Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 01:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe
- Size 3.2MB
- Sample260710-bpf7tabx4k
- SHA256 7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d
- MD5 0f1253fb73c2fdae5b49a1ec82921209
- SHA1 c51ca887dcc1c62166070cc0433ffd7013ec3eef
- SHA512 08bab79669545198e76fe73ff39a95f2bf29d034d2e110bd25a808a600c7d08d8adc99e9164f157aed87ccbdc369d1a6b4a6ddfd92db5ead8cb728b89654e699
- SSDEEP 49152:QuW1A84e1ubGOoW51jGfJqg0alOFkiwSYQ3YNDyh4qJ/Yv6/wTmp:QuWa84tOW5ZGhq4lKzYgAeo6/wTmp
- TLSH T1A4F52301ABC6C9F2C0151C391EA1AB546E3D7B167F61E4EB73D4069DBC3A1C0AA39537
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\mpszfilt.sys LoadDrv.exe File opened for modification C:\Windows\system32\drivers\mpszfilt.sys LoadDrv.exe - Executes dropped EXE 7 IoCs
pid Process 360 QCTool.exe 4204 KillBaboon.exe 3540 LoadDrv.exe 5964 LoadDrv.exe 2352 DrvCovEx.exe 2268 KillBaboon.exe 3672 mpszfilt.sys - Loads dropped DLL 1 IoCs
pid Process 360 QCTool.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\DrvCovEx.exe DrvCovEx.exe File opened for modification C:\Windows\SysWOW64\DrvCovEx.exe LoadDrv.exe File created C:\Windows\SysWOW64\DrvCovEx.exe LoadDrv.exe File opened for modification C:\Windows\SysWOW64\DrvCovEx.exe DrvCovEx.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KillBaboon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LoadDrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LoadDrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DrvCovEx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KillBaboon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 QCTool.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f49471a0359723fa74489c55595fe6b30ee260001002600efbe10000000eda8a7bbad0fdd010cdb26e4bb0fdd01388f9f180a10dd0114000000 QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" QCTool.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000e95c3c72120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee95c3c72ea5c620a2e0000005f000000000002000000000000000000000000000000c72fea004100700070004400610074006100000042000000 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000ea5c620a100054656d7000003a0009000400efbee95c3c72ea5c620a2e00000074000000000002000000000000000000000000000000431a2000540065006d007000000014000000 QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000e95c517514004c6f63616c003c0009000400efbee95c3c72ea5c620a2e0000007300000000000200000000000000000000000000000044a8ea004c006f00630061006c00000014000000 QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff QCTool.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" QCTool.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" QCTool.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff QCTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ QCTool.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe 360 QCTool.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3292 wrote to memory of 360 3292 7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe 86 PID 360 wrote to memory of 4204 360 QCTool.exe 87 PID 360 wrote to memory of 3540 360 QCTool.exe 88 PID 360 wrote to memory of 5964 360 QCTool.exe 90 PID 5964 wrote to memory of 2352 5964 LoadDrv.exe 92 PID 5964 wrote to memory of 2268 5964 LoadDrv.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe"C:\Users\Admin\AppData\Local\Temp\7975f594cdb0719ba486204d485bddd5470b354cca089bb08501be2bd092321d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\QCTool.exe"C:\Users\Admin\AppData\Local\Temp\QCTool.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\DRIVERS\KillBaboon.exe"C:\Users\Admin\AppData\Local\Temp\DRIVERS\KillBaboon.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.exeC:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.exe SetIgnoreHwID 058f78903⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540
-
-
C:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.exeC:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.exe InstByIni3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\DrvCovEx.exeC:\Windows\system32\DrvCovEx.exe RegisterOnly DrvCovEx4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\drivers\KillBaboon.exeC:\Users\Admin\AppData\Local\Temp\drivers\KillBaboon.exe Once4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268
-
-
-
-
C:\Windows\system32\DRIVERS\mpszfilt.syssystem32\DRIVERS\mpszfilt.sys1⤵
- Executes dropped EXE
PID:3672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DRIVERS\KillBaboon.exe
- Size 44KB
- SHA256 608ccc34e1311651de24a100e5b50fec28cf51ce177c653e4dacbceb78ecdb1f
- MD5 59af81b1929a529ab8f046286ae63779
- SHA1 9d8e9d6cc0c1cd5e0bf9ffdf54d61c64dfa63024
- SHA512 5b2d479a7dd70c7262042d316043b583a9ba0a826ea165adfbcdc685703c105fe4e54edc69ef326dfdd1c88578a655f9bb63da79a22a636a956f9165f7e9cb7b
- SSDEEP 384:f0pRAGfNt9o2DG/v709J9MF0TXACOsbimToV0X3y68TyewfnW9E3lVDp0:cflDG/DgN7/sg398erWu3lo
- TLSH T143135B1BBDE5482BD48345309AB54B37E77BF62107B0594B8790F99E6E71AE0C939303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DepLib\UsbStor.dll
- Size 119KB
- SHA256 e00bbc5231f7570e4868177082ec3d71cacc2a37c8303539703c9f0202935d4d
- MD5 264b672c0e4f3e8650e03704bf494958
- SHA1 1140cc080721aba4dfe9b3c912e6724e5a20cf3a
- SHA512 00561702189318244c365f7296a36f6b64a7490b7ec8f36bad14a35e494ce110ae63644202571c12024a5ae67a8f794e8de5c19946cc9c1127a02135a568641f
- SSDEEP 1536:/gctA0PC70WU1JER/Td7E43ht6SnwQ7iWEWSTDhQMkiHJc+XFlXToYDwV6:/gcu0ZKNTdbhtLwqSpQ2pc+XFlXTofV
- TLSH T1D9C36C217B62C131D199143A5978CB76632F7AB1ABB544C7BB680B7E8E342C17E78307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Format.ini
- Size 3KB
- SHA256 b7e29677f8e5fee9f587247de0760043df83d704ebf417c49ad6ecf78d3e2cfb
- MD5 5377ed64457e5a0d2b1842886a8f9c79
- SHA1 773d75a1f8108ee5a30ab12b00eccf101086d444
- SHA512 b9b21a94f3f74f3ed7147230a15dc9cd91c87392ed73577ed03d9cc992439514471991ad96f47e1e8f7d85bf282046682c06ba3420fe78055c84cfb76335ba5c
- TLSH T15F7185913526C26D33FD71B438F40CFA1BEB0BC946114A6EB6D8850AAECEF07112B65D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PortInfo.cfg
- Size 598B
- SHA256 76dfeabe5d60fe3e2de79c2e1a763524d090aac8a68d940a6ad299fcb6e18193
- MD5 115885564ff429bbda66b2a72b27d50a
- SHA1 2638effe7eb19e651790ebd7d08ab181f421c37e
- SHA512 c26d68e625a0efc450c6c69749ab3c15d22d7487b95184e1f719e9e4aeb74eae1b97462bd37806762ef285e4218a53632bd1cbf03f3a2ebbc7f607f11805f077
- TLSH T1FFF0FCE266510B47D080A3B50B9653C4880CD19654DA76E033AEC6BD759BDFB6332F45
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PortInfo.cfg
- Size 563B
- SHA256 25a569e8614a1d58268a704e6a250fa80c7ad499be82d7a92a956d7faa333931
- MD5 6d2314c7f97b621d7f6e3186008db29a
- SHA1 2aaab642fb12d08b0e658439ee5dabab6520df93
- SHA512 e65c3a8fd387255517f58e0e61d4b92d147ad159a327e641e912fed00f1b5030526bab19b8ef800ae79dca400c2a8a40459f8532348c0bddc1f58e977b09245e
- TLSH T13AF096F226610B47D084A3B91B9603C4840CE19658EA7AE033AEC6BD7597DF76332F49
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\QCTool.exe
- Size 764KB
- SHA256 793f3c744fb267f47a48a848ca88ab240160645e4a549753b2206a0f4fc09a20
- MD5 cf4554aa7d4752775e360387fa0ce005
- SHA1 9bfc97c2ea2ec35d7324c6d86587109262925c80
- SHA512 5c19b78cf3722768889e838d3d69351f04a4993e733267a3fecde82c3e3f20f76ee7d042f28dadeca598c3f332ea7084dc5e19f42bd47629aacd4cdc116a2e17
- SSDEEP 12288:VYD22j1MUPwywFxlCOHMiruB1nBPrjFp3bHPD+:iiCP5icuHrupbC
- TLSH T19EF45B107A978417E0638670E9FD91776170BD322B11989B63C46F3B14B5A92BE32F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\drivers\DrvCovEx.exe
- Size 44KB
- SHA256 607c6a1cfae0914179aeb91d96f9794a552d59f2160091dd380cafcf16251d84
- MD5 85850f3a3672c5b70d064c87825e58ca
- SHA1 013a13abe8a1771e18936ebb1b87dfe88e8e36a0
- SHA512 7d7fd8512ba304055d2a39569dea41b6b7f33befefa5be49ba442c8afc5c587fc1f050f1938cbda625d25be190d22122526bb28de55af5c52f42444d35bc892c
- SSDEEP 384:3SsU49nCXgkVEGntRV8zKCDCKRCm0QH2GJgZLXyuUpR5RRyEXlqs:ih4UQkEGPVYKrdc0XTUf5nXl
- TLSH T1A1138E7738D141B7D89382F045F28F3BAF3FA275069250938B54AC962E714D1DA3A387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.exe
- Size 52KB
- SHA256 70c086735e3a6de470d5e945bda8fce6c37795d1dc05f77ea3bbe5fe4c84bb43
- MD5 bee8abe9c7a5c7b1e35cf39779d8b2d5
- SHA1 fb0a97258e6375c84a7348c879d85f063f2b60ee
- SHA512 658dfc685b86ee1fda2f597969918d169d858c482dea781fe42d1140e8e5b3d33342c62e4c7355eca9829ea67679ea60829dfb91c52645c9f9a14a7e4bfc39fd
- SSDEEP 768:i/Gm1E9RVbStaqwqWvDjomVO/nUCAgls7+:i/PVaqwJDPV+Rls7+
- TLSH T1F1338D6728D1C073CC9252B051B64B37AB7B52990611A197FB8CE835BF33A95C73F24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\drivers\LoadDrv.ini
- Size 260B
- SHA256 211c5431b56290b0317814f41b38105cba04fafb92705fd9aad565b6b74cfbc9
- MD5 95504e1f50ebae8191f368b59c4ea6b2
- SHA1 58a84042d8de7f6c01335e1188e33037ac535790
- SHA512 751b31a1b3b8c52cb60661e4e69a54356e039dbbc4714ecce480375cb5509ffce4ad04159b8d36a476e6573a35ca491c423e4d9c231b3191b67278cd590135c3
- TLSH T136D09724B6B30AB89C4021EC84172F03870CC150024EEA2BCFED8104E002C0F8975B4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\drivers\x64\mpszfilt.sys
- Size 20KB
- SHA256 76fe9ac81b65dc9b801db321abcfd5405810802220d6fc7b8f3a401a6222c855
- MD5 591fc3b26c2ac598210389c2ec700b4a
- SHA1 690eb95e00c3b39d73be6caed85e782d1eb21863
- SHA512 c18d1d4f57b69ede595cdd6224ece8b0a0d1994ebe398cba1e78afda80f42d678232b71f67372aa284f061cb3db0d54b48345c423aaf42bbe3eae27a8ab87fa2
- SSDEEP 384:KVvP3W1Wg0HDoE1mw6f4rknYPLPYl/rUHeMt:ke1WgCDo2mJ4wIiY
- TLSH T1C2923AC7477C1442FA97CB74C6E6DB63AE30B6616B52CADF406081912D42FF46B3B21A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\flashlist.afl
- Size 1.6MB
- SHA256 7f19ffbd437d4f4cb516c2d050582b7ba3d474659f943d435c6eca05e7c98fc4
- MD5 637248ad98862b31aeb27fe3346de53b
- SHA1 c53e4863958d11d368f0f1ce2277ebf5f8de876b
- SHA512 ca0c807e63770bc0a0a3fbb8f914029a65b0668c8f7eae029501a1915c0e27e517da67ca5f87d9d6ead6a649aef9482a04feb5e10c39989737ab7503eff1ee15
- SSDEEP 24576:r2EXYwvfinltwjBe7uAbnaxoL7Pe0Stdnr1OSZZS8hDmN6Vrb8EbgK3SjjDPqJTp:H5wl4iLCNMSr1DJTCS
- TLSH T1217523B15F3F9600AE6A326552570D0FE74BDFCB222A2DF11B4A9C058FE63095E82F15
- MD5 SHA1 SHA512 SSDEEP TLSH