80xx.inf.resources_31bf3856ad364e35_10.0.22000.1_de-de_d6e7cf1b808ec6cd\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_biometric.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_a5df9da304bb2655\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\Media\Windows Restore.wav.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\de-DE\DataCollection.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_c_swcomponent.inf.resources_31bf3856ad364e35_10.0.22000.1_es-es_8bdc9ef161530df9\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_digitalmediadevice.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_86d1af71937e826a\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\WinSxS\amd64_dual_fusionv2.inf_31bf3856ad364e35_10.0.22000.1_none_1384419ff7f245a0\README.txt e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe File created C:\Windows\PolicyDefinitions\es-ES\EventViewer.adml.smert e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 652 wrote to memory of 4956 652 e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe"C:\Users\Admin\AppData\Local\Temp\e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe" --foodsum2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4956
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\System\wab32.dll.smert
- Size 740KB
- SHA256 68d7ac7aa4f0013c24d1a4136ddf25d96914d4287b147b5ee22b5d0bd9f52a77
- MD5 78b5c4f4f756dca5a03fb3c74735b74e
- SHA1 9d5a0037ea5e94490c8b716ac48c82dec7cf1631
- SHA512 c4dae701a8f0962687e252c00c303ea45bbda54118623a9daffd793ccc56e4dbc6ae844fc0aa2a4e12c96e01516f0e594f43d2c0dc6a73169a8b0a2d5e90630e
- SSDEEP 12288:xffihrN0GwYu021CXndEB6yYa+ACz96NP1stS9TlqN5OsXxkhKD/oj:xy30lYP21CXdEBZYa+Zgd1stStlqV+h7
- TLSH T14BF433E24CC7ADCC39A8D9F30D04625A7B2C85DA5AD87E7670A12B0B2345B9DF350C79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Lang\bn.txt.smert
- Size 14KB
- SHA256 f9312c30195ba7c3c6b139a65872f4f872182f4dd1d5dfb284ac5b530da048ae
- MD5 9e497ce2574cb0e43a01e400635f395c
- SHA1 905ae4e40818709de9101106de8937cc3bb33e1a
- SHA512 e035674aff235c8ff9a3a12da4227c797824fe7a570d127065a92288f89daa1513dceace04c213ef1dfdb4336e9da503d0697990cc1158bd3cc0fc17b2e2cc1c
- SSDEEP 384:YTyj/gAJsm2TuhjA29EWIZ0DfDXcCHk+ntPTF9CFwLTpyf/:Ljn2129EWJD/HBZE9f/
- TLSH T16362D009C0F9DA72A6346AD23DE3AD739DEC7F7741659FC83C9582A014A93A002CC7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.smert
- Size 42KB
- SHA256 45901163535608f6eef090a18aa69d86216da87063f9f754d740406cdefdb855
- MD5 37cc8b2b3241d8e3ae7b8e3699534ce6
- SHA1 cdf40a1b6c0aaf2cb0b00355d52006cc1f0dae84
- SHA512 908e7268eee35f54cbce4468f3ad4efca6d4f9c10e37dbf8c3b6de258bd87ce60d7a0607b916c24a33e379163095b9d67472193113992ce29a20faec7d4cdf13
- SSDEEP 768:z27soTuJQrFI7LEgCP855UEsGePaD7wWTXTT79WGwBQ9AiPk/TDqQUQOKmzuy9:zAsOBr2SP855PkPaHwM9WGwB/Ok6QgKe
- TLSH T15F1302ACB4F8E1511FC569E634DC066173062D1A2654F4713D2578A08EAE0B3B5A3F9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.smert
- Size 26KB
- SHA256 1f3606cccf7f1aa0647caec9557cf79ca8fef20be4d5a5fd7cdcbb45f7e59dfa
- MD5 46948ef099fc4c22a279ac6d77a05bdf
- SHA1 2c12f5ed578d22189c5d3026b9624a8ccd41c4d4
- SHA512 afb033b64b28951716ee400c5c3eb7f9815ba83a853b6c1cdd29539db8bd778f006d4095e7429d59d2f26b2691ec77f5c8fa9870230eb5cf11f8deb49cbd45fc
- SSDEEP 384:Hssv7NwiyoXk8jY/XA2T0+MiyAM9uxW2lKKTJHs8cjRy3izhjDIx/FQ0liq2i4qy:9vA//XAlIiz8sy3izhnIx/FQRqtvsfg4
- TLSH T14DC2E177697130021399F3DD71BE43646C22320C586B6B37A7D93A7172943970AB4CE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\README.txt
- Size 138B
- SHA256 68e60b1d18e7e8232c36ba3b139a253892084cc26482909ed31d366421a2c8b8
- MD5 05c0af037e62668b1d124a1ab7596949
- SHA1 2d5aa1fb2aac92a65acf84aae2cfc9dc57934cc0
- SHA512 0f6668472297765c729e373370662d1b0587ba22ff18883f63d9efe2a5594e98c68a66f5676b32ab31cb86dffd1fb7b7e9f857ab27c05bf66cb1dbd94621e275
- TLSH T136C02B0BD53D341A10100B2433017EE0F91B4600459039200CECD8B073901E56AC3453
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Provisioning\Packages\Power.EnergyEstimationEngine.Storage.ppkg.smert
- Size 6KB
- SHA256 57846f255e0504a0f806af0e1367381578b989295308d3a37e8ac959c60e5bf5
- MD5 ccf9a77ca7225d90839086455a6924fd
- SHA1 39e9efea4b90dd20da5e0aac430f03cb604437d2
- SHA512 00929ebe725c5f66e2a78a99083fc107917c242409f6b6a82322fa1ffea8f8d0ca07ac3cce4131a086db5292fa2abb0c5e762fd1040ce5fb0bfe0535977be4da
- SSDEEP 192:JdUX28YgOpG+TTZU7a7e5IRpq3PcdsSEgi9:Jd58Yl9Tub5IR83osSxQ
- TLSH T197D1AF3EECF8513A241DF187DD5C21C25B655BCFD6813F4A1DF87EA18590B852263983
- MD5 SHA1 SHA512 SSDEEP TLSH