83e2794f0be3a730943e5efc310e633eb51664bff3e67c5417c31b8d879c961d

Analysis

user interaction
yes
max time kernel
415s
max time network
438s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
FluidSim4.5.zip
Size 459.3MB
Sample260508-l5bmdafw7v
SHA256 83e2794f0be3a730943e5efc310e633eb51664bff3e67c5417c31b8d879c961d
MD5 502a66a55b70445c3757f936fa54ece9
SHA1 a163e1709797e332aee275e448784352ac6775b6
SHA512 2b646ec850469f10f15beaa1a3863c926d90a6b1b896cccd5ee03e32be13a7d417e2095e6a8d2a8698e672478d80e0b75e81fdb474e211cd7f80cc9fe2dec0d1
SSDEEP 12582912:oPlu2OAlUqRkvSBQd7chb6VE692z38/B2M5F2hWiwM:KluvMCvS2SOE692zs/pCvwM
TLSH
T120393335F52B7BA1B2240DB3A9C67C8619C530C6AE97DF35E3CE4345AA13C932871396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SYSTEM32\DRIVERS\WibuKey64.sys	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\DRIVERS\Wibukey2_64.sys	Setup64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
3376	Setup64.exe
2856	opcddemg.exe
4656	opcddemg.exe
4120	fl_sim_p.exe
1968	fl_sim_p.exe

Loads dropped DLL 64 IoCs

pid	Process
1848	regsvr32.exe
2052	regsvr32.exe
1656	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
2420	regsvr32.exe
1256	regsvr32.exe
3116	Process not Found
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3556	regsvr32.exe
3088	MsiExec.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File created	C:\WINDOWS\SYSWOW64\WkWin32.dll	Setup64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\wibukeyUSB64.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD437.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wibukeyusb.inf_amd64_5fba4c38c57aa9da\wibukeyUSB.inf	DrvInst.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lhu	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lbr	Setup64.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lde	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.lfr	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.lhu	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.ljp	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.les	Setup64.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wibukeyusb.inf_amd64_5fba4c38c57aa9da\wibukeyUSB64.cat	DrvInst.exe
File created	C:\WINDOWS\SYSWOW64\wibuKJni.dll	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkExt32.dll	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WibuXpm4J32.dll	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lit	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\WibuXpm4J64.dll	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.dll	Setup64.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	Setup64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD426.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\wibukey2_64.sys	DrvInst.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.lit	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.ljp	Setup64.exe
File created	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD426.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wibukeyusb.inf_amd64_5fba4c38c57aa9da\wibukey2_64.sys	DrvInst.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.lcn	Setup64.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\WINDOWS\SYSTEM32\WkExt64.dll	Setup64.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\Flash8.ocx	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}	DrvInst.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.lde	Setup64.exe
File created	C:\WINDOWS\SYSTEM32\wibuKJni64.dll	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lfr	Setup64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD425.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD425.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\SETD437.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0882d067-9ce2-d04e-b416-0dd79a80c8c7}\wibukeyUSB.inf	DrvInst.exe
File created	C:\WINDOWS\SYSTEM32\WkWin64.les	Setup64.exe
File created	C:\WINDOWS\SYSWOW64\WkWin32.lcn	Setup64.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e076a.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11ee08a.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP111\TP111_04.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_1_1_3.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p3_1_4_15.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p3_1_4_19.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\grafcet\sub.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e085.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_1_1_2_8.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_1_1_9.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\psup10.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\valve\fuvalve\pvalve\pn1.ct	msiexec.exe
File created	C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.lcn	Setup64.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11ee02a.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\Grafcet\TP201_09gc3.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP111\TP111_06.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_1_4_8.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_2_6_7.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p3_1_4_10.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p3_1_6_1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e061.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e075.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\Grafcet\Grafcet02.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101_TB\B_4_11.CT	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\actuator\lsol.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\relay\re4.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\sensor\mea1b.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\valve\pcvalve\ppc.ct	msiexec.exe
File opened for modification	C:\PROGRAM FILES (X86)\WIBUKEY\HELP\WKUSEDE.CHM	Setup64.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101_TB\B_4_02.CT	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101_TB\C_06.CT	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\ladder\l12.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e024.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP102\TP102_05.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP111\pos.txt	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_1_4.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\psup7.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101_2009\TP101_19.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_1_6_10.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\Pos.txt	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\psup5.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11e017w.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP201L\TP201_04l.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_2_4_1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101\TP101_04.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\valve\sfcvalve\sf7.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\chap5.swf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\pos.txt	fl_sim_p.exe
File created	C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvMgr_es.qm	Setup64.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_1_1_1_1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_1_4_11_4.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_2_6_1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_2_1_6.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\dde\fs_out_a.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\bmp16c\11ee03c.bmp	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\ct\TP101_TB\A_5_14.CT	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p1_2_4.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_1_11_5.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p2_2_2_1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\dida\p3_1_4_5.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\sensor\si1.ct	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\valve\fuvalve\evalve\pos.txt	msiexec.exe
File created	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\valve\fuvalve\evalve\el6.ct	msiexec.exe
File opened for modification	C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\pos.txt	fl_sim_p.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5c91f7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF611A2BEE20EB3000.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{68ED7241-4508-4F48-BB55-0EA004FEB0B9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C1A.tmp	msiexec.exe
File created	C:\Windows\opcddemg.exe	msiexec.exe
File created	C:\Windows\Installer\{68ED7241-4508-4F48-BB55-0EA004FEB0B9}\Application.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{68ED7241-4508-4F48-BB55-0EA004FEB0B9}\Application.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	Setup64.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB7E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB820.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC08F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B58FF6F849CD23C.TMP	msiexec.exe
File created	C:\Windows\inf\wibukeyPCMCIA.inf	Setup64.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92E2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Fonts\timesmd.ttf	msiexec.exe
File created	C:\Windows\Installer\e5c91f9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB850.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD9DD3A3723E749A.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e5c91f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9293.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83FF2DB931A0DC3C.TMP	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fl_sim_p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fl_sim_p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fl_sim_p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opcddemg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fl_sim_h.exe

Checks SCSI registry key(s) 3 TTPs 43 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	Setup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	Setup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	Setup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	Setup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010004-0000-1011-8002-0000C06B5161}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010005-0000-1011-8002-0000C06B5161}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.AddedEntry.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010006-0000-1011-8002-0000C06B5161}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00010005-0000-1010-8002-0000C06B5161}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WibuSystems.BinFile\DefaultIcon\ = "\"C:\\Program Files\\WIBU-SYSTEMS\\System\\WibuShellExt64.dll\",2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash8.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010002-0000-1011-8002-0000C06B5161}\InprocServer32\ = "C:\\Program Files (x86)\\WIBUKEY\\Bin\\Wibukey.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Encryption.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Version\ = "Version Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtc	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00010000-0000-1012-8002-0000C06B5161}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WIBUKEY\\Bin\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010001-0000-1011-8002-0000C06B5161}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010003-0000-1011-8002-0000C06B5161}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtc\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtm\ShellEx\{00021500-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WkSvCtrl.Server\ = "Server Class"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1427DE86805484F4BB55E00A40EF0B9B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\CLSID\ = "{D27CDB70-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtm\ = "WibuSystems.CtrlFile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\5\3\0\0\1\NodeSlot = "25"	fl_sim_p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010003-0000-1011-8002-0000C06B5161}\VersionIndependentProgID\ = "Wibukey.AddedEntry"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010009-0000-1011-8002-0000C06B5161}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010004-0000-1011-8002-0000C06B5161}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FluidSIM.Document\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\TypeLib\ = "{57A0E746-3863-4D20-A811-950C84F1DB9B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00010000-0000-1012-8002-0000C06B5161}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010000-0000-1010-8002-0000C06B5161}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010000-0000-1011-8002-0000C06B5161}\ = "Wibukey Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WkSvCtrl.Server.1\ = "Server Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.RmtPgmObject\CLSID\ = "{00010009-0000-1011-8002-0000C06B5161}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010002-0000-1011-8002-0000C06B5161}\InprocServer32\ = "C:\\Program Files (x86)\\WIBUKEY\\Bin\\Wibukey64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Wibukey\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010009-0000-1010-8002-0000C06B5161}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010005-0000-1011-8002-0000C06B5161}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010004-0000-1011-8002-0000C06B5161}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Subsystem\ = "Subsystem Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010006-0000-1011-8002-0000C06B5161}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WibuSystems.BinFile\shellex\PropertySheetHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010001-0000-1010-8002-0000C06B5161}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010009-0000-1011-8002-0000C06B5161}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\FluidSIM.Document	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.WibuBox\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010006-0000-1011-8002-0000C06B5161}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Subsystem.1\ = "Subsystem Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010006-0000-1010-8002-0000C06B5161}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WibuSystems.BinFile\shellex\PropertySheetHandlers\WibuSystems.Page\ = "{00020000-0000-1011-8004-0000C06B5161}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WibuSystems.BinFile\Shell\Open	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010000-0000-1011-8002-0000C06B5161}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010001-0000-1010-8002-0000C06B5161}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010002-0000-1010-8002-0000C06B5161}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00010006-0000-1010-8002-0000C06B5161}\TypeLib\ = "{00010000-0000-1012-8002-0000C06B5161}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashProp.FlashProp.1\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\5\3\0	fl_sim_p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010000-0000-1011-8002-0000C06B5161}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wibukey.Encryption	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010000-0000-1011-8002-0000C06B5161}\TypeLib\ = "{00010000-0000-1012-8002-0000C06B5161}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00010004-0000-1011-8002-0000C06B5161}\ = "WibuBox Class"	regsvr32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4100	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	msiexec.exe
4528	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	fl_sim_p.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAuditPrivilege	4472	svchost.exe
Token: SeSecurityPrivilege	4472	svchost.exe
Token: SeShutdownPrivilege	4640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4640	msiexec.exe
Token: SeSecurityPrivilege	4528	msiexec.exe
Token: SeCreateTokenPrivilege	4640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4640	msiexec.exe
Token: SeLockMemoryPrivilege	4640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4640	msiexec.exe
Token: SeMachineAccountPrivilege	4640	msiexec.exe
Token: SeTcbPrivilege	4640	msiexec.exe
Token: SeSecurityPrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeLoadDriverPrivilege	4640	msiexec.exe
Token: SeSystemProfilePrivilege	4640	msiexec.exe
Token: SeSystemtimePrivilege	4640	msiexec.exe
Token: SeProfSingleProcessPrivilege	4640	msiexec.exe
Token: SeIncBasePriorityPrivilege	4640	msiexec.exe
Token: SeCreatePagefilePrivilege	4640	msiexec.exe
Token: SeCreatePermanentPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeShutdownPrivilege	4640	msiexec.exe
Token: SeDebugPrivilege	4640	msiexec.exe
Token: SeAuditPrivilege	4640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4640	msiexec.exe
Token: SeChangeNotifyPrivilege	4640	msiexec.exe
Token: SeRemoteShutdownPrivilege	4640	msiexec.exe
Token: SeUndockPrivilege	4640	msiexec.exe
Token: SeSyncAgentPrivilege	4640	msiexec.exe
Token: SeEnableDelegationPrivilege	4640	msiexec.exe
Token: SeManageVolumePrivilege	4640	msiexec.exe
Token: SeImpersonatePrivilege	4640	msiexec.exe
Token: SeCreateGlobalPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	2924	vssvc.exe
Token: SeRestorePrivilege	2924	vssvc.exe
Token: SeAuditPrivilege	2924	vssvc.exe
Token: SeBackupPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4640	msiexec.exe
4640	msiexec.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3944	setup.exe
3944	setup.exe
1664	setup.exe
1664	setup.exe
2504	setup.exe
2504	setup.exe
4932	setup.exe
4932	setup.exe
3376	Setup64.exe
4048	Run.exe
4120	fl_sim_p.exe
4120	fl_sim_p.exe
1656	setup.exe
1656	setup.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
1968	fl_sim_p.exe
3788	LogonUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4304	4932	setup.exe	98
PID 4304 wrote to memory of 3376	4304	cmd.exe	100
PID 4472 wrote to memory of 3812	4472	svchost.exe	104
PID 3376 wrote to memory of 2888	3376	Setup64.exe	106
PID 2888 wrote to memory of 1848	2888	regsvr32.exe	107
PID 3376 wrote to memory of 2052	3376	Setup64.exe	108
PID 3376 wrote to memory of 1656	3376	Setup64.exe	109
PID 3376 wrote to memory of 2420	3376	Setup64.exe	110
PID 3376 wrote to memory of 3956	3376	Setup64.exe	112
PID 3956 wrote to memory of 1256	3956	regsvr32.exe	113
PID 4932 wrote to memory of 4640	4932	setup.exe	114
PID 4528 wrote to memory of 4540	4528	msiexec.exe	123
PID 4528 wrote to memory of 3088	4528	msiexec.exe	125
PID 4528 wrote to memory of 2144	4528	msiexec.exe	126
PID 3088 wrote to memory of 2856	3088	MsiExec.exe	127
PID 2144 wrote to memory of 3556	2144	regsvr32.exe	129
PID 3088 wrote to memory of 4780	3088	MsiExec.exe	130
PID 4780 wrote to memory of 4484	4780	cmd.exe	132
PID 4484 wrote to memory of 5008	4484	net.exe	133
PID 4640 wrote to memory of 4120	4640	msiexec.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FluidSim4.5.zip
1⤵
PID:2392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4844

C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Hidraulica Crack\fl_sim_h.exe
"C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Hidraulica Crack\fl_sim_h.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:420

C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Hidraulica Crack\fl_sim_h.exe
"C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Hidraulica Crack\fl_sim_h.exe"
1⤵
PID:2336

C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Neumatica Crack\fl_sim_p.exe
"C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Neumatica Crack\fl_sim_p.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3736

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Neumatica Crack\Instrucciones.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4100

C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WIBUKEY\Setup64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\WIBUKEY\Setup64.exe
    C:\Users\Admin\AppData\Local\Temp\WIBUKEY\Setup64.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\WIBUKEY\Bin\Wibukey.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files (x86)\WIBUKEY\Bin\Wibukey.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1848
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\WIBUKEY\Bin\Wibukey64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2052
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1656
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\WIBUKEY\Bin\WibuKe64.cpl"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2420
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\WIBUKEY\Server\WkSvCtrl.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files (x86)\WIBUKEY\Server\WkSvCtrl.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1256
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i "C:\Users\Admin\Documents\FluidSim4.5\flsim\Support\MSI\fl_sim_p4_en.msi" LANGUAGE="ENUS" SETUPDIR="C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe" REINSTALLMODE=amus NOPRESENTATIONS=1
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\Didactic\fl_sim_p4.en\bin\fl_sim_p.exe
    "C:\Program Files (x86)\Didactic\fl_sim_p4.en\bin\fl_sim_p.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{22c7c221-bb1c-8f41-a259-8bce4c7594b2}\wibukeyUSB.inf" "9" "44eec5bdf" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3812

C:\Users\Admin\Documents\FluidSim4.5\flsim\System\Run.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\System\Run.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E3DA9A82877B39BFA932F41D9AA7FC79
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\opcddemg.exe
    "opcddemg" -install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net.exe start "opcddemg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\net.exe
      net.exe start "opcddemg"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "opcddemg"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
- C:\Windows\system32\regsvr32.exe
  "regsvr32.exe" /s "C:\Windows\SysWOW64\Macromed\Flash\Flash8.ocx"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWOW64\Macromed\Flash\Flash8.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\opcddemg.exe
C:\Windows\opcddemg.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe
"C:\Users\Admin\Documents\FluidSim4.5\flsim\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Neumatica Crack\fl_sim_p.exe
"C:\Users\Admin\Documents\FluidSim4.5\FluidSIM 4.5 crack\Neumatica Crack\fl_sim_p.exe"
1⤵
PID:4116

C:\Program Files (x86)\Didactic\fl_sim_p4.en\bin\fl_sim_p.exe
"C:\Program Files (x86)\Didactic\fl_sim_p4.en\bin\fl_sim_p.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ca055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5c91f8.rbs

Path C:\Config.Msi\e5c91f8.rbs
Size 109KB
SHA256 9598360c6fe9eda670d07efd8c9466323037caaa6dc0e63d0a443aaca2fc9dba
MD5 3595a8865f654cce7594e64891d91038
SHA1 5d3e46124374ab9f53c57847b3f10a9d14eddb87
SHA512 26a8ca19da8e2869c9809b70aed9ffe876461ce31b1a465cac493241291fb62fe8a84763788c8aafc4f093360a6afcbbdab32c2713c6b18a92a16fd5dec55e6d
SSDEEP 384:BF98qhn/UGjD0X819Dl3LfAe9SPmjqOLifA3FhvpOagd3xjwMOe4cTKDo+RwWRws:BFrhndXGwRfqwQ4cTKDo+6W6eDyu
TLSH
T171B371888B39E2E3E52295E9BFF9199D06406D06B7E88533218CB76786C4F7713F8057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.chm

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\bin\license.chm
Size 71KB
SHA256 980eebdcc6868b7c87689fc9d0d56712c65d3f768e699d9620326dc015d99d4f
MD5 1d51bedc777d8d733d1b630c6092dde0
SHA1 6720d463210fafde65a602d1b97666e95c6c66ce
SHA512 4eb089cfe0416de10e950808d16f6ac5816c1a57bf3db818d0680084df1e87feda542a4e6cfbf0cb30f1b1b347c34118d5c14bb8c10feb216e48da9ad96a5361
SSDEEP 1536:S3hr+MJ52kUFTUp3Fql/CbgAMgpwRufK4FA6RqwQBYeKu0Uve:ahr+Myja3nUWp3P1qwQiFuhG
TLSH
T11673F2A41F77A311EC0179B85CA35C9949A68D030949FDB64D8E39F8536E24F8F34D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\actuator\pos.txt
Size 74B
SHA256 e5a5637df1cfa8b8f692aa4a631a3efc1efc2023c776df9b4f5cbc14c53a66a6
MD5 14d569e44ae152beadbf6461314067fe
SHA1 2e52a3fcab158a6e1e5f8a85975d53e8f133bfd8
SHA512 5d5dd77870a99cf4e4e0df940179e18f0f53d2cba7cdf3f0097d18cf3bed339c485b35c0a960e92ea5e3496af6c9e8258ab4f0315267fe20448b8136384a1b28
TLSH
T1E1A024D3C05DC035D4154500015F3017350F30F07C7410100144431CF4CD10D5701CF4
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\electr\pos.txt
Size 133B
SHA256 8b4779b9b11e06592c89462bd68731446576c1f79fcf1a66a1b9d2ac46ae00e2
MD5 71e7afa9146a770ba989188bb9341927
SHA1 4e8b563c2f8cd6b01c5bca2f7f86b80883b52392
SHA512 c4c84cb956bc774f344db41773e91fef0d9095462619a7db3b424a9296a39735d40b77851e6bac763c32474e3fd75a51c0ea89e9460ddecd5c3e6fcf79faee37
TLSH
T1D4C02BC608AED00CA0300D0C110B20173C0FB0B8603E42D90136862090CE5C4DA0B4C1
MD5 SHA1 SHA512 TLSH

Submit Download

Pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\misc\Pos.txt
Size 192B
SHA256 0986025660b9d94be0191c20aeef1769ce41982d957c5b7c90453a172f5cac14
MD5 a735c2ef348b8e41334948e64c3a06b1
SHA1 c3c9b904b217dc52d1b648cb5c41d95977dede73
SHA512 ce3d16f9747d50c76f4777397d30df662c4e3916f7a718e148f2a7aaa5fa20652ed5f680f490cdcfd88481d9975477e8788e22a172662299723a5a44a2f85464
TLSH
T15BC012A40C4E112AF0350661241D3709005FF2F2A88E528E8EB9D50C504DB05C3D2DB1
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\pos.txt
Size 109B
SHA256 ef8f284c5370bc9ee170bf5cb7f529cb20aac49683ac467ee91567691fa58f29
MD5 071d9b674c4c52bb922988bc79a70138
SHA1 ec65ee199dee0b080e1a474fabd99a275519209e
SHA512 8063a73a0eb9c83c812d06ebfbf844af13b0f65d76747a691564eb7cf3c1593ee2b2fbb7b0cbb2a7594b69ac3ebebdf7c266bf88ea5d2cc795340958aa2d390d
TLSH
T1CAB012C4284ED90DACB86E1A5417392A3CCFB07179B9659E5D95C340B1CFE51F3298C1
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\pos.txt
Size 109B
SHA256 47b5c713082e1beef041c94c1e75705802ddbfcf17b2fc3cd9c1847a3d7ca046
MD5 d26818bf3aa06d850549d23694291fa5
SHA1 da1ebe2800a45e4de25f7de5febd98826759f83e
SHA512 3ae1bdb474aed661c4cead5ce4da5faaf67f36680af9048e524ea47ab64856cf4fb76510d618407df21f6e10bba804e67cb79b0db4d8e0ff0ce0f8c80f0c5b03
TLSH
T170B012C4244EC90DACB56E1A5417352A3C8FB07169BD619E5D99C350B1CFF51F3298D1
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\sensor\pos.txt
Size 193B
SHA256 a8bab6720910eb93ff560ed75515b9036ee864093b9db1ca847aadd2e94b4d39
MD5 5cac8f64cbf92dee6a00bbd05c5f758a
SHA1 dedaa16a61a7d4c301b3e670bb09478ef95c2ef8
SHA512 8bdabcc162fd8119ca36b155a37ee2bb5f06ca647009f10afc18827916b1d67a4d79d9a9e42dacc99a817626bc98973aa592ca206b75fcea752873a512963a61
TLSH
T164C012C0A95D5AACBD330654309D3240301EB2FB25DFA746853E9A5CB080902D342CF1
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\sensor\pos.txt
Size 193B
SHA256 61ad19a98a7238f2e70bab5d64508832d25de3dddcaab15947b4077776e4b866
MD5 327a7c79b743112f6b3514b365dfdfa7
SHA1 cda7945d52539eef77b593a75feb1b1050eabfff
SHA512 26a2b5fa7110b453fc88c6039476be7171820d64cc28a68b439045db95b1e96fd62643c92d30708c9dca0e43d9497f3213548f3618f29a4eeffee459a9567878
TLSH
T104C012C0A95D5AACBD330654309D3240205EB2FB25DFA746853E9A5CB080802D342CF1
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\pos.txt
Size 260B
SHA256 f5228fa43a51a5a30d46cc2324d7e084faceebdc1bf313b3fdfc9a49ab957b50
MD5 e7eb6318878a6f9feeaa0818a03d3aa4
SHA1 103fa64d2bede42b4207ad2c6bb88943e0b4466f
SHA512 514e6913f571a86cbaf3745c506a40a42f016b11765a7eacf00c5fea776ea8f3b6d8637d2199bf78418ed8d5ed18af8a315f30a2b782ba44b54614c092dfcd99
TLSH
T19DD017B0898CF849F03C0558221E3538204BBEFAE95BE7094426C13C10A82CDD704CF0
MD5 SHA1 SHA512 TLSH

Submit Download

pos.txt

Path C:\Program Files (x86)\Didactic\fl_sim_p4.en\sym\pneu\supply\pos.txt
Size 260B
SHA256 85ded67393b793726698522f7baf72e5b2b1182a31af9d991b7628eb24e10061
MD5 ef82640f82ac049590bd0cccafe96fcb
SHA1 5202d9bfa81e750216120078a560d92e772b85fb
SHA512 d9714cde231feabb247fa61f213aa9f39a69c930ffc6bd1c608b356c2211985718a93c71b63a80fcb85b2bb444f2aadd4750a89740132bee4a8999b5668485d8
TLSH
T113D017B0898CF84DF0390558221E3138200BAEFAE95FE709402AC13C10A92CDD704CF0
MD5 SHA1 SHA512 TLSH

Submit Download

SETUP64.LBR

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LBR
Size 61KB
SHA256 7e707b18d34eeb93c49ec16b4ee31e603d80bde401368b71b5e88885545485bc
MD5 a5119585edc16b01d2718d31dc32f5c1
SHA1 0cc2cc40da567f42c458de691401c31638d34050
SHA512 1a34ab2ea116c3429b226c646376ee9111b20c64e131f125fe91e114ee66aa0ce77c0aabc8aa58736120fa03448f91745ff44c3f72f7e25413eb6e15e68e19ad
SSDEEP 768:DU2p9ihgMxqL3OktJLObumvfJgMxPXg1FKHt:DU2murilvfTw
TLSH
T153534F5157FC0A25FAF3AF356ABA56A21D37BD91AC3AC10D221CB15D1DB4B80CA34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LCN

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LCN
Size 49KB
SHA256 9586e50c5168b28338ee99669d2cbae72c3cabc5177962fa683dd5c5891bf958
MD5 905b9e7187dc4c587239accad2749d27
SHA1 811e97c6ef59a3629d7ef4c6967b659595762d78
SHA512 c2abcbb72d7ccd8fb940f555f3ceed790e02b2bd7957e9842f16e056913fd56d5c730112673cbf06d3f6098738a250a2c60a1888a0cbfc62c35e1b94b774897e
SSDEEP 768:qclM8aB5yF9ihgMxqL3OktJLObumvfJgMxCpPLV5j8t:q+M8aB5y6urilvfOhB5
TLSH
T1EC33F82507C80E66E7A29B741AF785E23732F5909D734A1E319CF32C2B4CB68D720769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LDE

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LDE
Size 72KB
SHA256 021f144ce492c5c926d3a6075a9a0eaff93e4fe55ce762a410db47f0fbd6b45f
MD5 63c4185f47b4b494425753d9567d2032
SHA1 68f1075a1d9603580e0251374fa82e2ccafbbafc
SHA512 76620986bec54564423e4800bc20248ee97100cf128dbe48c57e250d6260c5f658eff0c2a66b2553e18fc8e0a85d5dfaa59518be0ad697e3ec233f8a369ddc1b
SSDEEP 1536:vHRpsRZwkjrtb0YcSW8hTYurilvfHaSn3XcoqE:ZpsRukjrtb0YcSW8hT6aA3XrqE
TLSH
T13F73411253E84A28F6F36B346EB682D02F72FDD1AD36D60E235CB18C5975B40DA21736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LES

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LES
Size 60KB
SHA256 ae427c4f7312bf2f43b48e2341e39ae70c9b8e3c2afcc8f5afab1fc86fff12ab
MD5 98843f1a88e82dcef563218c5151547f
SHA1 7da14907b17aea33eb542dcecaf94c834a8cbf3a
SHA512 56d161add585308c6e46dd3d7d726cda0a07c486be854d80f6031cca10ddefaa82b8d5fdc5c90dc90881ee500b72ecec9f0c74747a766526e44a93641b1dbb44
SSDEEP 768:vYicfaB9ihgMxqL3OktJLObumvfJgMxEOb+A5R8vxcpYiFt:vYNSOurilvfAyV5R8vxcpYi
TLSH
T1C3532E101BF91A26FAF3AF346AB646D11E36BD91AC3A810D225CB15D1DB4F44DE70B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LFR

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LFR
Size 62KB
SHA256 02512c11e32ec52419add05842695f5c0e301c1672ae9b23ae67dd68042d0f2a
MD5 72bb755766d7f8389cdd3c3aa5831204
SHA1 6ed08e7ffb13154babdf80d3692a937ac3ade3f7
SHA512 e888a01da6d8a4d9fc2fb3418a1d0554519c3b452245392931e3a9eb8a6df17c6b615990e624c32b1c0afef7d2f8f808175ec15291963d1aecc4135caef60d09
SSDEEP 768:+/oS2F9ihgMxqL3OktJLObumvfJgMx9Kxl8Wmtt:+/NTurilvfxg
TLSH
T148532C2163E80A21FBF3BF34A9BA41911E3BBC829D36C11D225CB54C2DB5F54CA74726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LHU

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LHU
Size 58KB
SHA256 9af5117a408b491ced4f0c6565de2f07832b90e4c2ec1f32bc2c88ff4d5ac3db
MD5 7ca0b8e26370f232ebab190149df7b67
SHA1 1b689b4ddb7a2c4f82a763ba1461729b6ba5272b
SHA512 4ad5def0507cc57a035f6b167b4b394080fefbabab21017aca3d679f7ef4ec9356d493fbde5c2ceaaa71769356fabcc16f2b6e08e5155be89f31393083cdd450
SSDEEP 1536:xuFpKt4urilvfF8zbjiWmNOmmVmWIIV/i/rhA:YKtU8zbjiWmNOmmVmWIIV/i/rhA
TLSH
T1C443421117EC0D66F9F39F313EB692D11A35FDA0AD3BC20E624CF24C1E69644CA64B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LIT

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LIT
Size 61KB
SHA256 f508f241efbd05d41cfc369459f3991c03dad5029d1e365f29a809aedec2fa04
MD5 341e8195e3522f6015010b467afc9d11
SHA1 2764702787de295e1a4f25cc58f88555249bac1f
SHA512 c839052d8aa22ebce313aab2ea62853df4ae09958d26ca423dba5d5768457ea751fb6d1473c6c2a1581525dadcb5357d55e39f643746374b494936a8b495b9ee
SSDEEP 768:vRdY9ihgMxqL3OktJLObumvfJgMxZk3jEEdqSeN1fLGt:vRdJurilvfqzHif
TLSH
T1CE532C2157F80A24F6F3BF347E7A86D11E36BD91AC3AC11D225DA14C19B5A64CAB0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.LJP

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\SETUP64.LJP
Size 55KB
SHA256 87f59a938baca750ba0166c4aac6136b203494ba9dbc9cbd39219c6df7158acb
MD5 67cedc4d2486022987d5cb04fdefe650
SHA1 d21c7afa59dafed19ada7c3771e5fd69a91463cf
SHA512 9499bf70806799586265d0c2c8625be072aaf34c86eebfb029bf68ceb3698a9e869e810aac91ee4615667e6427c3fd8dca531b97532b85e12e384f13e24c63d9
SSDEEP 768:k/ha59ihgMxqL3OktJLObumvfJgMxEgYK7/DVsCUshayZwdG7Nft:ksWurilvfwHK7Nhay5N
TLSH
T18243C52776E84DE2E2F286302AE382D12735B6545DB7452A328CF24D5ECD750AF2171F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKUSEDE.CHM

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\WKUSEDE.CHM
Size 877KB
SHA256 5e1ab8d61bb8205c82c580be0d71e8a65e6cec179ff4fe1fc8234db95a43cbb7
MD5 1907792f05aed919591f0b2f16dbf92f
SHA1 86a2bbefbdd52fd3e925a3e2e2c80006e3e89483
SHA512 4293c3a354bd0c8087c1c374529e8c9bbcdbcffe2403e2d94cbdd8ab1bc5fbb8ec84f1ebe9fd298bd62c87acebd73eca97856db22416278a7ea4c9767cae1cd7
SSDEEP 24576:cw6Rc+wBzQOkblzufPqMEgymrHEfICN71TxALHQ:ucvzOlzmSME+rsTxADQ
TLSH
T1A8153326A7002678C4279CF0746992D3D3E32DC11779A3CF7FFE6E88848838B5A69755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKUSEFR.CHM

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\WKUSEFR.CHM
Size 788KB
SHA256 c01d36e1d3a8d33c3e7762bcd9e92b7519ade1e4cb2ee14197fcb0faf499150b
MD5 ea2485f2860f1cacd1ac48cc9a04feff
SHA1 d045606305e9edc5ea704f99659360243ab86c73
SHA512 8aaa5d3c5f9ae0db1f132d7375cb58a3406e0f30432406828c6f6939d6fec201128cce7e6a4fb5030b73828719d35e1bbc62768cc32b9f1c33967711179b4943
SSDEEP 24576:XXx4kyxhlgUpZnSQi5cppTwaMPHSuHWfYSV:Hx4kM3jfnzPwaMPl2ASV
TLSH
T12805233096DAFE68C55D0EB4857702A3AB20AD2F616E5547464D4F0B3FE23831DB39B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKUSEUS.CHM

Path C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WIBUKEY\WKUSEUS.CHM
Size 571KB
SHA256 6a6634ccf351550d95bb2e8b12d55a8f2517f21370935567d73f5a772ef343d6
MD5 fce7ddc2e3d7cddd2049c44000423fbb
SHA1 ff7810a1283889b5e2b7934a3835792028ba6efd
SHA512 90095726ddd74437ba39e1e90566f541dc14e5f96ceafc9eb7384ec24cb51e5bc6a5f503e8d3936eac9c09c3b570861d4c510a4a8a3176036c4aafbf5275f965
SSDEEP 12288:T9yPm34CP8HHDT9KhbnGSiE2oK57/SSFNolZfQZB5AP/MNgb:WmICGjIhbpPS/bv8ZfGa/kw
TLSH
T1EFC423FC07107DDBEA262D70BC0B414894DA2FCAACBDC72B599C54AB6108B45F9B5D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.ini

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\Setup.ini
Size 4KB
SHA256 124333b6f23d4c03acb7b0e92d87597d082f040897a4b664f74aae574cfefdc0
MD5 03dab9c1e270f21250f8ebe5ae225cba
SHA1 33c5acfa5edd22f78b9398771d5fe083f2e8cd62
SHA512 0bbd54d8bec96c0f94b747cd54cfc00481c5d1cdcb2282e5eb6f3e08ee34abc0cd0ac5b774f169401a828076db231c85314212ad8aa92ca72f238a9f4318a370
SSDEEP 96:EbNuJ3wiR68EnLnPQHATNMQXSF1hRN2FuXWZ6:ESREnLPXMQX+Gho
TLSH
T17491E5749C0845A848B7C68132835299E28AE07EF199F50E86D9FC7F65B3E47C84E5F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup64.exe

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\Setup64.exe
Size 784KB
SHA256 f70b29094c85db457bb98d191737574622b0471cf1e3be479563d13f5c36c095
MD5 5aff8f182aad5024afaff0690bfad365
SHA1 d4de456bcc0cb2d4b8710d7215752df30e750ce4
SHA512 f80b9b991f189efd5df71a2c9d2d26983ae9a48f51152db2b8a106072ae75b012d41073fe8c8a6820971babe9c3053115f66e481a7045cf3b386e754bb366fa9
SSDEEP 12288:2/t5I0oqBFbomdc/nD8cBE8FbCJ7dvdq5y/1ogntYF+:2/t5no0mPFbCdW52ognto+
TLSH
T153055A15B7B40DF1D45EC13E89938A69F6B278415B3CC6CB421086EA1F277D78E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WIBUKEY.INI

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\WIBUKEY.INI
Size 1KB
SHA256 9caa5bbdc6000e624ff547c0c67a5bb72bbb5a1ac0ffc5fe191d35ee23a800c4
MD5 05fc8c387ee3470593390974b4396b73
SHA1 dcd8a5bb72f3c64c81acd59ec17d94ca726b208b
SHA512 533e8a0a6ee9bb927187af5ed7978fede01a260e1fb4cc2e9b1e882e9e910c6c11bc36d5bbeceea4ad6213b098921991972a28880fc77e69492be3d0d9a92bfc
TLSH
T15E41A0055D46B4BA09B0D1B3B363079FD3DA0505263B6235249A4E6F6E8948BEB0E1B8
MD5 SHA1 SHA512 TLSH

Submit Download

WibuXpm4J32.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\WibuXpm4J32.dl_
Size 210KB
SHA256 2ebfadf2cc9458cd68f3f7baf51dafe89ee7154e06042ac7d6162e2b8d927a70
MD5 c3c4190a50a732bc7f60515a6d9bcc8b
SHA1 b813de90adcf0a50d7253480bc56446c92fd339f
SHA512 31459e6a4cdb7dc2790510ffd850326705841875f9084ebdb4666bfa44c70fc7abb559b69d704c1b363742c357a988478a1ac4b2c719709c97718d73956bcad0
SSDEEP 3072:xlJ5at4mCwnsmebd0+5OE1alhzEjQgL1ch6uPuq/pkkeP/XHmh4IT7k6P7Lf+/w1:Dy4k4bayOECw0gLqVpykeiXkwn+/wyVW
TLSH
T178241272C1289D562385C6AF913EEF2640DAF5CB0D5A4F41FB87A244528CECF388DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuXpm4J64.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\WibuXpm4J64.dl_
Size 244KB
SHA256 ebd86ec02cc53a61d575ae65ae28695fee6c52cfd28359dccfccdd3634972334
MD5 9b8c4a045366612db1f0f205f1e3e487
SHA1 5f43cda0afedd4437a92b6ec42a0e97501123b6b
SHA512 de146d2949d334956e277de42e41378d41077a51bbc7244348f08a33968a2a1cd95deae5e48d3295eb96d267485b0ae3f1a71ea6acffda6c7ec7a051f1a6b76f
SSDEEP 6144:QQ5eRfPc3bf2fAaJwUDU08dR5XuLuCES5bBDv8311bbi:cdqT2PmdTsuCT5d4bi
TLSH
T1C73413B92E35882F4E022553EE7CF4E4FB5740A66507C0C91A63E3171F2E5B25A6D6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMgr_de.q_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\WkSvMgr_de.q_
Size 1KB
SHA256 1be7915ed4d423937d276e9182b4f5fee849bc890be62a3a6d6461d92299cf34
MD5 2507fd3a89ece98c765253d8cc4cf8fd
SHA1 a918b3374c8490e02d0dcddf72e2295bd20bef13
SHA512 74e05c52c9a85ccd0e2a1f081443bba2469863e3d345f099e11b2d61ca0f130e4fa177283d87416f3c83d6f251af43b420b3cd0b6b45e1bc35dcd66fe1015c31
TLSH
T1C431DA393ABE516E5AB176D130920E860F21FBA94405ECE12848721EC1572E6AF7F54F
MD5 SHA1 SHA512 TLSH

Submit Download

WkSvMgr_ja.q_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\WkSvMgr_ja.q_
Size 1KB
SHA256 81a08029a957194e643cf89d1edca0af2635fb9ffa87b6389527763f73fed09a
MD5 ba41e7c67fd5466e3bf2e0ec255c3c15
SHA1 7baed086a5326a8ac4f1dc0855152a74c3dbe761
SHA512 682de1a172bbcb6efd6dea0531403f0a8f65eb48346967a34c4ce1d4f87252765865da52548802aa4a20d5226813505532fd94d9e61a87e6b918ad7a395ff760
TLSH
T16B31F967342CC119CA300FD9F171FFE91258BA6AC3B24491189F624D529BC4866DA4AF
MD5 SHA1 SHA512 TLSH

Submit Download

decryp32.ex_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\decryp32.ex_
Size 78KB
SHA256 bc38dea9ca329c4ebd9d2739a3279361a90d750177c6ac6836950e5c65a39ab0
MD5 98d742c9f1fda5d182ba07b7b8da920a
SHA1 6506ea9ad4cc9153609fa4bb78e176f168cbc2a7
SHA512 3bd33d069c6baa5111254e2b0f7e07b2a9a9905085e346021530827121a83be8118209fdd83faa4ef7294dccec2d070cc898a518354d655fec1c9a7a1ee8287c
SSDEEP 1536:mHvez80dmo8kaalGylSQNVmyZ6qgs3rl5E83gVZC6+Igvg2x89iujk6QQ/ft:SezFdiDalGExNVVovsbXLC4ePdkrQnt
TLSH
T1BE731237D9A9EF70074AAA11FD719B1AFB2FA413CD3C142167A6F4E706961EC9493E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcrypt32.ex_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\fcrypt32.ex_
Size 96KB
SHA256 1bffc122d45cf72f4ac48810f5605267f3bc238d9990ec8ee1438b9cd8eab542
MD5 c959f62d819b8defc7b8ee135de14ef9
SHA1 dcd0be88c87a8512a666a55af581fa87b3ccd640
SHA512 84909e82d2175822bf1fbb82f305ca817fb854e3902416ab1f30093212da7fe6744e855e1fb7181d960aefd8fd7024431dc34fa90b0d6cd578cb6de3fda870d9
SSDEEP 3072:RUI8Bas8ak+wN51lYhJX9AUoroBlTXWiAbzK3zaX:R8ajEwRl9/QJWiEzhX
TLSH
T14BA30221EB7A5BAC5985F4115E7085D8EF67918E28038E7B923542CDEB079F32A0D317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuKJni.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuKJni.dl_
Size 196KB
SHA256 6ce675eace0c9e384fe2a70b61c62283e961c3cba11e0e04ba58389a2409e92c
MD5 a3b088243099982ea2097b6c22f8899b
SHA1 1ed89e3efc3ea9cf243ffa158e1b7d87c90beb5d
SHA512 83fab5fd2c1b7ac1c814926c970a5542a8f4acf147b6a4a4c57728251c6c07c35a8f6ca50dadb4004501554071943f6d325b78aa41fa1a429dbdb308eeb326ba
SSDEEP 6144:z1oyoMFwLO+iHgI4P8zrOFRCwx1DNexqm4RdPihciI:NjFwLsAZE36xlNexqFd6hlI
TLSH
T15B142376C8B14E5313C00EEE94B637DF8F3FE9A205A765ABD3219A44FE98451D8325C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuKJni64.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuKJni64.dl_
Size 228KB
SHA256 c899e1e280034de0523fdcd0e641b89c91367fc4c9ab4cf38138c9d3636d0490
MD5 799e3a44d1708c04a48a28a3f6a6d407
SHA1 a3685b4c0bdc58e70835297036207487c3a0a3d4
SHA512 7331da866a9b82681134485430174c029ff2353b303bd06777ac05523821dd4a75d67b0e8daecca8e6d109db2aa5d7e5a816337778fc6e5eb4dfb89ea9d71a3b
SSDEEP 3072:syzA4wJYB4rpcSe/fLX9dR4ITdl+pqaF3EQ8/3igomUZaySaWmPHglaa6JWRMke2:s46J9fOp/0BF3O/3iplZayjWNUBW7e2
TLSH
T11D34220C939C08703AA2DFCE8F1DA98AD9D501E99EEFA3CC5433BD234746E566875984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._br

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._br
Size 343KB
SHA256 7fe16d9c51479ce7ae5f928787ebab23b0fdab8f05307ef0fe93a87700f2d623
MD5 1ffb4b1362e0aacd2f71f10bdc6c6568
SHA1 2f7338390dae59edc03ff2ad0baad75e16c8a705
SHA512 ded67ff8adf1b276c372660a9448c065ff382a08405d8c7035d58822fc14e4746ff72c790da86e6db323c23491fe9059a87db079cc11bcd639e5aa8ad5ba9044
SSDEEP 6144:aki31+cKiLsQl6vDvfvqovklzKRLQBvCmShSdXRKlj1p2Zo+xZcEIP8YfH0E6yYH:a7FpLLlafpvwKRL8CRuXRO1QC+IPjtOb
TLSH
T11B7412F1F67BDB49DF8BA19E44F316C0E80F50281E858427214716BFA4BB6EBC449C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._de

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._de
Size 343KB
SHA256 c10d10ae7b0dba841cb8896a406ac6ac6ea01dcf18021a5e65247233c97e01c6
MD5 3d68a7d5df98d9147bec09c1597de563
SHA1 9b9124adec60cf91ad25974ca11156b4eaf95062
SHA512 05b7b672b2fffd2c6e7170f59642915ba1e51352df4dd33de0530437b4af77dcae957fb4deefefc818a53dce3c287ebac2f183c6c3b633cd93bbaaee6359bc42
SSDEEP 6144:+gJKzGqnIXDz0vT+zMis53nzP4miz8SiYhLMNgqYrxp8q2jQ2yYqmLC:+1LncDQvTAMisdzP4mc8SNhLMNgqYMqJ
TLSH
T1717413B1FF3DD799EBA8A00F657212A4C48768306784781F107727B9846B3E55893D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._fr

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._fr
Size 343KB
SHA256 b3ba8ee46bd8444bcf4a58d1935766dee925ef2956bdc483ab17e8ff994a5270
MD5 b59e03569f1c93060117ad9df9a5fd89
SHA1 623891f289bf0d5e10bfe1f2e0f8e60920b1e95d
SHA512 698f25bd6f1b9ee0772f403918ba02793a9fb090eb9188115d530d88683c9964db193ddcebb9826aeddd38f29ac2436a72e1785252ca1c6ad5131ada965fbb53
SSDEEP 6144:DK95B7cRUKCaod+jbva9cvrxcljjHqcv3LI8cljFQwYQULMEYXNcYMiWPfi8C:i/7cgara4xYmm7I8YFEQHXvGfi5
TLSH
T1127413E0F37D875DDBAA909F18B31240E80BA470174A1817215766F7A5BB2E2D44FE2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._hu

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._hu
Size 343KB
SHA256 312f4dc42d73de40d9fa1517601545521690b93d8978d971e79ddee223f9af3b
MD5 1e0a483c8839e909760fdedc355c8abf
SHA1 1060a0f74353b2e23b3374a96054879de27f3eca
SHA512 9bb8494aaeedc60a895c473d077a32a8bad880a6ee4d59cf4cb1e00aa94ba5dd1b5baba4d29ec3ad0862a0707dcec09c62af0e3ac309905fb110de75ca0aa93e
SSDEEP 6144:tHxevJR9xJ8hAM33tLCMz++9161WLj8Tkq1ChaVwWD4ZxLyYTvp5LKwfkEIC/QLD:JxkJ8Rt++jJDOkWaUYTvp5LmWEDP7
TLSH
T1767412E0D7BF9F6FE760A01F19B78514C413985897448B1760178BEEBA476C0E4A3E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._it

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._it
Size 343KB
SHA256 7c4ac30a284c941f5af32a890134abb5174b5f6586683ed2da3ece697f73c816
MD5 259c297c0238bc2c63074b5b86d812db
SHA1 64c6d3ecbd7db3509e6d59e1c8be1e9a368dff8c
SHA512 4c66fc3ae5eac1b36f730660d8035ebf5b67715817bd55c855579c1062dc7bb3a4fbd6f7b21064491be0031fcdcee32fe403c27e4142d94f7f29a5db632027ee
SSDEEP 6144:ctlUP+R5wf4cGqETBX2PC7nnMGKkD7g653uPvdk4ekBosoGwfJ0j:ctlY+4wcfCR2K7nnMfS7x5svd4kBnfwq
TLSH
T1E7741290F739D70DD740915ECCB20548D657662427DABB17226722BEA0EB3FA21C3E87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuke64._jp

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibuke64._jp
Size 342KB
SHA256 2c6238c9886546557b2d3b794b23689782562effef991e5b33d011a36d41b96e
MD5 e0cbcb5b4876409cd727f939b7c8266c
SHA1 52d029d99d1c7cf3a2e9f1fe22d9e654ac3b7738
SHA512 6be684a49bea91e9eaab1e3ee53717ab9e10f09e67d292a4eab0873838b8a7a779e220921c7570c989a5291647e871beebb3734688fc9d8e2431922defe3dcbc
SSDEEP 6144:YEDQe8DZEru3o3KCrZoJ/PBuoX6EcNTHIU0Zndq3zFmWrSbtO/Uf:3DR8DZEru3ajoJxu6TgTolng5mWebFf
TLSH
T1CC7412D6DB7C774EF7E2200CB4B61394E80B943063C85B0B11576A9B90AF2E59C6FC69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukey.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibukey.dl_
Size 278KB
SHA256 075484af39890ee47b6b857cac1fe2db10ae9594da16bb6e09e89cbc4508d69c
MD5 cd02c751faf6aa28ec118cfe27dd3a89
SHA1 13f993291ff6c852fbf28c74e37360f804af8e2b
SHA512 ca4f82c37c421835698683b2ae968ad4c01f4a0d4cce8c00a6464e40700aed7a2678dc6e861594c2007d77d6fa55149e8fc9696f0b36009c3383db37df85d861
SSDEEP 6144:1mCqPdWmFnDiixVssbWOkzLokRZKNn4LnFFPaAvzTnv0/ijy:YdWmFDimGSlknSmFFPawTvb2
TLSH
T1775423B1DDB628833283954DFB75F1A093BFE501C2DE44AB50A75B1EF08E2A152C8B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukey2_64.sy_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibukey2_64.sy_
Size 8KB
SHA256 809f04afb6758a9ee0addc9e8701bc101b8773d79e634a7c8d98f83421b28a5d
MD5 2cc1e833525dbff4fd44e2cfce3740b4
SHA1 517265eca29be1dcb1834e7ed9396e2bb034f926
SHA512 dc6963dad2c87aaa975a63bd3f9bc67a1e2f7e2932a76cf52649e6e916ae65ef248a601fc7c670a6f7edaf1a732d3a8cd298afdf85ae0d41ae2c22ca33568add
SSDEEP 192:KlY9IHo73AOh6LhrwhAjDRbZFb7u0PWSpem4zzjPSYJ7PQnD3jYdqY:UY9JAwOH1nb7u0PWFmmzjPSYJ7IHYdqY
TLSH
T12702AF0EF2E9CC5207F1BDAD763697C4EC4B9A50A3A6792BC5B61C412F0310FCD69150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukey64.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibukey64.dl_
Size 320KB
SHA256 a461383f24717d88cec53e2ece42f7e238eaeb0734cfcb9c52f554d2d0303ea5
MD5 84c725ee9a303d6c8a147e6e941d9c58
SHA1 2219313c7d34a4a39d2ec544cbb5b63d347aa93d
SHA512 dafdc205bbbdfe15c3ea9adde08e39498bb80086ca391c728b0e98e98423bedc2c09043d93e86c159bdbeddeb2b37b912f4651854cc9e1721464998f13f07919
SSDEEP 6144:c0+ywgQ7IW3LvKvuMh5lJheQ6q95/zehn2ShGRF6H6h2XUGAi:tfwhlLGDVeGe2Kwk6h0Uni
TLSH
T1FD6422D1B27C136C5362A15EDE2EAE81D5EDCE177246D087C251E73A786E8B4202FB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukey64.sy_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wibukey64.sy_
Size 60KB
SHA256 5babc13997cb85960e125cf283f34203dc1643ffd1f379e3bff19a88cc0e2ead
MD5 35f52ddd50fe3a0ffd6025d2168e8a4a
SHA1 b19cdc7e1b51b57975455a62b7ac7e005b540f93
SHA512 79b4345c43b436574a8d0a808461bd543f40403c7744cd3febab0c2d8c2530f48ff112c87b7bc1785e58a89b5604c34447f044887a388a8f09df265f15bbe32d
SSDEEP 1536:aF6+MOZsfPG+ZfFSF3zwQ4uC2pHmWN1fM7M/csnKlL2zi:gvMOOfPp0F3EQYEN1fPn1i
TLSH
T143530285991031253177CCECB26C6827D2A7F3E09284BB4F35AD5DE6404A7770CEFA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkext32.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkext32.dl_
Size 192KB
SHA256 8d99bed8479e758983fccf05a43769218bd0843a700bc8420d5b20276b0815c1
MD5 10ad47c8bd3970e3d4ddfe1841c5512c
SHA1 d9d2c36a9ec291de1ace5a35645ea93b7d1dc5db
SHA512 4e00a81f154a827033b4bb0c973d14b4bf641d36b0e27b571c92da3285eea60e15c19c8c0517b1d6ac9b9ffd9ee06eb8e94520d321701df81449dde3de6a3c44
SSDEEP 3072:FRGgyAvXbHTf6LVXG+5oOteah6omyeZS17wREosILPmtD3iGnygm4o4nHbUnn1:FRpjXbzi52+5Gg6JTEosIs3P9m4Snn1
TLSH
T17C1412395AE28F63D7C2D44C2B3E9E6EC86DA5820C7A190722BFF0D73425151DAA31D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkext64.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkext64.dl_
Size 223KB
SHA256 f35002bf687275213f3681fc5fbe9004860271f5bc63bc9b5b60f8f3f3f38108
MD5 53e9ac04f9bfa6f42a983be555bc3b8e
SHA1 d715c8265ae4570c464bed4acd266b7d0e0fe82b
SHA512 d9043b2dc72473178720a8b4312e11d839ed7196ce8375f0cd8048b26eaa3a45febbbf01fd1e7ef5448a05b2bd5956e555486adb032cfe993efed1c508eb983d
SSDEEP 6144:BMH+BH2qfrPjaV4SqrWLiON7tG+Pk3UFdzzGQH01s3GzPSau57+UdD5:BmAJ6LlNtG+POazGQH0YGzBuZ+U9
TLSH
T1A12423FDF79001757D172053AA68BDB2F8FB9BA16132685592787F67A40B316320CB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmgr_hu.q_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmgr_hu.q_
Size 32B
SHA256 14df62ce5115d2014362877e6d6e25fcbdc013e2d3ea5780b39c8953f45e5dc2
MD5 bda4fa4caeb2f1bc3999a460173413ca
SHA1 8ebf159757c72048c14d14d59f5cfc2126d0e9ba
SHA512 738206f70ed4d388afedc557f08685278bb29d16c2a15ea3df4857fc017d21fa5c16cc2e230bf6dd0c4dd4f9c0bd0de6bb18f0c17efd61166469a050082cc1e4
MD5 SHA1 SHA512

Submit Download

wksvmgr_pt.q_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmgr_pt.q_
Size 1KB
SHA256 98f01fe6e83ff3d2549fea7326c79af56576a49af0e4e16de881445ddde253a9
MD5 f54a60f5105c22698c634c23bda1716a
SHA1 aceac60c8f3d0cc74139746eefffa66254c5236d
SHA512 e6730aecdb6c2b05941a52fa47b671d1c808f811288ad579f199459b7217d09b574eee7c1d0f67880570d2b446eb5772e1351a7fa4287fe728ebf2bd8744903c
TLSH
T15831F97D4F0255018020E87F4A5044ED67B4B0A6A7F1DC173C3A385CB97CC45986988D
MD5 SHA1 SHA512 TLSH

Submit Download

wksvmon._de

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon._de
Size 16KB
SHA256 336ae16d0eb06fd6562b400127769b63b6e710b5c57681445035cef6afcbd1bc
MD5 e87729ec7d152d3782dfe243c16cc0db
SHA1 386f58698a9dda6cb4613914dd6f6cb4ec6b8cd2
SHA512 36da335a865b8cdf52304bdb5100beeb52ccc55f65fb748bb62ead6f7acc1653ac5927c2276d41452ccab9bc44a0f2f59bd74375e957906b0a86499d3da53e02
SSDEEP 384:4x11ivCibJXpNcH6pRrm1ZhjFQd5ZdFaBOJeU27lYRM:C11ivCib7GScHhY5PFOO7AlYC
TLSH
T12172E1769C8283C6ACC252E56F152BEC8E5138BAD2F4C7F223FA21636115917235FE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmon._fr

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon._fr
Size 16KB
SHA256 9e1de2edd3e9699cd93e097fe490a01407ab0f5b7bacc8f685d97802785b1bb1
MD5 08d26bdc21e6f0b89304fd2421837c13
SHA1 337a1d9eb9ea2950362e8c2561e2afce6ce49b30
SHA512 100bff23e2559388691e6d07d41fb82b9ed0530312b312a07cdea4b12c10939ea35929ffe0ecf982db7920c63e2f7636ba94690c941a272d9936e307b1c82dc7
SSDEEP 384:mQx1dZPWITUO4njav5jDtONoShw8QbJO30lqM09ix2gUylxq+I:ma1dZPWIwT2v9pKSbJu0jSkCylI
TLSH
T15972C0324C884B490C6B5370DDCF9FF98F638E7F2DD48668A679448BF4280623B1D641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmon._hu

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon._hu
Size 16KB
SHA256 dc275e36b507d2ee59dade99e381eecb4093688be27b68a4ec81e18a329180f4
MD5 9fdc6624b4b89ba973f1498630a08d6a
SHA1 f49a1a97e93e9ce96ba5e979f8e8ad93fb8c1971
SHA512 24130e5050d1f59881b2d1eb011e129c570198863cbe7be49ff3a130393f9e5523c7b5cf2fe81ae5b224706a797ba1e63e78f1bcf1a56b87b6e264340221edf7
SSDEEP 384:TBcx1nmkvynbJXpNcHNaODSWOs7ZVvefS2ipOpI9vXsL:FG13vynb7Gs7mefR6cL
TLSH
T11972C15F9C87D28A7CDA26B92E41028C88E5264FD9C18BD535F5117F237EAEE070A9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmon._it

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon._it
Size 16KB
SHA256 5fe4fff917de4512e7ce253c0fc4b9db7f3cb97df980324fa05ffab777602050
MD5 26cf443db6d0849f8d6cebd0e1dae9dc
SHA1 e17baa97ea3c2b58d562944f12f8c26539cb5666
SHA512 879e5c943c94a99e6765d91ad842103d0c6c8f4cdb146272413cb2fa9cca8ec59f06ba48f4e59aa927cc76f83225e21bcc1f4beaaefd31d91104d5a4ed68ec02
SSDEEP 384:vAQ/MQLK8Z/OuL2OB2qVXrrU2Gf43CwGmoRR0gishwRSe3gtR:vAQ0sPZ/O1habUf2CVDRa9Se6
TLSH
T14672D021063381855EFFF7D54F88A0C589D31B4BAB2584CE7792226FE4C24F67A0B5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmon._jp

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon._jp
Size 16KB
SHA256 a28d1a131513cdef1dc09bb5a09deaabb88509f7b750d7f4e3fb060b2abd8c4c
MD5 0dae7b64c8a83c9d546907a059e68ba6
SHA1 db3d89edcc4e6a56f0dd71c4954e72bb1db7923e
SHA512 8d73a00ed50dcbccc0a3511b9382ebdbea35e2bef80cc8814a16157d1bf84fecedde19b7092e1171d3e81895efb8dbafda5c0eee2ff36d2cbc2d65c5db50d627
SSDEEP 384:uHzXJByzXKxV6rBpJOGvzDTnvViCzxpMTpm6:u+z84tHrPNlQX
TLSH
T1CC72C09A30FD94B40D9217F2EFD7237489022A790D38A6E376FA063975E817B135A2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvmon.ex_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvmon.ex_
Size 204KB
SHA256 49f495284e4370eb002aee1a64768626c12544549ab6b469e16f71299aa0cba7
MD5 64668fbc709bb6ce1e11fc8deaeefcac
SHA1 5a898aaedc70fa7b4f2ff83671da0dd19548e174
SHA512 af3bf4300be35e49c8a709971d0143a2094538ec4a4948e22895b68395f03fe40aba7651fbda8e9cbb38a78434d95bf5b4c0b0469d4ddbbd1df6cd080b272a36
SSDEEP 3072:6XqcyqeQ1y4+n1AoV621afaGYRsCDTDeT5iiGRWWIJhL3IVEpBBYQLYBmThHJ:QF1mOoQ2SYZDuToiGRWW+x38Uz/YBmT/
TLSH
T1A8141390E6C0561117A847D9BCBD57596A4FEF220DE1132EFEAEDF3882A14C64E403ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32._de

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32._de
Size 18KB
SHA256 5b5beb8dacd37dde902d5ae0cd59e1055b6436f17023484ad41d0403985f785b
MD5 71a817b97eb90ed36ac92b2c14b698db
SHA1 70e42fc335178f38f358f3c0f6f2ad9f2c2062d5
SHA512 6dcdff66771398a3727df3b614a2e96151f3eca8304e85b011963577671ed3daca0ca4cfb33db4feb505616cdcb04c08e969beda0a8c5129cc6b11a6aeece255
SSDEEP 384:0vSRCeAkBZIFRLlLprUqautWpk7heR6FLxerLzgRa:0vSOsILTr7QR0lwMc
TLSH
T18282D17189FADCCCA66105B6A31BBFEB41D0152A6DEA017FE6351E529023D0F52250EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32._fr

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32._fr
Size 18KB
SHA256 854741e73d7b99ebf8601aec35d2cefc21fe59df17158dde57c0d7379909bafa
MD5 748abb12886a4d13e713f5ab6708f7f5
SHA1 95772a320825b8ef8da1be2bdb818996c92f3b1a
SHA512 7772723b5f4c9fbdffb18bd2a2fa93a28a59268c27565d0bbd8a6cd5c2eb671a132124b6a3c946830c9af90b07bfeb0fb76641f9dfe8260d534d664698ce8d24
SSDEEP 384:AE1tPcrOq1zvTz+DU53rK0qVQ3s9fEDWXQaASp/nSmtzca+k9S:o1zvPYYKI8KW/ASpnSaQeA
TLSH
T14982D05D98D3DFACCE7A3C0497997A07B22B4CB335A8355EA4381781C8B3585A70279C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32._hu

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32._hu
Size 18KB
SHA256 bdc71490a64621de696064ffadd536af85f380ad849989e2e1dae115cf3daea6
MD5 47900928f6f46ad24f3a6b340e02b90a
SHA1 415697e6a91cc9e485b449d67872ebf34d8c7c87
SHA512 cd9054af68dfc3f0ecf7ef4670f9d78ab94c9e1963d66bf53248d5f7e365c997565b3e45b005d4e2fd0dd8ccf445800c242d794365c2cd9ee85c8827de79e225
SSDEEP 384:6U0X63Co6XtHWKcMCoiFn7OqhXXIqvSmAA14KJ6+aYg:b0GCoKHWKcMqn7OGIqvj1TRaf
TLSH
T14882D0DFACE68541027F300935B8CE1C607BC9362892964DFEDE59F5E4E0E87A3916C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32._it

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32._it
Size 17KB
SHA256 f53f07fe31677f1fb1432a3a58c1bc5dec2bbb5c071677777ab94880fa648762
MD5 a4338ad98d03ea8fb1dec7155c5fa33d
SHA1 c186d5a5bb498be969bab9fd53a19aa0edcd9f33
SHA512 fc37285cab25e8ab84010b85d76cf8fad9b9a46a5f1b7a4496681998a5943ca6912c9d19533990ff68835caad579ea247fd4df33e1395482f169fc3436b60fdf
SSDEEP 384:inczZ0iE6BXXw4kKKScYjZUTF1ZPDu6w1QwbaAXtxvX+72PRv:26dXPjHcYjZUJC6wVX7f1PRv
TLSH
T16082D0A967DD844839A7EEB46F5A66448152050D0CAB7FA1BE179F61E4E8F330A3C10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32._jp

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32._jp
Size 17KB
SHA256 f8a4806f5814d6f0b4eac013fbdaa5513f6f78c4fb6e3d250b8a17aa700a9595
MD5 eb051cfce0936a02bb7302d5d2f921a8
SHA1 6b75f0671b5a9ba0cca190d4b51e4ffa6ca88154
SHA512 e179b42dea1a1d58bab2fe7679a37ea9a7c367a12287bee65b771852ff6c8852e1a2c8d16a3a1b09b8c0e5b5d86f01638a7764ed7d247b7da4ac1a57cd1891a0
SSDEEP 384:thfTSI/RTGuvOk4UTlU2JP+BwbGyqS0sq0lzV2ylSGu8GzBbWJQ:tVJT11hUmOAPcM781BVWJQ
TLSH
T1E182D030B53480A87E32D243D91DA3E5F6D3123BD5514F96A283F6C9ED60C5A633D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wksvw32.ex_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wksvw32.ex_
Size 336KB
SHA256 acbdb6dd2f2135a2b3256789e0c60f0f2646d91ef2b40de7eeed6882aafb858a
MD5 2babf6021faddf62211a41a84496997e
SHA1 77cb81676a891fedfb13cf754950d13833dc7e00
SHA512 0162fe2561b8251614e2375266613869de43e2634bc0a0d80a18451516963e8792f443ed6ef1c246e0e5614fd2261c2b84b4dc810e179d08f488d1a76fdae4d4
SSDEEP 6144:bcaZEVeumF7l2LLq/9d+FZyra9tYLo0C65nBXBWPXFnWoNqw8:bxZE1A7lILq10F/Ys0C65nBXBA8w8
TLSH
T1137423F3CB059A074383FD454EEDB77C0ABFA056487AA4CB6404BFEA6A3585B281C157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wku32.ex_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wku32.ex_
Size 236KB
SHA256 7e3697ab255458e40aa12ac394a4c45c21512103701ec9d1dfe2e67ac5546817
MD5 1bf3cf0088d1447bbf7540807eaa80b2
SHA1 c7b39f75e7384db9061c11152dd243354f44a81a
SHA512 e136ed6673a1895256946d6fae09b6dd990f31c0e5622ffc0a04bea94905298e3b910e3c539e9ac40d16800ac7cf1aafafb45f00c7fee5e13b954ab102b18541
SSDEEP 6144:FOEdIZ1hBP88K3MW5j0f78hptXwUSlJm4dOUCsSWrXuGH:FHYVU8axj0T8RXFSjq/Wd
TLSH
T12B3423F517D60211C7635906CAB56368CEFE02A29990C41D8F7EAE0605AF9477D33BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._br

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._br
Size 6KB
SHA256 110e5987f422ef4f3fb3da8659b5dd284331c790f6e0af9c588c8e4430df7b3a
MD5 8f4be0f27f8753863357cd92b0a9f455
SHA1 266051a9a3abf2e0627428d67c93819007b6268b
SHA512 872a2d697228f68dd77e6117461e9bf1908f1f5a17e9496deebf70505366a634be59b3e0ffd5a51457a7c2ccbfc0eb5e2b95563c8372ddd5c9ea2e59c0c49671
SSDEEP 192:0y7Ek2F2s6SMZ7FhPNJXQHCodf8RB3MhfWPqAkWv:0LknrRFpNJAHLd0RB6+Cov
TLSH
T1BCD1AED0F632577EF87361CE8525A947CDABB9F112AD5DCA1DC5802D8A33EAB3507820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._de

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._de
Size 6KB
SHA256 0af8e384b46fc3e154d229a4c3b8c7e087763f6a64c903ca437173925ebeaa34
MD5 e863cd01ed3d77cd992c88420d55a562
SHA1 d3dbfab9bbc91ab412bf6c1901940e46038e2186
SHA512 7b9e8c6829cb7cac9e1214bffbe04e4f742296062587e1634200a8dcde615cddfdabb162c90eb0534491cfbc7c0fa0cc15257a1a755745e734fe6c2ffca8090b
SSDEEP 192:7zeWDYHUPn4Li5jqblTwTr+CtYs5r5YAPegH:HcC4G5jqblcTCSzdYoeI
TLSH
T1DFE19E6CFAF06F8D2A5A9053233BD9E7848FD07D5B135E8F25F44528249B0EE09253E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._fr

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._fr
Size 6KB
SHA256 2c085df69ecf5bf91e434941d43f75e95ea2d93b2acd970357763b1da75ab0a2
MD5 55000d89e5abfde9dd01ca4d77a474d8
SHA1 2c44ddf5058d4712d94cfb96116c8741bbcdb4b4
SHA512 298c80ba84ada2dc824a96fb4a524b494594db5659912f572801b123aece8a8d14f69b725a30441255851046aad201d90e02e92b8b730c61e37d19c7a274fe79
SSDEEP 192:3AhCrC6BDG3uwkpAgcPbbzIxkvmMTZ+dzgNu1WDs2Ve9W:QB6xIuwNvIxdMFNunke9W
TLSH
T139D18F2165E3CE6E439743C65C1CC428F2EDE4CA2607692D20D696DACF938FB5811BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._hu

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._hu
Size 6KB
SHA256 6419c64ea17c6512239f83b1312c09a00b9506fb4187b01212fb3ed4248a10d8
MD5 233f2310038cae92163dd24aa948c307
SHA1 0b00dcb547e0e0dbae7f5ab4e12aaab5140e86f3
SHA512 f87491eac1464da044e47798463b49c4c66c7127710ef4b2650d897b696baaab9e4422a16a6e3e3e14512caa69711216af26ca7727c332cbd19ce455eac65f41
SSDEEP 192:YZ9NOQ/CfLxh12DAX6cBxkPd9GMGfnGd2hqfBEIRUS:g/uLzsdwfnhqfCpS
TLSH
T1DBD1A05C52E95EFB096B41D0841716D7D89F927CBD3598F5C874C06803678BB2223B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._it

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._it
Size 6KB
SHA256 a7cc59d6818338f58e4acc4012574f492a21efcad478a5cfeb36d1b98f801627
MD5 b33b987764a05fe15703479f6ed73876
SHA1 4b316931a148d21d873d680b293b4b041d42c501
SHA512 0af2337b5531898d4420f52e15568fe99a030a54c58ada14142125c28e07049782836ab48ade82720ce6f67f5c180fadf387923c0f40dd9257a3eaae45e3c062
SSDEEP 192:TUW4AcVoMsaDj30MM76C0sreVJuPSA6ef37:cBCM/UkJbeD
TLSH
T105D1AFAD17F2C0376E7EB8A8A467F6538A53DDA34120DB5D2200816588719CB3B76912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32._jp

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32._jp
Size 6KB
SHA256 6efd51db48ef5cda63694f286f5a0e3a2aefe440a1496cc23d00bf033a222136
MD5 afb31b2f2d05388670ef3dfbc98443d8
SHA1 acc431f2f8e11da9589150d579adc0e1b4565751
SHA512 e806f89423ba6c06ad58d525a8330c0093c33ab945ca5ff4940687db188d674f30d4b0610a643faf980a7b93f612c49c94ff2d6e8d555a639c6f5cede1a94881
SSDEEP 192:9BQObkGNFc2e6dgESJz12bnO54dp34DRJVD:9B9ksFciSQbnNpoDRD
TLSH
T197E19E9DF2B156B99D63FF88C46703485953DB6E100ED3B8E6B44C6CF150EC17020AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin32.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin32.dl_
Size 91KB
SHA256 f636d2d8371577b618085c8ca6aa488a425373ce45d831cb8e9d195b5cf8c580
MD5 dd4c279410d1be24c40b31f4c8436d61
SHA1 5400fccbca65a4e566cd167942e1bc257ad37f91
SHA512 744af2a7a4893bd21442722680f199fcf0e9a69c97f3d418a89300a6002a11a6125777e47892fe0020339077dacda33163465925c79d31edd5f975c979e2146e
SSDEEP 1536:dwNcay4scgdNnGWoHH556j9GngwuldJ0PMPWjISZv0PAtuQXWmGanKkm0urAJ2My:SNcWscgnnGL5QjZwqzD+8guQNnKb0wrX
TLSH
T1B893022E2226092292039A4FF176866233A773251567248E7FA2EF8DC5539FC7916D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64._de

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64._de
Size 6KB
SHA256 67d7d10002518df0f32ff63bcb38f851cafe7c169212adb1465288b6167494e1
MD5 05a375a6100ddcf91e368854c6830117
SHA1 ffad76167ee32a9a064eb3ea2733c7e3ea574a67
SHA512 aea54923be57d57b360ef485d2e08007cb88319d5b32e90b66e3d510f3b494809fe0d9dd5e436ae78adc3e82852068f255a75161d99f0726b6692d01fe049dae
SSDEEP 192:7nMOPVVGQtMF/9mT1OYukxZtnItqi2ebOl8wK:vDMp9mT8eOzbTN
TLSH
T127E1BF0C90E88A700B7B7004132FE6EB45DFB93B4501FA2E65E600746993AF5397B661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64._fr

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64._fr
Size 6KB
SHA256 ce932aed88f82bad0a78c2480f7dde2a67541bca629f1b7011295bbd2eb521d0
MD5 e1d884ba1ca97abd99dd5e32dae6b02e
SHA1 2d43d0cb0306fdc723f5c59b4d11d513d2c812b8
SHA512 f5544ba45fb64fc75964de6020c91a1da309c9aa2d9e6719a6e7e3e3ea256aac9cfa9ff0a6570111a80bb4aac80bf406bab0e4b6a8421000cc622aca319f0c9f
SSDEEP 192:8BgxxHGNFdDuhbxjoL+aPAYsrRrkBryNBZmsk1:1xHsFdkWTIYbFMBbE
TLSH
T1E3D1B0EEBD920C25831712024D3D725486EF64CF7006E17C49925A0BAF83CB58933777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64._hu

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64._hu
Size 6KB
SHA256 ccbfada9559d6419a6a90c326bf76c0a378ce8e253fef859cb855d0b70163ff8
MD5 85eba8d55dbc256349de2b98654d5160
SHA1 df0cd40c89b1352b47df4977f4cf52053332aeab
SHA512 0c4265ed3bdeb17d2500663853485e83304a1abc484a4697073e8eeee6af00fb6a57b84c12abc68e153cb2f81e96bab92115731e1f798828531d39dc1b74f131
SSDEEP 192:UJ1jCfLgh12DBrwdamxUUH1pGHnGd2hqfBEIRUS:ULuLrr0xUI6PhqfCpS
TLSH
T133D19F4CE69A66F70A7B80F054A30BD6D89F4078FD2688B9C879C199169B86F2231743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64._it

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64._it
Size 6KB
SHA256 06d86839acdc2b6d1b5d28888dff4febcf5c06fc4bd2eaaf9c242fd033c45d13
MD5 7f1fa1f24aad2b90a4f60ef711a20d6d
SHA1 fbbdfa5715a3bba2c93bc273dc40fb0e5f36ae79
SHA512 b227fd89d08469d041cb252e170e0b17e62fc3acc8305ee487d3d0c415ad4f6141a4ed39e030b23d4b8bd9a778b7376aa2129387c8796b9c20936ccbfea3e9c0
SSDEEP 96:KzoqxIhkx4HGN+DCLF4/Gz/mnn3038MRR6r0MhA2nsOeeLhO5GuPaPxA6Reo7DVy:HdVGNPLEn30MM76+2sreVJuPSA6ef37
TLSH
T185D1AF3D0ED380371E7F2864E83BF7538BA39A674114EE5E0451C1A199B2CCB3E75A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64._jp

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64._jp
Size 6KB
SHA256 31e952671057922e8b9463273ba081ae729df0c0491529d597dc5e9300d2b1db
MD5 203f437ef197d1c3265513d2ea295452
SHA1 f160b5bd79e63126e25e18ec64009b585d64bc27
SHA512 07857b9615fe7c0dd8b404e61fc90d5e5da8a328ee52b75a0ae01a9f4f9690d154f9b31fc6347d497c6974e5084f94c4856c575f9d2a9917f27371ded7ae5bc6
SSDEEP 192:AYceOg3bhEUnKxlPmMz2NDbl5NrKTAWxt79m9+AM:Jvh7nCv2Nnl7rYt3J
TLSH
T1F0E1AF74FBB002FC88B74646009FB96DE59FB27E434EB3449A6041ADD561A647015B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkwin64.dl_

Path C:\Users\Admin\AppData\Local\Temp\WIBUKEY\wkwin64.dl_
Size 100KB
SHA256 b4097f972ab89d6bc924d4bb62fcdaeb1aa3ddcadabb53589d8a947ce1e49380
MD5 06c84a465142dceeb99eed66465ee3e2
SHA1 612308a17ed89abb9b0d47541c0ab64c15fa0889
SHA512 0034d49af8b9243e8ccc96de099e55ad47adf710ecc4c4bdec9a93bf443f9d33f24c483badb53c7ee5c6752080b6afcd8c4fd0e9623f03336ed89751063fd0e5
SSDEEP 1536:aXPj4Bf+zk3hD4yJsAktWBYeGHdZVh678K8twBm+d6KXrAr8121wqV4YWewAoC/V:ar0+w3h9bbYzRoIn+PbAY1wwqSeCMw3c
TLSH
T1D6A3024CE11F0A18E83585E52A8C6879DFEB283A2375D9AD13C37B47C39D1DB4869385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukeyUSB64.cat

Path C:\Users\Admin\AppData\Local\Temp\{22c7c221-bb1c-8f41-a259-8bce4c7594b2}\wibukeyUSB64.cat
Size 8KB
SHA256 c8da554fc8e010c6556be7675014b50a55b347379ca3e090f4216413b2fc69a1
MD5 7d1ea8d657a46dac1ae54bd66dac752d
SHA1 22a7a392f3216bea5f0804a3a648d58f2590d729
SHA512 2664cbe31f4050e65d232ad6b822bb671784304afb55915ef5b41ae2c8b7110f4f9fb9db080c1d3107a7b7050ad2a2b4c614a89556cd160a7cf989e73e6344b3
SSDEEP 96:pU5imh0mvy01RXzQMLy+Cgzdew5mog+MSNWDPDaxDPDaFOgkHDPDab3vADPDaiuE:Ov9vy01R1L/CldolMGogivcMPuP
TLSH
T1DD021996862C9585E8969EF156EDFD47BC71F3C35C50893A20ABE3C80C837D47B0841D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Decryp32.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\Decryp32.exe
Size 135KB
SHA256 159c2609d248e1d605119de3b1f32e0c398842d43defb862f0736dac76b58093
MD5 687c226f7648d0078d5e3f7b1b09879b
SHA1 ce505ef258c15dcf13859dae0387a3f51a081365
SHA512 64dacac7eceafb111e9700e51260801987e03a983dba9b06d874920c4c07675a8d27db1906482c2b8606aae7131af5d07248bc211d400f1d7c3c1cab0b6035d1
SSDEEP 3072:9vJGxaxtH6qdvdjlild5e5BDbanRE5JwoTG/o+5UW+EJC0XadT:9RhxvdM85BfwF5t+EJk
TLSH
T15BD36D11B9D3C9F3C2A70A791C65BBEEF13AD6500F225DD3B3D41D6D2ABA2C10A31196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCrypt32.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\FCrypt32.exe
Size 168KB
SHA256 44cd8c240132656156b2d24602156b59e27684b1864295e3a998ac58f3d2f786
MD5 4afb4c47d339038867faf877b1172413
SHA1 c46298531273ce4da2b73e67fad02a70f8893b39
SHA512 6fcf329475dd9451eded6ff4b0a69b7de370a349655ce0eea4797e6c11a1954af7797e1c330725a4ceea515a6826ac36970588948a58b8ef32ea573d1314b73c
SSDEEP 3072:6KL1F5l5RuoAcXT7UfMZceNBk9/9BmrtLob8tFi:6KnyHcXbfouF
TLSH
T15CF38D2175E1C8F3E3A716310DF8A775A2B9FC610F328B975348DA1D6D36981863A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.cpl

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.cpl
Size 2.3MB
SHA256 812e98af4f70a2391ec6734bddd7f136737e44ca7eaf9739b33ab059e5850991
MD5 aa956b4949a9c5d9b3c784bb4894d8d1
SHA1 affe5f9bf93b90014fc358263b3359aab5436b0b
SHA512 07e01e8c7c1e85905632f31503b2a73795ea618c7e82aa326fc3d0a6b59e44ca5491442c9a2db1449538e4917a639baa43fc333a300823b984bb8edcbd6a8a6f
SSDEEP 49152:58CaAoAf5Bo0nJZca/8GcKPT9DUN57Hz:Msc48B7Hz
TLSH
T119B53705BF28C0A6E065833ACA22C6F4E1717C54DB604AEF6295BF6F3E732D1593A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lbr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lbr
Size 818KB
SHA256 e6ec6d4a4ea03ac77f2412ae6f8afbc908f61577b3c96ae97de51033f6ed7d48
MD5 b10f8ced7b3e9975f065e08b04712ffa
SHA1 c6f74b00568fa8d0c7963da1235d36459c017acb
SHA512 970a0c51dcb3cfd90ae633e868aa1ee109aa176b9572f8bce6363990455b07ff59b304271c9beb4ed47da36b14242bd64962500a5ca2ffc00f376b047ea966c8
SSDEEP 6144:NemspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKxvqdm:U5VnVHPO8ZVHPO80lKvQS6AJxqc
TLSH
T16C05B4417F58D0CBF8690672DF2AD0F42852BC98DBA0857F71E4BF6E79722114D8AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lcn

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lcn
Size 800KB
SHA256 0b219d0f11056fc8b819ab9c3463ca5d3ba5728afaa8a09822637ceb6478e80b
MD5 7a6b7d6cdd75c66fa529c79631a66871
SHA1 beb00006b1c0729955c22fc78beb14ba12672806
SHA512 a93f5ac8eceb78e0bf4b7784a31417542a5b5a2d2417def82616130a2176b3a749d7dc59d7b261c1fa2dce72194635897d86265b6147f0a53eecc36e7ade64c7
SSDEEP 6144:CHKmspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKc:r5VnVHPO8ZVHPO80lKvQS6AJ
TLSH
T1BB05B4427F04D0CBF9684672DF1AD0F42451BC98DB9049BFB1E5FF6E79B22110E8AA49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lde

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lde
Size 818KB
SHA256 bb34caced05ea4b38928a8e4f2d755dda22abdeddd241f351c089b1e472b8158
MD5 f12c62761f95d3c2204fae5b28ee60ec
SHA1 f4a0ada781eddaee66b9dff0020cbd49cca39853
SHA512 c33fcb79f2cae69d038533cbcfe616ff9e909042ae829e1fe9f519760c871028f5b9a4264b9c925d9c11b4e9565dd985313a2a603450d96cd4892c094fa79cf6
SSDEEP 6144:o8mspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKP:b5VnVHPO8ZVHPO80lKvQS6AJ
TLSH
T1E505C4417F44D0CBF9690772DF2AC0F42851BC99EBA0897F71E4BF6E79722114E86A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.les

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.les
Size 818KB
SHA256 a5413aab630dcbb12e1b74d32932deea00a069eb71a72bcd5605e7de9d09238b
MD5 387d3a8c2ad676775e6ab0231d38f03a
SHA1 6c31c1304cc677c6932189117e98d339ffb97327
SHA512 df5aeb614392f0fb03be6bfb1203016f84a1e6bc55cc81087e683f866bfe4e9ce7524659222dff6b88e1024ab41a8e72bb053530ef09c6637e19ad4f1a2d7316
SSDEEP 6144:rMbmspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKNP/s:ob5VnVHPO8ZVHPO80lKvQS6AJNP
TLSH
T14005A3417F58D0C7F8690672DF2AD0F42851BC98DBA0857F71E4BF6E79B22114E8AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lfr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lfr
Size 820KB
SHA256 54a25f32bf26db75f6d2b42cfd8f5582ac000b1dca29085420147c5bdb87621c
MD5 a1c65daef611f2d2c63ab2e79a51ff43
SHA1 d3aa5568da63c2dfd616b1b281b01327a004cf33
SHA512 56f96455af46de8e292558aeba81a98a329c42a19eb76296f8a3b4565ddb7d102fd42c38c29a9a4f090bd79757f394020c7b694cf8025576b55bc9c180732f97
SSDEEP 6144:6ZmspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKv:M5VnVHPO8ZVHPO80lKvQS6AJ
TLSH
T14805C5417F48D0CBF9690672DF2AC0F42852BC99DBA0857F71E4BF5E79722114E8AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lhu

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lhu
Size 816KB
SHA256 ead211c0e9a5f60005f3496361f727151f48b86f6847604ff43607f4067054e4
MD5 376963d21e3e2d5535895bf51d431dec
SHA1 8a227958ad1ec92738133d1d84e3b615d40887e3
SHA512 3c27bf602fd05581f9b2f3cc10301ff0f532585473a8cc43293916486a0223573143aaf56e8c39bf0a7965a29ef83f071abbbe165901ece2838ac4b7c09d90d6
SSDEEP 6144:PvUmspjvnELAHPO8ZELAHPO80lKvQFb0CbAmK2/X:05VnVHPO8ZVHPO80lKvQS6AJU
TLSH
T17F05B3417F48D0CBF8694672DF2AC1F42451BC98EBA0857FB1E4BF5E79722114E8AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.lit

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.lit
Size 817KB
SHA256 89f588e9e6addc3a28d0173b215c55891de7a1d4365043b29bda3c42be315de3
MD5 ff9728c9d678d238437b1089300661d3
SHA1 4e5b354c1a89973b50f07b68e571bca698265c97
SHA512 d3023939aab022f04a0a1bc5f4e416b8cee0594015b3a53999405962abbd69e8829b96b729210791f9632fca32c6917b8dc475e1e1d50ce8d7875b1ac64b4549
SSDEEP 6144:wemspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKbx:p5VnVHPO8ZVHPO80lKvQS6AJ
TLSH
T1FD05B4417F58D0CBF8690672DF2AC0F42851BC98EBA0857F71E5BF6E79722114E86B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKe64.ljp

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKe64.ljp
Size 808KB
SHA256 9c47b13dbc4d13a6b150d139535eb787a712d289e2d8bcdfd869777096416be4
MD5 d1861d4cb62ed7a9f1a29eb448ad1306
SHA1 538673c373c80a8bf0412f57834101aee85d8dfe
SHA512 240e76730839c2a8db787a1330b012438bd810a9758d90459b3aef58b61b3f4762ee57929573b0a59313d601250f2af7c1c0208d29cd598973e8a9499d34edc5
SSDEEP 6144:7mspjvnELAHPO8ZELAHPO80lKvQFb0CbAmKFt:75VnVHPO8ZVHPO80lKvQS6AJz
TLSH
T1ED05B3417F04D0CBF9694672DF1AD0F42491BC98DB90497FB1E5FF6EB9B22110E8AA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuKey64.sys

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuKey64.sys
Size 100KB
SHA256 0a28fc8b67af8ac834b07820398a0d5fbe89c7639ff6c6ac7e48f99544e3f43e
MD5 f27bd4135954690b9c2c24258caca933
SHA1 ef8e83c27233c30ee6c485c6c714dbf284389993
SHA512 c64d387ea5e9712b1c9e36e89d20739164c0f6daeffdeda3d509c290fec826c25a732974728bac72f2bc56950d52a139cef664cec16700db97f5964440a0e612
SSDEEP 1536:GDMzrTRK8+ckjwPy+Ev8OVVo3VTc80UyVbcR1hRqGvml74vwXzHSWifL:+ao8+quAc8ZWAR1CGK74OjSXL
TLSH
T1BCA37D86E29511F8D567C2F8C5B6565BF2B2B0190B1057CF93648BA65E23FF62E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuShellExt64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuShellExt64.dll
Size 721KB
SHA256 20cbd2994ac58e87274e833d29bcfd1798b94393fdaeb5bb67408e671f6ad772
MD5 6fda1eeb53389a6fbb1259713e6d7976
SHA1 b75748bfebd82ace164290d231dfbf034fe87d3f
SHA512 046113fe606c901fc9855eceaa50259e5e29ca4402118422e72c34a4a3a545e9819d143685d3a5b6b814be75abdcc476202f1194f14612e70962a97f5270949c
SSDEEP 12288:de7xZ3HhEXSsZ8uQ0lo+dJgKdZZI9PuSXXJGo/Ju7lg8m2Eq7Dmz:dExZ3aXB6uQ0lo+7BEXJGoxuhg8+
TLSH
T12DF44A5AF7384171D056C27FCA93D656E3B278015B304BCB13929B6A1F336E99A3B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuXpm4J32.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuXpm4J32.dll
Size 348KB
SHA256 991a0831122e57ca5295976c5d7ec9191b1ddef88aeec3ac418dc2094b1b7206
MD5 1030c0c322eae96e2276d58e62f59380
SHA1 5b315c888fec2f4a32bb8066e5a8033696e7be77
SHA512 00d48424d7a155f2d23c17cdd3a103ca6aad403421caf86ddc21dbca70fa3c42a190dd9fc18a4faf5b7dcbbf2a679f4b9e9d1c4a33ffcadb58b69faabe4e2f91
SSDEEP 6144:HYp/smo32XxfKa1iFxIKE92Hd7EA60P0ATzTgGxd6Pw34o9TBrXqqDLu/0:HYp/smo32XIa1izIKH7EgcIAPw34o9TC
TLSH
T122748C03F786C0B2D9571376047687390A3EBA641B748AC7F79A0B6EAD306D19D3538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WibuXpm4J64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WibuXpm4J64.dll
Size 441KB
SHA256 f54b28dd94778c623801ea1c1e6ccae96f716c3d05fa6ccfd88e6b0509ad0557
MD5 7a7746b20d82ca5b69f4cbdd9b79d0be
SHA1 012d2657249ef6c1fb77cb3e16f011c425b2a6c9
SHA512 efffdc9b2dde6dd4e1bd1a90b1659b6fafd0e76190d962eb7fce9dd97ac9d4938a8698b8aa184604f687966d6c312b6e955272dd819b72f922ae974cd7fdc969
SSDEEP 12288:SNSsEMEfyDy1SE68YPwPum89TXBCqnuXg:S4sEMVDy8E68AMuH9TXg+uXg
TLSH
T125A45B1DF7744075D063927EC9A29756E3B174891B708BCB1259872A2F33BE8D93E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wibukey.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\Wibukey.dll
Size 539KB
SHA256 11882651bf9d06afbd22e4c24e3a249dea902eb3c4d4d03acae2a67ec54efe84
MD5 774c93e5700743dbd0ea080aa3dfe7a0
SHA1 bc5fb3e8ea0c8720112f53ab959b2cc8936876da
SHA512 3902d744f07196ec6403cdceccebb961db2d6afcd81b14fc3c06d7ee2e8da7a94bdb5260d92b250d2513b347c56279c27587dc10f78b231110d0cd4ba5b01c8a
SSDEEP 6144:FJg/mLLHhSYsSk8WDBu2KEhvZwDvuLXjcR+7FthnQo7G2z3yH2RLn5PgG2z3yH2Z:FrZsSVUmvkEMCV2RtV2RX
TLSH
T100C45B13F780C1B2C04B0235C91BD7A917B5F2548F3962CBB3CA475DAF356E1A63A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wibukey2_64.sys

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\Wibukey2_64.sys
Size 16KB
SHA256 b32cfc5992fb390c1192979a02a03a2e166b4788f6c10ab3052b33b028805a27
MD5 9b33bd737b6620e5dcd4909eff719216
SHA1 730dad67b33c26013dfd468a77a45196b2cecae1
SHA512 69f95a257b25fb66c41c54a7cc7688c2144c572c19e906fc22062df3efe3e40132482fdf0b1e7e6113d20e578d92061de1d58036b102893bdbf38d92287a8a25
SSDEEP 192:Ck3yV2PIG94wK1HtAUcH1rCydWuhh0mhUboj9TViWp0:rN4905CydWe0mhU8j9TE40
TLSH
T19272D842D3E4C9D9E1B7C17589B90F9AF625B4019336E6CF165084161E22FE0EA7F3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wibukey64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\Wibukey64.dll
Size 661KB
SHA256 b0b7cc484324ba6840ecdf43a9df7bd4fc7754ab9b93754e04ceae3cfce161f0
MD5 c31d91089ed8260858e6c0f70535b055
SHA1 de70e1e57a799a4ad10614b762efb121200dd938
SHA512 6a31421f9b73dbded1952cf8cf9f08bd6d1fac11c809da3dce7bd5d5751db9d2431b0ea33f477cd046a07313deef072b7d8feba7ac2d1d7cfc139fa26590f063
SSDEEP 12288:ZEhp6HvET0cs7zH/nXpt9yUIzyDJV71V2R0V2R:o8HvHcsPHxt9yU5DJV71b
TLSH
T190E43A05F7548AB2D04A9238C917A786D771B0895F31A38B6399C32E6F333E1693F365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkExt32.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkExt32.dll
Size 326KB
SHA256 90d5ecd2d8dc664c3c43dec38d6c2852087a38afc331458e33ceb3498c26f57c
MD5 2619ab560706c7475c8b63676b6a571b
SHA1 c4af6584971218aac5b606eca5d505fd3b910151
SHA512 1122fdd7a9efd68aba3558fce61de03cb2c0bee1c9383ca05e22dc374ea8e4f1e19629ef85d0d12180b0a32bf56520e731f1f89e2ac1b2b6cf5b9964e42cadef
SSDEEP 3072:bvhKBiFi0miegMWxCEI8nrLSEjN1PLV8cvoCUxhknKG4/t+J+zuGM8cAxIPD5fsa:NKIVzx/TnrLFjNTvoCEkK//HzuwO8
TLSH
T10C647C03FBC6C132DA471775043A9379193EB9550BB08AC7F7CA0B2E5E262D2AD3535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkExt64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkExt64.dll
Size 408KB
SHA256 b58fbdab248c5c48bec4a4770c561b3ee4cab5fe175a9aa7dc62f9295a67c08d
MD5 46f3c3ad1a76cd9b5e8b70ce3554f5c2
SHA1 366c8f5ec34aefd970f317d41adbfdc55bdd2c8a
SHA512 f1661bb901c77edcc61f5a8494b54fc509badd965f67dbec6e4a21ce41c99b0a63087c7a549be89e5af52e086e70d412bbc2ca8de0931ce1cdff60423c6fc843
SSDEEP 6144:4aQwk3P4zQpMz6bUrxA3E0KPiie4Fo0KNbxCjDpjuuL8N:4aQwk3P4z8qQ9kixhuDpjg
TLSH
T1E1945B1BFB654075D063D23ECAA29746E272744D5B316BCB1352872F2E337D5983A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkStartCpl64.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkStartCpl64.exe
Size 273KB
SHA256 4ce8576f349f903289b128d3dd937dcf37232ae585e75263b6cf44fff821e339
MD5 bb1bcb5039d654ad68b0a967c73dec36
SHA1 7186ea7b48621ce36446f7609e21b8991e1a7ca0
SHA512 3fe7e92f0ddb8a8c6877e2b4111dc3b92434b33ed6f1a6684524af60befe4b1e6d7d5fbd22e6b2b0c26e54f6aeb0cfc9ef5fe86c4a87248c4d6ba42ec7e254e6
SSDEEP 6144:PGGhPKrP6Ft229eKuDL5k0D3hjmfR115ebprKJvqsem:PGGhPKrP6S/KunC0fprAe
TLSH
T1FA542949BB688CF1D867817E89829645E2B278155B71C7CF2361876F1F336E19C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvCtrl.dll
Size 252KB
SHA256 df1270073f67d6c5cb0115c5d8ca8ce2372a321782f815ee6741250e9f3207ff
MD5 64f37bd2a66506faadb778504d1665de
SHA1 4331387eb91e4038db2324b7cd4236b41218962d
SHA512 4f31c746d1383b5ced6234aa12c2c5bc01d5a1f2edb604856092c9e7d843860de81a666de0444371737f5bf10c267a715ec14c3071e5b40c89b4a48645b87dd6
SSDEEP 3072:kKJrcCrOV0cEUT6HO6Nw7+l2nWAiTFLW5o59I7Ovvtyw:nr7OV/EUmuh5WAiTFK5AIa
TLSH
T121448D127792C072DA470779882BC779267ABC244B7486C7B7892BAE5F313D2CD3531A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr.exe
Size 5.5MB
SHA256 4fe96754e2044cad3243a73243e168760d7b5d786190590d2bf9720860215e0c
MD5 65a17bcaf3cee4c0a771f3b84cb24e30
SHA1 6c9b3ffa7e7ba47a9ecddb0f9dafe2d19e6dff98
SHA512 574687d8f82520ef0cc29cd81befe1dcb7736d0ddccd0fa4f92864dae9607d2be4de95243ae6a919f4ef10e29db14ed4cd1f3ccd511c9a630a44fe51390bb93f
SSDEEP 49152:gmjYXNuEGVGO9BcE8c0tA2UbeD+xHUeGFBUdWlmDybCKyiwVPXiYWmtK5T1uPtKf:gcRVG1ZD9aWEWpIVPyYWmcvQKFdu9c3
TLSH
T155468D81FBCB81F6CAD721B2116B932F96359B4683241AE7E35C6E179D313D1BC39209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMgr_de.qm

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr_de.qm
Size 3KB
SHA256 43d1c3d1277266773fab0851614395623f5c7ed0c150385e999adfad19683984
MD5 3300a02892171d26abb2efd53df3d11f
SHA1 2b99958d518376093cc7914f01a9934cad2f73f0
SHA512 70bcf44c3a398846c404240bd42dffd816a6cd3b7819b4996072d5fc5b4a4020eea4cc81b7d3ec39e8ed79f1cc182d5ff343c47a84e56d10dbc458b417f672e7
TLSH
T1D8515C12A3E0853DFAA58BBE6CB2622E0B713C637CB1C65F1B14B0F900744509F67B66
MD5 SHA1 SHA512 TLSH

Submit Download

WkSvMgr_es.qm

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr_es.qm
Size 2KB
SHA256 79c1e24cdc7a6f534270c5cfa88e35ad099ac2bb1b85a657037b21254e13db8d
MD5 6a7043e27c527563e241bd7e00865e78
SHA1 420c8baf97eab1a30d5ccd973c8058d67cd2e5a3
SHA512 fa64b1ff5fe028bed9bfbd2e7cb1b314168f436dd8b9f06593e0e3855669a18b1611c1c0234d7999af9482cdfb10121aac7fe9cdb0084532568a40e15811a8db
TLSH
T19B515A51A3F4853DFAA58BBE6DB2A22E1B7138537CB1C25F1B24B0F900750609F17B56
MD5 SHA1 SHA512 TLSH

Submit Download

WkSvMgr_hu.qm

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr_hu.qm
Size 16B
SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
MD5 bcebcf42735c6849bdecbb77451021dd
SHA1 4884fd9af6890647b7af1aefa57f38cca49ad899
SHA512 f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
MD5 SHA1 SHA512

Submit Download

WkSvMgr_ja.qm

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr_ja.qm
Size 2KB
SHA256 6796c2daf3f3770deb6c4880e8e38731f7d1fec9ac3343d1a9e9bd3a9d77f826
MD5 0c92268fb54d1300dc5b0002b51c72d1
SHA1 01addb948e2523e69ace757d58d1abf6d43321e9
SHA512 35508f234bc3d075fda68fcac2af4ceeb7521445a742daece340ed4109e57aae1beb60230424dc45a492f4f63f6a7515221d73bc9c5eb9fbaca955bbb7f9fa47
TLSH
T12D511358A2F0993DED440DBF9983322F9B333413AC7185A71728F0F5805C8E51B4BAA7
MD5 SHA1 SHA512 TLSH

Submit Download

WkSvMgr_zh.qm

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMgr_zh.qm
Size 2KB
SHA256 9fec3422cf89a4dd14718d267b88a1751d916f6d550fb2576fb20d518b0e4cac
MD5 9dd8e9ae0f52ab1c831113a2bfea6ee8
SHA1 fba295c98017a529cb350b056aaa1c2f21f48d74
SHA512 66609eb5987786c5b1e1196eba0918ecc57444999b1ba1fd532448c058dd5695b1723440a9109caf6f8ea615c00c12d69a12915b68f7236b2404c7f61ddc5ad4
TLSH
T12C41BB6AA1A9883ADF454ABF6DE3777B07B024233C7185672B25F2F1508C4605F1BE87
MD5 SHA1 SHA512 TLSH

Submit Download

WkSvMon.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.exe
Size 351KB
SHA256 52c2d9a0c2bffafb94774334f62b52ef9cf76930ccb7fe1ee6bdbf5cf9499c0d
MD5 0a3be0982da917af4dabf824373b6873
SHA1 b2b2e57939729d1f50680d2857e5e102348bf648
SHA512 a508c7fbaac28fba8222bcde767b15f584c8f57dbb835f6994f47dc958bbe4903b4739486821adc1898db4fc23c382770d8e743438432ab6bcd007c0d3cea7d7
SSDEEP 6144:/10s+qqYZ2X8PApsHKlmLOYqSfdjdei8ApgtlVq/ZFiNtPcc/thNgN4Y05uIutTp:d2Xc2tlciPxmN4Y00Tp
TLSH
T126748E0177D5C031D66226314AB3C73966BEBD616F3097CB77803A2E6E342D2AD3875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lbr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lbr
Size 42KB
SHA256 51bc1ae4c5b6cb650c1f4de95f45fbaaa34e21e7a7dbb3dcfd6503775364d137
MD5 8a710fcccb851b63456260eb66f01b55
SHA1 cfc4537d661e2c40d7c6db53fe6da22c2100832b
SHA512 acaaf78131b3530a0c77b57bfe4392d7a07b5af90e4410be86115e5cddcafe358297c869531305e7c2a40212ac13a07db86b301835c8d0b72d049d75100e7cf9
SSDEEP 768:A3wZ2dk4NdBVOWOkGi72TmpQ1Sc1UMyBoAet:AgZ2audfOWOk3K4o
TLSH
T12713EB4263F88248F5FB6F3549B68B654A337C92AC39C62E1650B25F6C70B40DE2573B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lcn

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lcn
Size 36KB
SHA256 aa6d03428175652e995675c8ae7e87312340e6a5752991e432aaef708580b34f
MD5 fe00160c6d769ba38ad55e0a93c226df
SHA1 59ebfe74359adde5795a343ed889ffdd1c47438c
SHA512 13ec63858f0574b986c9ea287e69c3565aff2b865aabba2366e2f3fdd159bae0337d9130298c70be10ebab15c5349b2080ef9017a60a433b16d108d4ab8de972
SSDEEP 768:i3wgPk4NdBVOWOkGvmnYMPiS/4JELH1aPYVott:iggsudfOWOkHma4go
TLSH
T1C5F2750263E8C659E0AD033449B78B651B32BC95AD358F3F6690FB5E7D30710AE15B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lde

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lde
Size 42KB
SHA256 2ff5f7716327525e98f5c386fb14893ef20a8ba873efda60e60da638bc5fad9c
MD5 ccefbc9d9cdc635dbfe9db8067f3ae25
SHA1 cc9595ac322aa0646b2b303b3225595f225ed16d
SHA512 8fe82f95d38ba7243b2f8bb494278bb5c4cb9a35536fa856cd450e62d5a75c919d80c3a2523f549441d04d3873dc5cced6cb3d5adc29ec047915b449cb4951bd
SSDEEP 768:M3wJxk4NdBVOWOkGF5/fTBF3BuRGailcE+LULafJoG4OEjt:MgJ+udfOWOkMVVERGaO+qUoyE
TLSH
T1E113010263E8C658F1FA5B345DB787641F23BCA1AD35C72F1650B68E6870B00DE25B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.les

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.les
Size 42KB
SHA256 247ad3cc88ed3429e2aecd0d61f32ba1da5513e90dc982df7ebb59eec0fd5617
MD5 e8168a287595cf91e59347f2a10b1743
SHA1 30a3696f3ee10c692e761643a912b37798888dfc
SHA512 45e6df04877409d6dfc0bfd6137339edba04f523441273690229a58573fdbb4e00020c82df777ce05c5da79751bbbc7a400d3508f230c1aa41fecc978165afdf
SSDEEP 768:E3wOhMk4NdBVOWOkGosCZxNDrQchGcOoo5mmYiHt:EgMLudfOWOkXvRo5mmYi
TLSH
T18E130E0167F89645F0FB5B3459B68BA44E33BC91EC39862E5750B24E6C70B40EE25B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lfr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lfr
Size 43KB
SHA256 1c00877253e34576214858454b302536361727c4786ed29cb85ebf7af2f415df
MD5 287b30dc6f5717a33c07840b1e30501a
SHA1 79e3eb01a06e24adb2aea6579b9f4a44e6a9b91f
SHA512 00d87105769625f0f1fbe6659f420dc03b1ceac0c85f2148d338c53d84667089bbe446f0596834c1ef83a492c305124f077012517f4c6ab6f778499f97c06369
SSDEEP 384:b3wo0wk44g911BDZOPhEOPh1gMCHCdqfbg8BA4Ozp/G+NVfFRRInZeZ3fHoUe4n7:b3woBk4NdBVOWOkGsg7RvNR2Z+fo5Ct
TLSH
T14213DD0163E89645F6FA3B3498BA4B640F377C979C39C62E1A50B54E6C70F40DE2972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lhu

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lhu
Size 41KB
SHA256 013970f8e3d9ffb7a046e9f41c90436eeb8a6a1e87153a51b1d57ab14c45c368
MD5 62f1273f8219433b768eeb161ce15cfe
SHA1 957a491b620b72cc9c794b71c63ef5fda4d3b55b
SHA512 815c074b1c68dae5ce9f5ba7e7039f3970760ec40984cdb2b7cbbab85c5b3e82c18cb8640edbe68b6dabe22b16fc2f8adafeea8d3d87bc53fd0b40ddf4b2acc1
SSDEEP 768:H3YRk4NdBVOWOkGltHY+67r13p1IRmWCbalk7HgkF1SamahI0wZT2SYSxX8WoOM4:HoeudfOWOkiy+6rbGR6OGgAhI0wZT2SF
TLSH
T1CB13330163ECD655F4FA4B316CB787A50A22FCA1AD39C72F9A50B64D2C30740DE65B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.lit

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.lit
Size 42KB
SHA256 8aed93fe0c2f7aecac9c1c77e819da749124e7db27a7bca2c480f2b6efef70a7
MD5 0f24a2495d8af1e18cbdd3e023e3f18d
SHA1 9830e10a5af890a02bad4f3af4331c7c97dd2a2d
SHA512 fce3e7a6276269f453d5ad353c7283ae62ed4f4d32bc1cb27a9636ef8d4a54445bb090ac35b2bbe8f77b3f3dad63324b904de22ec6c0f93c5847c13f3b50c840
SSDEEP 768:h3phSk4NdBVOWOkG6LTddAqco0uqSeNSkdt:hZ7udfOWOkRvOo0h9
TLSH
T1C013DE0163F88248F5FB6B345D7A8B544E33BCA2AD79C62E1650B54E2C70B50DE61B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvMon.ljp

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvMon.ljp
Size 40KB
SHA256 195c11b90cb7dc0c4a9a0dbb0e603ef5bb9977eb28c7ca39611014fa0ba52e1e
MD5 9b13ff0b58bd71e291ce0d11d7b64611
SHA1 873c9989d617cf316de0be808c0dfa5bf4f9bdf2
SHA512 c59c1540731d9047dadb4dcc66950bbd3b7c8d6a2c39db841f51aac216e7f357601756a5ff7ce4eb8481a4c065d2ae4b424cf4f37bcb64acda528be4de618125
SSDEEP 768:43TYk4NdBVOWOkGRXANFJ/joBTyZwdDxt:4jHudfOWOk2QNF1oBTyu
TLSH
T16E03210373E491D9D1F9423018F387A15B62BC55AE77863B6640F64EADF1B00AE25B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.exe
Size 573KB
SHA256 4c5d0e5aed518da96f97238027d88cfb02d5d694d129903bfdf4ba1b8f1783d7
MD5 ec25ed59540db3d4797795335409fd64
SHA1 e508afaef570ddc140779d7c4d212d104a95f9ca
SHA512 a981e85e881ed3b4c09112636ab96da2bcf36f0158364b148f0d2eaad81019737119374ea2e58d1453e5c5891768bfc95c4f24fc22f7358f218a961e7ec280ae
SSDEEP 12288:aLXmwtxzuh4mQDltCJ0XpIn3LmOq6k/zv4Mh5qXEj:arrx51s3LUxzQMh5Fj
TLSH
T1A4C48D41FBD6C076C99762B2886AC36E3136B95017350EC7E3841F1E6E606F17E3627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lbr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lbr
Size 39KB
SHA256 2ac0e32a5a3d4cf2140a550e02c4b0584b05bb3351781038831602cde4ff78d3
MD5 b42e2baf8ba29e66d7be5d5d47c42166
SHA1 939b44661175a5f88fa953702652fb0de9328581
SHA512 1c31bf40fe82d4c8c9e2feb33f394790a5cf10cde1dc7038abd1bdf757a341f8394aaf77e3af63edc5701b29ed714f405fddacadb3b7c545ea67e3620957d7ba
SSDEEP 384:w0loYgYKJR/3Mqio06uKXGhQzaBQkaDxwRCrt:wYor/3MqX06u6JCQkalnt
TLSH
T154032A4127F89219F9F36F32897A5B715E377C82AC39C10E1250A66E6CB0B40DA79737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lcn

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lcn
Size 33KB
SHA256 4fec59c75f29d7e7c2291066de2f74191a323269220647429a97be4c7a856e63
MD5 dcf38544a3ffb6d3f9d572fd09e95bca
SHA1 6f8b387bf10cf5908d0b4e59bce4b1b752342070
SHA512 1896dfe7e9b69cfa0816c91ccf853981ed0e10593bfc8054bf530ace24c832b6ed7a6f6b2cec47b39f818f01858a17663017816a78cfffd135f887549c2b4293
SSDEEP 384:VFnqRZgYKJR/3Mqio06uKXGh8U2N/SClJaOfIV3t:VxB/3MqX06u662N/VJaZt
TLSH
T1B9E2070063A8959DD27543B08CBB4FB027727C5AD5314F1E62A0FBBE7DB4B50A912B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lde

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lde
Size 39KB
SHA256 6d1d2cd3c9f892230a05a6fd25a371ef0f252f3cf4b28a29e9c84d8b39993cfd
MD5 8666322490e29abe40fd26c682bf4729
SHA1 bdaa022ac63df126b82c94071398b865dac5ae01
SHA512 187fff2c3b2862d2fa5131db16943c6435a93ff140871265db87e69ac358f87ee90c50d95d790ef6bed3f28bb2242542e2ec6c797024101e6001c21d8720a30d
SSDEEP 384:Q28NgYKJR/3Mqio06uKXGhQjs3cajWWGaYMSQMOETth:Q6/3MqX06u6Rs3ca7iOETt
TLSH
T1C403420157E8861CF1F35B30ADB687A02F62BD92AD75D60E1750F59D6CB0B00DE62B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.les

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.les
Size 39KB
SHA256 9305e717cec357111b9ebb06ba20cf1712f776da3569bc105dccce3d109ceb78
MD5 b9112afcf5324f94dfd0b6c8c67d007f
SHA1 c0b790e4d5cb4d04e5862f7d87ebd80973825e5a
SHA512 4ad7115af432aa012b46d399b46d6396aae2625c0bbfa7bfaaf17b496e5175dde9a9327d07658b6f072cfea63554e89f2f2798822f7aeccd18a971c927d047f7
SSDEEP 384:032gYKJR/3Mqio06uKXGhJ6xrQIeGHcWYi7DwMvUUpntii:0R/3MqX06u6rxrQITYiPwMLtP
TLSH
T11A031D002BF99649F4F36B31997A4BA05E36BC92EC39810E5350B65E6CB0B40DE35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lfr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lfr
Size 40KB
SHA256 318fe22d39c330a353e72b34bcff6b91f5cda97f8af166aab1039576e94cc5ec
MD5 03871988ea97c48b12e39b8d2bee8a7a
SHA1 83691fdd822e63c50ae881b55985eefb805fd67d
SHA512 bbb4c16ea6e4e291a80dc9616650f3e018803061e04097e5edf4aea6373002c7625cdf8ebc49092d487b0e35cfa17270a4ef78dc32aa02ab33385faceb26cbcf
SSDEEP 384:3I0rgYKJR/3Mqio06uKXGhI6nbx8KRJ10AM4nkhc2f1vqwVSSe4wViAoWpX9R1By:318/3MqX06u6ylRJ1R3/t
TLSH
T1B613EA1063E89616F6F27B30ACBA4A601F777C87DD35C22E1690A94D6CB1F00DE69736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lhu

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lhu
Size 38KB
SHA256 7356b680ccb4244b721679d3800cd2639a87f4ecff9d1dbc3caba103201c2b94
MD5 78db7ba605d5104d197972874b5433fa
SHA1 9ad8fa8b905a3b5d02d420b9f13853754db1ebf7
SHA512 4b12f52b1270a33651b38d5ffbbd3528384bb19b905ea0a37c725a27c6419d4d8a96bda081f88a5a650d91d955342dbfd9fd659339408ddc94fe7bdc3cea3432
SSDEEP 768:Xd1t/3MqX06u6Oh6naasMEIEV/Behj1tJRF1SVGVLetM:t1t/8qXlu+aasvIEV/e/kQL
TLSH
T10003200167EC955AF4F38F316CB68BE01A32BCA2AD79C20E9640F54D6CB1740DE65B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.lit

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.lit
Size 39KB
SHA256 e679d1633d5f69482dac85a9390c41dfdf392e46039326b4f95599a284c37ece
MD5 0c39280675e928a2e1bf3c024713947a
SHA1 5e728f06469e283f82637a1df52fdcd2ff4d89b3
SHA512 23ac691e2f775cee3a4a86de7d5506b160e6dd325987db205129c39b2331896229df1f1cf55817fa830737239b127b7604217197267591075800a884f5defdc7
SSDEEP 384:haeQgYKJR/3Mqio06uKXGhPKJk1zkNW/aO6wJAk3/sLt:hdj/3MqX06u6X6z3akKkYt
TLSH
T1A5031A0167F89618F4F37B30AC7A8BA01E367C92AC75C21E1251A55E6CB1B50DEB1B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkSvW32.ljp

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkSvW32.ljp
Size 35KB
SHA256 ac7e2aa9f361de842e70518b4b0a61ce57c8569711cb1d6086be33d0afd4e892
MD5 58e6bbb4be5c6c1128fcda66033696a5
SHA1 da984f782b2845b7eaccd9799e2be79d841dbb48
SHA512 d7931a49881c3f190e8ecea60185c69a8980fcae27e5df61ef94a9ac3895b4d2d9ff5169956aaa6ab647e0794b4cfd9dac2877d5dd53e8f2788fdc47216f2eac
SSDEEP 384:mBTJ5gYKJR/3Mqio06uKXGh6h/CQWTID1gAdaDAyt:O6/3MqX06u61/CQWTO1gAdaDht
TLSH
T1A0F2C70832E5C959E0B2C7708C779BF02BB1BC1599B1452A27C1F91FACB1785AB15B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.dll
Size 147KB
SHA256 f1ea119815f98941120a14cd6a565135004638c506e747e5a4e17346e763c678
MD5 1a373470714feb51b916e97315cf2962
SHA1 e9eebf9a70e55822ca6c930c0eed0207b0dd32ee
SHA512 513517b50ec49140a551b0f7431f35417d406e2bb00345c1bd9578a3c52514bbd6bd0f9bfea8e92f0bca37195ee3ede15b6f07739ba6a9f2fd04ba7d8bf7533c
SSDEEP 3072:KI37jr5cEarpBF4i3cDnom/NqHOqCSL5nRdCse5DjYD:3ntcEartz3yoUNzbseBj
TLSH
T143E36C60BBC081B1E4A667341176A7615F7B7E305739CACF7B50266A4E303C26E3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lbr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lbr
Size 21KB
SHA256 e5041ddd3b2b4cb2c3e41a44f2dcf1d6f162407705d0af558f6a746946a7a11b
MD5 7853984f51e5c0f31aa432a5d4b22df7
SHA1 9fa185620e0ab066a549403e34b25090a87ac37c
SHA512 e66692a88fe857db24ff09652a831e24bb374b10f71473673eb08fe261a723eaca44091c2d38415a8c345290d37f56ca019cfb3e0c02f3045fdc160de78a4943
SSDEEP 192:niPLQKtq5zxG4hsdZPoxUYArRXWAgjWyXWU8WsvTB0R:nijmpxG4xytG1jWcWPWsG
TLSH
T16DA222426BFC1219F6F36F3658BA5A758D377D92AC39810D1240B25E2CB0B80DE69773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lcn

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lcn
Size 15KB
SHA256 9747c75baaad041c06835cb17a41e5994265c6969843ff02bf5c2edecb8b7e22
MD5 693352a6650cd656fc93439150d5c6b3
SHA1 7c577c65fa9a1892d62234782d4438b3c5b57f88
SHA512 1057b97f317d1606deb1da709bb8edb498803ec3c54030f2bca6455f02e31de865c38f11f60f83a32224388331b6d67d62e6a9b48cfd5de07414afe6b8014f07
SSDEEP 192:1iPIQKtDrwWUPxtUuJTMrRfTvA/fWgQ6fl:1iwPsWUPxXwtfTvA/Z
TLSH
T1D062B649A7D8552ED251C3B048E7C6755273BC55A8324E0E3AD0F7AF3D74218AE01BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lde

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lde
Size 22KB
SHA256 b7228f262473eb0d40531d810c6743cb6707b19854d621d4aab33083229b29c2
MD5 b50b2a8c55317d76093cc742fecea1f1
SHA1 8414848affa3dac6c62d32c4abf551cb19771b6e
SHA512 adfb6bbc5c28047beb2c6520592d3840c96dc8f454b4840b5afeb5c3dbbf616facd55aa7716295a2679d96fc82404d7b99cd03b08ab59b7c42ec7e4cf269ed4b
SSDEEP 384:AiHoEIOHiqPGbltXhwBGdVBWO0FRRKdM:AixIOH/4tX5
TLSH
T19FA286015BE8862CF2F26F30ADB593646F63FDD2BD35D64D1640B29D2870A00DE69B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.les

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.les
Size 21KB
SHA256 e7aa961e09990be7072df37a2eb8b1c453cde846d72fb9b6e4f4aca0739f7272
MD5 19dd1913646e03abeaebb0f0fc79289a
SHA1 401e141ed0ff9f1064559d65e317b24004217575
SHA512 d72b5e6f1e46f37dccd8acdbba48122e1da455ea6b68a568f1c1b994cded2743de9ffe52b7c6aefd5b40067b3675d39fe1126879d01932710097ddd0332c8762
SSDEEP 192:PiPFGEQKtVdUActEbnzKzOUncWYiGrRS+bImaRZNlom6aAIu:PiNGEZ+JibzKfcWYiGtLbvM5n6/v
TLSH
T163A201002BF9570AF1F36B35A8BA4A644D3BBD91AC39854D5350B25E2CB0F44DE29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lfr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lfr
Size 21KB
SHA256 0304956a3de4ba9d3f5a929e4304ec9ff6352875aae23ebf3d3852be889920e1
MD5 d0ca1e685a091548853c8a582a5820ab
SHA1 8f6ee9c6c5ca30c6c5179aa1c28a3a797d3dfc81
SHA512 b52ea23bb4192f39d5b9eec6b89c9661ca2a4c90434a9f0e9a586be701f7ee77002e5319774bf66987f2dcdac4e0279df6e0385ed49b42b5a9c1ca14cae453d8
SSDEEP 384:h9iyWUQgvuxeq2f1vqwVSSe4wViJtp45JnFE7L1cx:Xi0H2x0t6
TLSH
T1B9A2201077E8660AF2F27F31A8BA46644E3B7C86DD35C21D1680B28E2C71B54DD79B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lhu

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lhu
Size 20KB
SHA256 8f74396b2e0d57c03ee53e764f6d786774e5ddd55aeb4b9211f13c74dae586b9
MD5 e59cfb23836185523e79f523502d9d5f
SHA1 bb88f4e876df972716f2a4cbb3eefac746f5686c
SHA512 f49ddd0dd8d52538025a66281fb499f8be5296bac952726b06a60732840dcbe12ba2ef9cecf3aeed7cb2f777c9a30fc4fe9711260ce05e84ed8fff0afe8ef23e
SSDEEP 384:ii9fu1/OSHHM/F/PJj1tostSMbhkQlrSBz8s7PazxY7xTPz9uRzp1Z:ii9O/OSnM/F/PJj1tostSM+QhSBzVaz3
TLSH
T18F925A016BED665AF1F38B316DB187B90926FDA1F938C20E5540F24D2C71244DEA8FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.lit

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.lit
Size 21KB
SHA256 67ad9637d2098bdc90e4de778359ad53e409c195930c7260f4eff7d91edda98a
MD5 c2880766213db669cccafe4e3c9e6ffc
SHA1 16f5b4426c2935cba4cc50be16b34f2968423b18
SHA512 0161a76daddc59df639bd19516faf9edcc9654a3341407c9efbc029453904120513540a878f131a07788a5699899f1a55f9109fc25eceb73c0b701cee66eca3c
SSDEEP 192:yiP5zQKtARgEEiKjiG1LnCcZU1jskrRBtCdaBDhmGcYOepRxdO9/B:yiRzsZEiKjiAj0ltegBDhvpo9
TLSH
T182A224116BFD5209F2F37B34A9794A344E3BBD92AD39C20D1280B25D2870A54DDB9B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin32.ljp

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin32.ljp
Size 20KB
SHA256 da2c8a92506681447b028719bd5d8f1bc938145486fe2a5bbf1c9e6bf888405b
MD5 2d2379cd1e41f39afcc2d26d3ab0355c
SHA1 610eeb86e9dca6e28f0198b542cde38fdb063d12
SHA512 9aee9927286d264e357a3f6f62c20437d1dba5c1363c5ed89709824b5485a9f06415b4187a0dfb8304cf42b52e1845a1717f563110e15b979ade99b58e30f800
SSDEEP 192:CiPHQKt++7GIYpuw9yMGUNcU+UmwaakrRIXoPyNM3JhWyPls0XnapXI/RA1E+ZT:Civa/IYpubltIXoPy+37ll9yTG
TLSH
T1D7929A037BF451DAF1F26A3058F703205A367D99AD7B861E2280F24E69F1A009D7576B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.dll
Size 166KB
SHA256 f4609a06222cfbe5c5991300b86297275cfdc607cc3d719042903af4fe49f42a
MD5 e01eafced2a75725363d6e4f9e7843f6
SHA1 174e52bda4ee931df13024659cb518ae795e84f9
SHA512 bf3d12c0cda8c4924386ecd42925fd0db2d7752b961c76fad9d37363bcf94384c59812f44dc29173b1167504f9485303082f5318797f989dc126b113ba2ea044
SSDEEP 3072:OQ8E26BKgDZj6tLkSbu/HxWQticTE75OPkKu2/Ss5rR0eX5:lnKgQZkSiDcc6WkKyI
TLSH
T1D7F34A45B2A000B9E4B79379C8B6565AEBB27C45273483CF475097AA1F337E2AE3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.lcn

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.lcn
Size 15KB
SHA256 a033f168ac76dcd5bcd16080f453a66ab511fb140d6eb2c1770cf0b9f97a0157
MD5 617593b10700422ebedba986ce365eaa
SHA1 9daf8d5ac4ff631c1c4918229de2b08b8fa7c952
SHA512 2153f2fd35056a71987d351bc27266f2698c39cd603f3c6ee9b7dd6f43805fd42ad128833997b88c465b800b14435697a77c50283f48a091c262d7c54b1bb7e4
SSDEEP 192:vzPIQKtDrw2UPRtUuJTMrRfTvA/fWgQ6fl:vzwPs2UPRXwtfTvA/Z
TLSH
T1D062B748A7C8952ED25183B048E7C6756373BC55A8324E1E7690F7AF3D70218AE01BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.lde

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.lde
Size 22KB
SHA256 90abf9a507fd75bc6e80a1050b580da52280cb804d9a9facdc09188155cae4fd
MD5 dffcc3d5b10ca7beb9ffe427b1f6a794
SHA1 f66a967451234a496f95b9e0b020cabb38578e50
SHA512 4f18de2f71937f336fa78c75143a2432e976adfa19cffc24c8b2b1ddf993076edcff3e7360e6c64f9499dbfbbd8869ed48d0f637a8fed550d112f967f02f54a6
SSDEEP 384:jzHoEIuHCqPGbltXhwBGdVBWO0FRRKdM:jzxIuHf4tX5
TLSH
T1D6A275015BE8862CF2F26F30ADB593646F63FDD2BD35D64D1640B29D2870A00DE69B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.les

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.les
Size 21KB
SHA256 f1c69b48416d3f79ed7f897ccc28e4666e97fee1939f2235a6f168d990183ca5
MD5 1627bd8eb6ef1189add711890de26dee
SHA1 eb37b88498c52391296fbb18ef286b03898676eb
SHA512 a94583a69090dcf4e3cc8e33fca1034e8c4eac834fad162098fa59dd06d33714dd196e9ac81d310a9a4a2b63b6c0716e8a4e036339b9301e7648bd9876a30945
SSDEEP 192:9zPFGEQKtVdUActEbnzKzOUncWYiGrRS+bImaRZNlom6aAIu:9zNGEZ+JibzKfcWYiGtLbvM5n6/v
TLSH
T1B5A201002BF9570AF1F36B35A8BA4A644D3BBD91AC39854D5350B25E2CB0F44DE29B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.lfr

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.lfr
Size 21KB
SHA256 1b8e0478be45393e7ff36590aa8171d835a750a6e50b6fbd84ef2ec6f11e4631
MD5 6ac945ef1ec14ab210a7f13bf3185898
SHA1 087a73ea3d0d91a6627986e640342bb8904c1495
SHA512 efd4e192e7fde2d30d568add06e6937c7fd637f3ffb48e1a0a6b88939fcdc753bd64f0babce2dce740ba4e8b7043c000428bc918ac513cbb8ed2452282ec0eec
SSDEEP 384:68zyWUQg/uxuq2f1vqwVSSe4wViJtp45JnFE7L1cx:Xz0HmxEt6
TLSH
T126A2101077E8660AF2F27F31A8BA46644E3B7C86DD35C21D1680B28E2C71B54DD79B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.lhu

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.lhu
Size 20KB
SHA256 eb5257f4de4d534a758a11111390c29c40f5e33dc25b135c90fbb32e1cf83ea4
MD5 b6be86635669fed8b8b11f6f668065f1
SHA1 5d4dfdfcdae83e2f43b510078c345118d4ddac55
SHA512 1dd76a7971c5b6dd3af2cb10ba10d3aa8e164499129e0e5e2762614edab8e180cd2620453632c474c67ab5f3c2865bc6dbbe0153f79357ec3601f97e777a0dbe
SSDEEP 384:Rz9fu1/uSnHM/F/PJj1tostSMbhkQlrSBz8s7PazxY7xTPz9uRzp1Z:Rz9O/uSHM/F/PJj1tostSM+QhSBzVaz3
TLSH
T1EE9259016BED665AF1F38B316DB187B90926FDA1F938C20E5540F24D2C71244DEA8FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.lit

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.lit
Size 21KB
SHA256 451e891d30fa9243d23c3070ea4108a6415f79e7528e3b07228ebc27e2b11f65
MD5 33bda12985287ac4d7dd402be5caef4d
SHA1 430d3d0f4bb89084dfd6be84e74fc194cd575c67
SHA512 5e9d06207ae0a3f425be47989bb5d8eb633062d4e228d55099273a82041790b6647e0ce97fa6bedacc88faf491daf5319e0cfef7952dcd16721d53ab4b713405
SSDEEP 192:KzP5zQKtARgEEfrjfl1LnCcZU1jskrRBtCdaBDhmGcYOepRxdO9/B:KzRzsZEfrjf7j0ltegBDhvpo9
TLSH
T1ABA224116BFD5209F2F37B34A9794A344E3BBD92AD39C20D1280B25D2871A54DDB9B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkWin64.ljp

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\WkWin64.ljp
Size 20KB
SHA256 54d3709f07e9051b9e42ca334f1b80b21fa36cd6713afa37bb3b33ed366b85ad
MD5 3a6b11d4c624500ec0f79c7ceed5f38a
SHA1 5607f5c8d570ed8b6cc7d2cae517d78a18127c8a
SHA512 68db5f7744da151aed9688db01adce573990e131925c55a2a1af25e24d74351922fe00059b5f63999c353c3347f653960c42b02faa1f4c0246a3732b596b4a07
SSDEEP 192:LzPHQKt++7GYY5uw9yMGUNcU+UmwaakrRIXoPyNM3JhWyPls0XnapXI/RA1E+ZT:Lzva/YY5ubltIXoPy+37ll9yTG
TLSH
T1B1929A037BF451DAF1F26A3058F703205A377D99AD7B861E2280F24E69F1A009D75B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuKJni.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\wibuKJni.dll
Size 336KB
SHA256 29db39c565606aa676666be5f22071d7804f401fe2114e90ae0479315c4b4ea5
MD5 a339b2f3368724b8bc3d023a3ac4d8b6
SHA1 dabf536e1431dcfce64b2e82ec96ecf2002bfb8f
SHA512 d000439b3aee6fd01a23048bf52c9bf76ccfde359637b0240f750a56c3388ee3325d11aff81078aebb8e7f5c936d78b743c55bff9ffe35a4ff846a2e3a0f1cc3
SSDEEP 6144:hRCOdLIWMwZoUeB7Hle7ENwM72K91wp2xw:hRCORnojlHw7EmM7nxw
TLSH
T15D748D03F7DAC032D99306790475D7AD093BB95417748ACBB38A1B2EAE367D1AC3135A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibuKJni64.dll

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\wibuKJni64.dll
Size 420KB
SHA256 66d4f5511fda8bc3b6ed3dbd83f99b0a3e579241a8ec1b3e709a402c14412b42
MD5 b8dbf60a7bc7c0eb4762a7117f862f5c
SHA1 2c06ff4ff418de2f4d86b6200a191e79ee5ea9e4
SHA512 11756b4dfb472e173ecd6e1a830f531f88d48139630d07cb6f98858625e972a05841b18cbda75d87e91eb3159708d28e2f73d777d183190d5eef4ad6d60c6155
SSDEEP 6144:n4kzjVCo3nswiVhXvaukVHkbr1gjvstFyUSHu5IX55XXyN2Er/etkN66Kstwh15:nB3VCo3nswCtvcEGjsOvm2EK
TLSH
T123944B1AFF644071E067D23ECAA29646E272745D5B305BCB13568B6B2F33BD1943B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wibukeyUSB.inf

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\wibukeyUSB.inf
Size 3KB
SHA256 edc3240acb6c18bc6c47ce45494160953bc53e1ff496a8e53b8bca749f4ded17
MD5 c1a4119053756a9ea37f098b0702e520
SHA1 0d0ddaf34b90e9acae29ac23b09585c00f790472
SHA512 a6b1ae3b6001abc761b2f1fbba25780b52abb1875d3bd30e249896b692ed29f1e7b831f062cf1c4b19bf228d32fd5b52a148affe5896533c95d4a1a055a5fa2b
TLSH
T17081DB382ECE1D367F9AE2482B5750E5228871604DBF149E33DDFA2543DDA9EC3620E1
MD5 SHA1 SHA512 TLSH

Submit Download

wku32.exe

Path C:\Users\Admin\AppData\Local\Temp\~drvb811.tmp\wku32.exe
Size 405KB
SHA256 9c64c03ddc263f5888dd3c59f2f143d36af563808ddd0b5f9cf3675b480c7882
MD5 efbcc009bce996404d5ebe0361e631cb
SHA1 36eafed65388d158bc65cc19fdad997e5f1b3e8b
SHA512 8aa1969738a40354712cb5da194d3a1ca1a0c819501996902da114e1057938b23c69b24b60109b69c4e00dda987e9b0d8da986b2a6de307b140998f25c5a9ee7
SSDEEP 6144:8Rm+ZElRqg0emf8PYd25AHwqDf+N6GFdnfTuDPJEUSKMP:CuRqg0PNyAQqDf+AQdnfTiQ
TLSH
T100947C02FBE6C072DA5212B50C6ACB791937F8542B314AC7BBD44F2E5D613E1AD3634A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.ct

Path C:\Users\Admin\AppData\Roaming\FL_SIM_P4_GB\tmp\tmp.ct
Size 1KB
SHA256 a732b27f429ed0d564b5c95a07103ed548a9db4d79b342790409aff5a8c5fcff
MD5 311afcf4590952351cfe659cb6b43589
SHA1 015a0bb436d6bc37e6b0fbd2680786b9fe2868fa
SHA512 b20f4f075cb9926400d8b0963f47b1f9bec89ba4141b7822c0d8b847bb44349e8859747f3c7933979336a8e6a9d39bf615804f79e6aeabfe6d400326d2711bf3
TLSH
T17B21D8D42A09FAFBB0B8DA965698040A1DE99A072E302108D53391BB23D3E0545D2F90
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB7E1.tmp

Path C:\Windows\Installer\MSIB7E1.tmp
Size 1.6MB
SHA256 c54f771a062e63fd90b9c3ed2a89fa3ae05d3631ea21579d0d55122c38c2ede7
MD5 5d76fa7f7425893b44d42a89eb42aa4f
SHA1 1f4eb9c217b6b7d95c9a9369fec99bf2dafb0008
SHA512 a0003e22172cfcce0f0d1c2d26b22d7ca9e9a7e7ba917358f606d9afb5a302baa0692afc3c19579bd57ba9912b24a0028bb0b5def7a2a7729ad82bac1e749c50
SSDEEP 49152:z80QpqY0rxD96jyEUjfsgED/UMDakdPLl0Bv2yL+43OfPyatYFw6:kpqVDcjyEUjfsgED/tOkdPLLyJ3OfPd1
TLSH
T15E759E227A908075D26A3334921EB3F8B2FC95714C79424B79A02E3D7E74593992E37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c91f7.msi

Path C:\Windows\Installer\e5c91f7.msi
Size 22.8MB
SHA256 74553107ff957db091cd18dda6b3479184fa4ff81bc6f6157d31efafd96f0eab
MD5 7cd25ab254b5e72b5c7a0ebe03659fd3
SHA1 3ea86fdec23e448dcdcdedc38f24c7c22db2b9e4
SHA512 10f125e401ddb7990da3d1fb00e8ccfc0a0e48192c9f4991e7b04082decfd37e183d0a94dc0825cfdabfb5d1a86a3c07b883d6e7dc7ba5aaea28e7cdf9280b17
SSDEEP 393216:z65926ueBVUlEgcO1c+PanHwvDIb42YGn+SZHEvlDZBqjM5KlkjUlvnHieSzkZSs:I9pTBVSEe1aHMUbB/ElZsjMol0+vihIx
TLSH
T1083723223A50D432E36F7235C219B77846B86CB28E77407732B87D6DEE786D24A1D217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-2809-0x0000000000CD0000-0x0000000000CE5000-memory.dmp

Download

memory/1968-2846-0x0000000000DD0000-0x0000000000E34000-memory.dmp

Download

memory/1968-2952-0x0000000000DD0000-0x0000000000E34000-memory.dmp

Download

memory/1968-2947-0x0000000005430000-0x000000000547C000-memory.dmp

Download

memory/1968-2807-0x0000000000CB0000-0x0000000000CCB000-memory.dmp

Download

memory/1968-2808-0x0000000000810000-0x000000000081D000-memory.dmp

Download

memory/1968-2810-0x0000000000CF0000-0x0000000000D52000-memory.dmp

Download

memory/1968-2806-0x0000000000C90000-0x0000000000CAF000-memory.dmp

Download

memory/1968-2813-0x0000000004940000-0x0000000004A43000-memory.dmp

Download

memory/1968-2811-0x0000000000D60000-0x0000000000DC3000-memory.dmp

Download

memory/2924-2376-0x0000021C393B0000-0x0000021C3954A000-memory.dmp

Download

memory/2924-2975-0x0000021C393B0000-0x0000021C3954A000-memory.dmp

Download

memory/3376-1189-0x00000000007A0000-0x0000000000843000-memory.dmp

Download

memory/3812-847-0x0000023258490000-0x000002325849C000-memory.dmp

Download

memory/4100-3-0x0000021207ED0000-0x0000021207F73000-memory.dmp

Download

memory/4100-1352-0x0000021207ED0000-0x0000021207F73000-memory.dmp

Download

memory/4100-2533-0x0000021207ED0000-0x0000021207F73000-memory.dmp

Download

memory/4100-1-0x0000021207ED0000-0x0000021207F73000-memory.dmp

Download

memory/4100-2913-0x0000021207ED0000-0x0000021207F73000-memory.dmp

Download

memory/4120-2535-0x0000000000E30000-0x0000000000E94000-memory.dmp

Download

memory/4120-2523-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4120-2526-0x0000000000D20000-0x0000000000D82000-memory.dmp

Download

memory/4120-2795-0x0000000002990000-0x00000000029DC000-memory.dmp

Download

memory/4120-2525-0x0000000000D10000-0x0000000000D1D000-memory.dmp

Download

memory/4120-2793-0x0000000000E30000-0x0000000000E94000-memory.dmp

Download

memory/4120-2541-0x0000000003040000-0x0000000003143000-memory.dmp

Download

memory/4120-2529-0x0000000000E00000-0x0000000000E17000-memory.dmp

Download

memory/4120-2524-0x0000000000940000-0x0000000000955000-memory.dmp

Download

memory/4120-2797-0x0000000000E30000-0x0000000000E94000-memory.dmp

Download

memory/4120-2527-0x0000000000D90000-0x0000000000DF3000-memory.dmp

Download

memory/4120-2522-0x0000000000840000-0x000000000085F000-memory.dmp

Download

memory/4528-1193-0x000002D33E6B0000-0x000002D33E84A000-memory.dmp

Download

memory/4528-1195-0x000002D33E6B0000-0x000002D33E84A000-memory.dmp

Download

memory/4528-1354-0x000002D33E6B0000-0x000002D33E84A000-memory.dmp

Download

memory/4528-2974-0x000002D33E6B0000-0x000002D33E84A000-memory.dmp

Download

memory/4540-2531-0x000001E440E10000-0x000001E440FAA000-memory.dmp

Download

memory/4540-2516-0x000001E440E10000-0x000001E440FAA000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads