9e7c6cb404da30bfa4ebff3a1622018bf0711a32f48794138dbc5decc98d4256

Analysis

user interaction
yes
max time kernel
103s
max time network
536s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svservice.ps1
Size 551B
Sample260809-pjhqcaxerc
SHA256 9e7c6cb404da30bfa4ebff3a1622018bf0711a32f48794138dbc5decc98d4256
MD5 3a796bad956f2ed94e2de68968152f9c
SHA1 8e2561855bb523cef8275fb45c11263e96cf1428
SHA512 afe03cab3ef7cf7528c31c30eda9e11effa142905a145c7ad511c999e1b025d8bbfbb107c6cc21bf91c86c58f62f2eee74ceb58c6f8ff20c4d8a5675132cca8b
TLSH
T114F0C0C9D3E8136A8D712EE84499D62E887B820D20974A0497FC4A0DFFB495BC3DC1D9
MD5 SHA1 SHA512 TLSH

Score

8^/10

bootkit discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1800	PowerShell.exe
4	1800	PowerShell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	1800	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
5372	kbm.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	kbm.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Lоw\\allah1.png"	kbm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1800	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	kbm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1800	PowerShell.exe
1800	PowerShell.exe
992	mspaint.exe
992	mspaint.exe
1084	mspaint.exe
1084	mspaint.exe
5168	mspaint.exe
5168	mspaint.exe
3416	mspaint.exe
3416	mspaint.exe
4728	mspaint.exe
4728	mspaint.exe
2204	mspaint.exe
2204	mspaint.exe
1436	mspaint.exe
1436	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
3960	mspaint.exe
3960	mspaint.exe
4280	mspaint.exe
4280	mspaint.exe
2388	mspaint.exe
2388	mspaint.exe
1448	mspaint.exe
1448	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
2336	mspaint.exe
2336	mspaint.exe
6044	mspaint.exe
6044	mspaint.exe
2820	mspaint.exe
2820	mspaint.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	PowerShell.exe
Token: SeDebugPrivilege	5372	kbm.exe
Token: 33	1160	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1160	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
992	mspaint.exe
992	mspaint.exe
992	mspaint.exe
992	mspaint.exe
1084	mspaint.exe
1084	mspaint.exe
1084	mspaint.exe
1084	mspaint.exe
5168	mspaint.exe
5168	mspaint.exe
5168	mspaint.exe
5168	mspaint.exe
3416	mspaint.exe
3416	mspaint.exe
3416	mspaint.exe
3416	mspaint.exe
4728	mspaint.exe
4728	mspaint.exe
4728	mspaint.exe
4728	mspaint.exe
2204	mspaint.exe
2204	mspaint.exe
2204	mspaint.exe
2204	mspaint.exe
1436	mspaint.exe
1436	mspaint.exe
1436	mspaint.exe
1436	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
5392	ShellHost.exe
3960	mspaint.exe
3960	mspaint.exe
3960	mspaint.exe
3960	mspaint.exe
4280	mspaint.exe
4280	mspaint.exe
4280	mspaint.exe
4280	mspaint.exe
2388	mspaint.exe
2388	mspaint.exe
2388	mspaint.exe
2388	mspaint.exe
1448	mspaint.exe
1448	mspaint.exe
1448	mspaint.exe
1448	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
2336	mspaint.exe
2336	mspaint.exe
2336	mspaint.exe
2336	mspaint.exe
6044	mspaint.exe
6044	mspaint.exe
6044	mspaint.exe
6044	mspaint.exe
2820	mspaint.exe
2820	mspaint.exe
2820	mspaint.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 5372	1800	PowerShell.exe	91
PID 5372 wrote to memory of 5296	5372	kbm.exe	92
PID 5372 wrote to memory of 4752	5372	kbm.exe	94
PID 5372 wrote to memory of 704	5372	kbm.exe	96
PID 5372 wrote to memory of 992	5372	kbm.exe	100
PID 5372 wrote to memory of 1084	5372	kbm.exe	105
PID 5372 wrote to memory of 5168	5372	kbm.exe	106
PID 5372 wrote to memory of 3416	5372	kbm.exe	108
PID 5372 wrote to memory of 4728	5372	kbm.exe	109
PID 5372 wrote to memory of 2204	5372	kbm.exe	113
PID 5372 wrote to memory of 1436	5372	kbm.exe	120
PID 5372 wrote to memory of 6040	5372	kbm.exe	121
PID 5372 wrote to memory of 3960	5372	kbm.exe	123
PID 5372 wrote to memory of 4280	5372	kbm.exe	124
PID 5372 wrote to memory of 2388	5372	kbm.exe	125
PID 5372 wrote to memory of 1448	5372	kbm.exe	126
PID 5372 wrote to memory of 4512	5372	kbm.exe	127
PID 5372 wrote to memory of 2336	5372	kbm.exe	128
PID 5372 wrote to memory of 6044	5372	kbm.exe	129
PID 5372 wrote to memory of 2820	5372	kbm.exe	130

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\svservice.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\ProgramData\kbm.exe
  "C:\ProgramData\kbm.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query /tn "Windows System Process"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query /tn "Windows System Process"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /tn "Windows System Process" /tr "C:\ProgramData\Adоbе\taskhost.exe" /sc onlogon /delay 0001:00 /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:992
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1084
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5168
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3416
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4728
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2204
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1436
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6040
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3960
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4280
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2388
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1448
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4512
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2336
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6044
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2820
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:260
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:500
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5580
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5936
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1716
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:204
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:6200
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:6248
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg"
    3⤵
    PID:6344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B0 0x00000000000004A8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1468

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5392

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

kbm.exe

Path C:\ProgramData\kbm.exe
Size 5.0MB
SHA256 b9f907f4df54c4d93cb8eedbba04fcae53383299a29793a78f28617e97f1a4ee
MD5 19d9e895208773871e3ff571dcbde4ff
SHA1 7be295e11c56416eba8a4cc0d0d02dfe5d21864c
SHA512 c99c28e0d693beb1a50b1059ade94ccdc2fd10d50605557c9017fc25e3bd0ebd011a2ab9a5b69d5a4f89079d0a8608853b1d29cf0e0bea81194430f6349376ba
SSDEEP 98304:WNNnIk7PtgtNm6g2YCzCFrps2SA3eVehZVrb/17XTUHbYxl:WNNn231dYdr221hT/1fU7Yxl
TLSH
T14E36C097AB55852FC15C1235C89A4BF83360DE2064A2DF0B7BD22FAF580F389DD39A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

muslim.jpg

Path C:\Users\Admin\AppData\Local\MsMpEng.exe\muslim.jpg
Size 81KB
SHA256 56c5b07ffe6d5550902821e06d57050e1557c59ae84b14bca1b1254600f0f00a
MD5 bcef182ab249015040121bf642dca71d
SHA1 4e55969439e11792ab55aee337ab839f9c6a101b
SHA512 0f63b966e951e91125c497aea50016fcecd3a2947bdfcc032553cb309936210dc8f658ca97db2bb7607b6640eeb4a31d9ee98a957eaf208baaf4309b59d77ef2
SSDEEP 1536:tW21nBuT2xzj80fgfRhSX91VpmeocQH8UggF2aDpJJQGTydWg1nzG4:tW21nBhZgfRhE91XfoVVVFvHmWg1B
TLSH
T10F83028107E3A013D93F643B5CFC6D8ADB596CD8B123EA2934C63A8DBC95D9722B4544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nasheed.wav

Path C:\Users\Admin\AppData\Roaming\Micrоsоft\powershell.exe\nasheed.wav
Size 4.1MB
SHA256 68c8133f17ff557091073fb68e206a34ff82457a3f52c525ce334b75d6006dd5
MD5 eeb8186fea52b1680a260f682555c134
SHA1 330fc8ace9fe6392e9b3d7e4046e461af361ec5c
SHA512 b95f509d5f7cae1cf11a047225b2eceeb24c8ff9131da0aabca4716fc99c9fee8106e26885975091c3d3b508d5673666cee4512b3cf0d9e3a60e56773c4f7a24
SSDEEP 98304:FnIk7PtgtNm6g2YCzCFrps2SA3eVehZVrb/17XTUHb:Fn231dYdr221hT/1fU7
TLSH
T10116D09BAB54853FC46C123889A60BF43361DE2464A15F1B6BD26FAF9D0F2C4DD39E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 50KB
SHA256 52ada3bf0198a240b6b7f4ae768556dc551b8d604055555be11c89e4ed8958b6
MD5 8d8b41fdbfa9286ba89a20f90c8c76e1
SHA1 aa518fd511eb4fb9a330db2d86aa042ec371284a
SHA512 aa3376ba5d73dfc8795db2ecdf7460261ac031a8e83798b63048e5d583a3d8c06f02c53b302119027a3e4748f6f93d629b9edae200c3dafba1244521b67222fa
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3/:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4f
TLSH
T1CB33F0D4C4826D5BEB8B300ACBA511D41F9FADC659E210220A3FBED590AE19DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 51KB
SHA256 a88f58414cf6cfaff04793338cc05f78d5d4316d3ac28506643a2c76f1d6ac76
MD5 8d3213f934df7f4319cc739c7d37bada
SHA1 799e9167d2cc9dcd7e9da0b4ab82ae49de239f60
SHA512 6696a12b681ea938933e587080be3ada046df7014483f518227c53dcb7b4611caf2d7c2e3eca0e6e2aebde86eb39a59da08c7d04c1b9faa4db57494a26c9e0f5
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3x:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4R
TLSH
T1043300D4C4926D5FEB8B300ACBA511D41F9FADC659E210220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 53KB
SHA256 a1ce2e252aedaa8807efb148fb5ae64ef209db7aa33d2c9668dbadfd7268327f
MD5 30f483a41d60b01829f2491a703ebc99
SHA1 fb4d8f5e074a244426ec44b381ef02c12399f933
SHA512 a9871289237f19ca78937e25b4cff478672d2cd9c16476b3499b5304f2680872806b78e74cbabfb16a5c56f7e8ea5add6449a2549f8a56e4c67197e05850c7b7
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3a:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl46
TLSH
T1DC3300D4C4926D5BEBCB300ACBA511D41F9FADC659E210220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 54KB
SHA256 37b0af323cdcc8c6ca920fb768ec72b108073e643e559767840c077db17157f5
MD5 eec7e7b2949a13dd9afb4db1c0f0ce07
SHA1 2c4c5b0481037d27555ce9bddb78e306d60dfb39
SHA512 721f5eeeef5e7eedd429446530e41ae82dfc42c7c0c0f39742b308dc2109a45bcef4120a8ee31dc16ac02bb20b58be8ee924112e74028873eb7a950d1d23b5e2
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3Y:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl44
TLSH
T1BC4300D4C4926D5FEB8B300ACBA511D41F9FADC659E210220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 55KB
SHA256 7bfb3b47ca6bdd8ae5904f7faeec7762551fe08d47f100a666120ceba1193a75
MD5 1a141ba4b014d3dc63b330ea84293aa0
SHA1 ba0596b7e5eb5ffe02518c0419f03c7b7bc722fc
SHA512 5116a2246799f4bbc11f74ed46fadee81abd800b92e7d38e711a82a418eccd7832cd6d6b71fd936ec9cf491321675923a96d665e45e6c49ef776691086e842dc
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3C:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4i
TLSH
T14F4300D4C4926D5FEB8B300ACBA511D41F9FADC659E210220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 57KB
SHA256 df08e99f1d3d3b83fcbb6132b7db6e48a1b58b3a9b7decf31d759bc8a1bb0a7c
MD5 585f525f5cec128215c88721a46d9b44
SHA1 8cd3e4317426b5bab71aa18c803023f594a09452
SHA512 ccf11f38e52c8b8406b779699980f3d7c33d534c14a69d767b5f206b8974b7d77e9ba633b4e64b608156a40fe31f410a8236e990a70ba6d23c0b1432d88c8755
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3c:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl48
TLSH
T1DA4300D4C4826D5FEB8B310ACBA511D41F9FADC659E210220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 58KB
SHA256 4fcadc7f825d089ee51d0c375d1f82aac5a3baa7d45ad4535d30e5e2448f5b5e
MD5 fdf21361d538c0c7a6048eb12f132086
SHA1 8c02ed907fa54cef0c502e18f8237144054b998d
SHA512 7ead47c8dd2de400a53c311982f4050b92a103c9bbc55aa1309800eb6b92a1f191af459c979ec0fe9c563dad370fbb9a0c66227e79c38aacba2cf07248f11c74
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3h:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4B
TLSH
T1D943F0D4C4826D5FEB8B310ACBA511D41F9FADCA59E210220A3FBED590AE14DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 59KB
SHA256 c3efcfd41a0707fa6935308a09c73a6d85c5a5178cb18e92571418fbd74f7b4a
MD5 4d2254221ab8d3077a68c95314d53c79
SHA1 0151bf7b8ce5c0d5e7505ced48ee786a0b1e7ddb
SHA512 40f7d3e86904ae52b611a7d8c043d04ae3143486b6ba6dcd1434547e4e29613cae486c3f4d820b815733325465fc00eba353781db0846f113e0fa1c7f1c7b4dc
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3d:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl49
TLSH
T1DD5300D4C4826D5BEB8B300ACBA511D41F9FADCA59E210220A3FBED590AE14DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 61KB
SHA256 1872069517b74e9e77cda91248a5d6403abd91079e96955f9ba4f57e0390e27d
MD5 ccb2a0691ea4a67fc3694738cea58d6f
SHA1 76f7c92138915397ae70dc445a4c7afff5d71641
SHA512 41b1ba9cdaaca40bd444caea2e0b7965009a3dc94b8cd4eeb0e4912caa039af3bdac3f8e7ab3b892e75e84e389cd9790e0ade9b4f37110f5daa15553a2dbc941
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3R:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4x
TLSH
T15A5300D4C4826C5BEBCB300ACBA511D41F9FADCA59E210220A3FBED590AE14DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 62KB
SHA256 811ed93d1338a52ba23340b7acee2ae389716ffb7f9b612270f3ae26996994fe
MD5 8237471251ff53a3a8617cc16ce32b6c
SHA1 186b149c5eb075e9f347ee22aa172cc9b4768acf
SHA512 71046433908d7316c346c597762aefe16bb2a45f1d15af693b396e31d3b92d685bb29685eb7a0c8f1419f9abf6b91f0965c529d016ed276ad0b512b06ca23c90
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3z:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4T
TLSH
T1445300D4C4826C5BEBCB310ACBA511D41F9FADC659E210220A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 65KB
SHA256 af92abb805267cf92cd1ced008e9633eb51c4e493f5a76bfe294e94316709d48
MD5 1d230ddfabb4be044b8cba89fcaf198b
SHA1 d45acbbb36a1de6b1bda2652653ad8cc17705dea
SHA512 ff93e9ce646b75cbb9e6e8e5c2a653d98b5d19c720760d78ed136dbb03bc2747431a7b425a4463faeb4b2af02a749447b4a5ae798ce6f6b4a5c17c5b98719a78
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3A:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4g
TLSH
T1AE6300D4C4826C5BEBCB700ACBA511D41F9FADCA59E210220A3FBED590AE14DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 67KB
SHA256 eb26ddb32751aef9b419d8eccfc2f8bf95760af06b677543a8ecf824ff96d16a
MD5 15c51c7b73a65894e4b4d1af1e9592fd
SHA1 6aab59a2ffd3bd532774fd35e0c2a87d8a0ba72e
SHA512 a5a07319791c48b93a7f9e19963182da4529ebf1dd98b7ec1d921a0bcdae3913f2c46d6a3bb4c6a5260904eaff4cbf15672df9230d23d16ffecd51dfbb6b0cc4
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3l:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4F
TLSH
T1276300D4C4816C5BEBCB700ACBA511D41F9FADCA59E210220A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 68KB
SHA256 407cca0c84c8208a98a1f8e67662fd3918cd81a6a3a906227b24204e811e6be3
MD5 71c8edb880222ea1787ba37df582f4f3
SHA1 d81a2e0150791b68f145a58de30da8a3ea270393
SHA512 57a0153b7abacfc80b6dcc770e84da78dcfaddbe1be9a900f7a5180efb825af8c39e705b585fae0212f79d827f471a2cf45e1343af1c95f7a44c68e0578f4930
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3D:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4j
TLSH
T10C6300D4C4816C5BEBCB700ACBA501D41F9FADCA59E210220A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 70KB
SHA256 8d459863731d64d5b9c43f07ed2f098140e89689e59a9d7bcb59e6c3eff967e6
MD5 5cf9ded0d71f5b76a4112d3e8b081785
SHA1 22602e6fd47921e352f0678a662fabe6275c8450
SHA512 90ee16f372c69f9efbe1c3a31b8db6b7b6c0ba4be5763bd92197e0b2af1a6d060bf9586b1b722b48d19f053ad02c9b1d4f891d1f0dd8f4732597f553b1c0d763
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3E:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4k
TLSH
T1996300D4C4826C5BEBCB700ACBA501D41F9FADCA59E210220A3FBED590AE15DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 71KB
SHA256 0785bb4461330964cd3a2af0e8cd2b3d15cd3f303a9a7ececabce133f8dfca71
MD5 625a358c41a4ad59249d4a9a15904900
SHA1 f80857cefb3e43c27d87f090918602e7ef742e53
SHA512 b633a1fa041dba74a74a69508dd52c4ac195687af630613119157ecbf270ea51ebd17753839a140a4a40cb1ce85552ec4ad6a124ea0e2cba26c39ef6cebe3702
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3F:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4l
TLSH
T17A73F0D4C4826C5BEBCB700ACBA501D41F9FADCA59E210220A3FBED590AE15DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 73KB
SHA256 8be1a2a21eb20899d7415a0db66fd2d94e0e043dbaf91a4d140b830c69c218bb
MD5 acd72cb6e6c006e9cc5f22c263a027e1
SHA1 e1523848a054b004ba466925a1b8ca841c6bc944
SHA512 ebd67c28f885072490a7a8e78304ebacce3396a6f9f2ffd5ddf9cfff8cedc2fb869cded1fd1889c7f5b1722b72f5ea99f9e546593651aea1445cfdbd2c7719c3
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3+:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4e
TLSH
T1F17300D4C4826C5BEBCB700ACBA501D41F9FADC659E210220A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 75KB
SHA256 a53c005840cfba3a2bc8480249789803ffde760819023193b4b79da891973036
MD5 77278706f7ffe88220a4592916cd1721
SHA1 1ec0020b6b32b26c372ffc67f4528e264b68c826
SHA512 2eee94153f743a56f414c82441fe3904c926469a19dbf8daed838b92739ea33f119a7abc02cc162adc21710e09e58bff46c28af9e259abe934b5399a2eb71a24
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi36:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4a
TLSH
T1BC73F0D4C4826C5BEBCB700ACBA501D41F9FADC659E210220A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 77KB
SHA256 7082c50d834f436baf6f337a43260fcee35dc764636ab6893e5898d54f899fd1
MD5 04bacfda6c737522ca25c0b03552f291
SHA1 d8e75e1c5ec8b4ab297fbbcc836edd66b48080ea
SHA512 2d59326ecf9cbc6f30f688cefe1262d4d175ea172fa9436d7ea2cad429c7706449a97bbae1f8f28a992723e6a97253f120d4328cbc293101acc7b5a639d0b4b7
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3B:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4h
TLSH
T18E73F0D4C4826C5BEBCB700ACBA501D41F9FADCA59E210220A3FBED590AE15DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 79KB
SHA256 3aa0d0fa896bb522635c9d6ab9b2df1a42d210827f3ea063cb57b256cf9222a4
MD5 48df445bfa6550594bf02e725784f309
SHA1 ca2b0a256ef29b6116d726cd0889f85bfa5d0669
SHA512 983a93251560240cc5e49d34998d15c740b67f2623e7a9339109da6441a02c31d1201bd680fa389bdda951e9e040b5489ec5a6f83c860666217444da1e33b654
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi31:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4V
TLSH
T1DD8300D4C4826C5BEBCB700ACBA501D41F9FADCA59E210220A3FBED590AE15DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 80KB
SHA256 db304fa3779c9182c6e130407ec8e0f6146e2d8c0fe20401a182afd0668c7c4b
MD5 e4e370b0159d0e08784c18c3e0eecec2
SHA1 88ff78472c9dd4b9e2ecad720cb70ad2b2df9b15
SHA512 4507a4aff502c139117d5260e023da194947b3a7bf93c6b76cbdd9ed53758bc1ae8c7b557d0ffb8c1d01350eb4afb9ff4c8fe4082ad23cfd6795d8e6e062d19a
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3V:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl41
TLSH
T11C8300D4C4826C5BDBCB700ACBA501D41F9FADCA59E210220A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 82KB
SHA256 f2ddd51a2600241ce21de2074b7517996318d04f9f40b6066022d6a17f4ae0ae
MD5 71874fac09437f86859dc9b2098fb24b
SHA1 870956a7fd62ca1f47e04cf1086f707b674ed71d
SHA512 e7a82726e9364cb951eeb780b32c73f3f136b9d345a1a74f1329a9224911d485ba698e3b848ee56722092c87fc0477cc55895a8ca7cf2a6720edd6753d5e9bc6
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3r:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4L
TLSH
T1B483F0D4C4826C5BEB8B700ACB9501D41F9FADCA59E210320A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 84KB
SHA256 261178e5e6c5506b63cba6a9627834c81c39d44c527cc0abebf711b63d466063
MD5 be115bde8a25a96e3dd5b158c46f2e3e
SHA1 ab37b40078a7bdb5949cfff0493edc1ab3a0d35a
SHA512 fa82762af8bdabce07b7bfb2cd6e06e5db199f0a16e8ec9f7a937ecd7ef6ec01b02de8e21755d15b407396a687369083973f02e9ae81ba79fde42a4e0188a38d
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3Y:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl44
TLSH
T1CC8300D4C4826C5BEB8B700ACB9501D41F9FADCA59E210320A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 85KB
SHA256 0a6e4a91706fe83b40e560b254da7beef345614eeb98ec43e71a048631ba4dc1
MD5 fe5b8cf13f2ee5a94d75f14e87779b85
SHA1 0bf0bfaa27c3c9614940ad8bb23c7d31f67254ba
SHA512 e4eaa1b1a6f4b3394b40e73365ca73301d189e13e1a1cfc7b207f34f2aa66e0e99d254acb38f4da242bf9d57759a822402f1049841c43243c16591dfc3615085
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3w:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4Q
TLSH
T1D6830FD4C4826C5BEB8B700ACB9501D41F9FADCA59E210320A3FBED590AE19DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 86KB
SHA256 9d0ee47a1632c3855384a287dfcc61ba3746ef087f67b902c93d582ecc8dbbee
MD5 724f66956ef05bd74ca3bf4c80cf65d3
SHA1 f67d4f4a35630d3323e0a1681172291a52b06cb5
SHA512 e087d25b0f09b3b34bcd6ec9273a78197932d433e2b6cebe4d96a52a89b625051782107590b936aade850dfcf1c191748b4730060f53ecfbe465a5b248eb4807
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3D:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4j
TLSH
T146930FD4C4826C5BEB8B700ACB9511D41F9FADCA59E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 88KB
SHA256 9049c67317ec7444ffb26432e15af20ed00f4d8091c5cc917d0b5881da8f7c0b
MD5 88423bb17d43f25a00fcc9bd66857f63
SHA1 da523e59647a18a35ef31ea22cfe754aaf820e92
SHA512 586a346fdb17f27371b458545dd425342667695fe91eebd10ee0a15bbd59e7fe0f45904cb0886d7249a167ac0e7cb1c1880d8df0fe4c4d9c7b97adcbb551fcb2
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3V:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl41
TLSH
T19593FFD4C4826C5BEB8B700ACB9511D41F9FADCA59E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 91KB
SHA256 e2ea15dd6af753cb878d6cdfffc462f53b24f719777f46862944651da59f395e
MD5 8abcbafc8d7e4fa95468830a310253f0
SHA1 34efcd6919f71b577a7e90b03101b3a6e9e2fb6b
SHA512 9ec66da95ef52349e0777d1e6a99b50b13eb0b760c9d66b600a54c2f7f383f073ce9e0027279b7ec9699c1c69857d2bdad4d6d82b48af3f5608314b2ecc32ee9
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3G:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4m
TLSH
T1A3930FD4C4826C5BEB8B700ACB9511D41F9FADCA59E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 91KB
SHA256 3a6af4cb3fc0a61ff6f78f9d096acf9cb04916cb12635833dc8fab30731442ea
MD5 decefd168ea3dcb4230b663f00feb37f
SHA1 3509e3314bd9162dd6366c7a564dfa8c58f670b4
SHA512 6dec4e787f7abf9321a5fa7a0f31b25b6dd6e9666c435c7d7f7f2b4bd9ea3a532cc7239556e96fde88fc38a7949f06fc50080607686e16464bc3df6d4664b421
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3F:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4l
TLSH
T10693FFD4C4826C5BEB8B700ACB9511D41F9FADCA59E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 92KB
SHA256 f487be635cb7801b808029343dce99fad355799d3684dae9d1b6dbfb9ee6298e
MD5 90e8cf4c869a458487e2e63664daa11c
SHA1 e62d3817015e67501ed349632d39ca94cfb4c053
SHA512 d2cf9c317c875623b62f194ceb927580f49a5ec382bf909205dff83bff1f7816f4452f7a9f9e65cb577863f02cb4d5949002f3b430435baad9c578b2ecacc9b2
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3a:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl46
TLSH
T15293FFD4C4826C5BEB8B700ACB9511D41F9FADCA59E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 94KB
SHA256 6b811d68c5c7b83913b33628605c57a0ad6da720396c44fbec4c0c6e8d5c6065
MD5 a0a86ec09a032e2a9c9644e011433ca6
SHA1 cd1e7ad89794c554b74d6cb34e8fc43fc99e3d76
SHA512 e13b970cac35791b809fd146a32b6fe00b2072e5504daa14c1e531daecaf1efb6542197272a9c4eef850c7bc8f6ee336082690f28891f1127e06e1d5383ba276
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3d:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl49
TLSH
T12693FFD4C4826C5BEB8B700ACB9511D41F9FADC699E210320A3FBED590AE18DC7E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 a223f1de5ba62cb2c69642fe52cf30de89b46b007950df51f987cb9c71374cc7
MD5 7e831b359d3a48219a0d9cc69e78fed3
SHA1 a3f3f4ecac379abd7b9c098c49e33e880f50792a
SHA512 23b6858fc81a14062b2a5f66d11381a543fea19940ebcafac14df9b40e2b116d2bb0d04c120f004563af716577cb70c7b13563c5646fc4d3d198ff3ea137ef67
TLSH
T13931CF84C4813D1FD79F704ACA5A01D81BDF98DA68E160670D3F7E9590AE189C3DBC42
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 2KB
SHA256 bd59e8a87bb7406201624e871e561739db4cf0b1ba6921aa23548be5c94d9697
MD5 68cb5d671d4e0ef767e74acc1cb073d4
SHA1 08a4905dc19e9cd21414e84361c2e902961f394c
SHA512 d280ee414b8d98a609879d2b3341bc2b70b258c9866fc4a491cd41804133dbc81dd59b18d79a70cccc9a14d702881fce520baaf33e80fcf75fdd69a066b098e7
TLSH
T1BE5121C8C4813D0FD78F714BCA5511D81B9F99EA69E220660D3F7E9690AE18DC3EB806
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 200d7ffd1bd0bfdf951ae09a31d620d56b76e31ab59d906e5e3957e31e5fbc5c
MD5 7f0f855f7eb99efaacc62aa04b46db83
SHA1 53e71608653df3c212e97d2ac8976c00785098e3
SHA512 2b39bd5e53360b59defa262aa47a067c0e1a021c9c368a0e770cb2e6ce70532e0894050532a870255e078b441bf47f76fccc3d52e870b753a2303cf8f0489bb9
SSDEEP 96:0ZcQSmXcQS6cucSSdVcSSwJcQS3RzoAchRHfcHycQS3RzoAchRHfcoMvxSmESoSD:0ZNSmXNS67DSLDSwJNS3RzoAYR/jNS3B
TLSH
T1929103D4C4813C1FEB8F710BCA5510D51F9F99DA69E220660E3F7E9590AE14DC3DB806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 9b419a9ca2d570435e6d9075cd25be0ac38b722a285e51512012b67a4afb6ad3
MD5 a6efb69801260be15ed79c499f858bd4
SHA1 783d9577528ddaaa0860da6c7216b90db6666bd0
SHA512 1f0ed869ede9dc86e6149b04fe1707b1f9eede03b3c1dd5e7acc6fc3d0a2bff0362b36bf36d46ecef9bbba8ee41b6310bc467452c86fa981378d89c4988f1e28
SSDEEP 192:0ZNSmXNS67DSLDSwJNS3RzoAYR/jNS3RzoAYR/YxSmESoS3RzoARfSdSwaS3Rzov:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKF
TLSH
T10CF1E2D4C4822C5FEB8B700BC79500E51F9F99DA59E220321D3FBE9590AE18DC7EB816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 a080fa4eafc5c5f1aeb850eb1679ed4fbcd2160b67dba58461569472b0e8716a
MD5 2016b1db87ff164a0b2766d4e9f41d1b
SHA1 e6b94cb26de141e6b0d9674c25367f54c2d5ae15
SHA512 bfdc6394e9da099247a40b7dcff62cd9428f0584a2813b8e9cfbfe16ee96bd779fdab290f276e24e2aa48e7579fe1dd499b5cffd6171103ea5f09dcee77c1ee9
SSDEEP 192:0ZNSmXNS67DSLDSwJNS3RzoAYR/jNS3RzoAYR/YxSmESoS3RzoARfSdSwaS3Rzo0:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSK+
TLSH
T14622C0D4C4822C5FEB8B700ACB9401D41F9F99DA69E220721D3FBE9590AE18DC3EB416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 11KB
SHA256 2a538817f0bfc8a9cc12ac3c9ca7df2ebb29a96446a148b875a3e82fe91544c4
MD5 e05afdca4bd81f059c13f2490729c516
SHA1 77f92ceb2ab550ebde64400c346d3a45ec50bc16
SHA512 e03c650e8888f39e6c58c9786c99e9e3a159274d845532c5412a59f93102241bbd328f4ed7226c63e54e2d0904e675db422934d7fee17cb593a6082b00140f5d
SSDEEP 192:0ZNSmXNS67DSLDSwJNS3RzoAYR/jNS3RzoAYR/YxSmESoS3RzoARfSdSwaS3RzoS:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKk
TLSH
T1B942D2D4C4822C5FEB8B710ACBA401D41F9F9DDA59E220321D3FBE9590AE18DC7EB456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 13KB
SHA256 127c58d02c295b5030ef5dad190d3c352d0e15f6c373b93d7f16c3306fd69f81
MD5 8d14bc0c883af241ff85ffe61e34d1a7
SHA1 38ad3e4e3a538b3310828d3b562c3e81ac0b5087
SHA512 8fec6a00df8673a769c74bbc35d81f657ab79947661c6c4946ce0e69501d4996eddfbefdf5aca23f3b37d77b06ba723202e8487d5dcceb5697c1d9aab157b1d8
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVMz:w999GnnJ69EPg0naD9wLYnlP5L9dLZnB
TLSH
T1BA52F4D4C4922C5FEB8B700ACBA501D41F9F9DD659E220320D3FBE9590AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 14KB
SHA256 181d87dbca6072ed8434add23368ff17b774e3e9f4e6157e033e6afade14a701
MD5 93fe40d618e859ee32d34ea1e061361b
SHA1 d364e53dd61a9c670fb35afb5e208dce760448c7
SHA512 9315c0752839ef4383330d7590ebec11fd6a9da9846378e41c4590c6f555d42258c5595a3cc4ab576f05bf56828f4f5a2a7fbc33606672b14a2ba6ad8f2c09b3
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVMN:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3
TLSH
T12662E2D4C4822C5FEB8F700ACBA501D41F9F9DD659E220220E3FBE9691AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 17KB
SHA256 47c17d72eb4809b4dd0bfdd13d0bcb11f8ef8191aedfe0af2e4edc48f9f7d073
MD5 15e6347c119f40e8235b4f123ee4619a
SHA1 7975bf9b3c02361ae8dc3fd8fce571aaa62f4796
SHA512 b250d2fdf8169a4d9e34a9042590ea20716466bae506844557337b722b074986c6090f0e4cb91021565d573069dee058821741e1f2017300a9e3c07941f73206
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVM4:w999GnnJ69EPg0naD9wLYnlP5L9dLZnC
TLSH
T17182F0D4C4822D5FEB8B710ACAA501D41F9FADD659E220220D3FBED690AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 19KB
SHA256 79f6f13d1fa3508d5d95ee30d7a0d3d076fea9e2d63281daa576859ab0f816fe
MD5 ae6cd7aee69d2509d6ed4ea018609f08
SHA1 775932b9f72a0865787d97b4ee7316409e847e9a
SHA512 538a8bcb75c17cae91c5a98fe1ed358c9fd39b0b3d6dbe937abc61d2b37777409b150fd5ad2d45eef5582a2b0c77b9892d43809f706e0216879f87700d165244
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVMP:w999GnnJ69EPg0naD9wLYnlP5L9dLZnR
TLSH
T18492F0D4C4823C5FEB8B700ACAA501D41F9FADD659E220260E3FBED591AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 20KB
SHA256 d51b97432719c9b2433471d21101b2d396237992b4615003269bec39a942763e
MD5 589753fefd112e56f95990ad4baacf62
SHA1 d5a1aa254f58d0364359352fdedbbfd6ae972507
SHA512 8f072ce660772fc583018519d64eaee01c2f9faa58978b4a8b47f12ef5e2c1f8b3f4f1a5642d6bdef06d9127d9164321143233e4f671b0dfe368d7dc4ec7a90d
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVMi:w999GnnJ69EPg0naD9wLYnlP5L9dLZnA
TLSH
T1C7A2F1D4C4813C5FEB8B710ACA9501D41F9FADDA59E220260E3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 23KB
SHA256 7ebb0d0f72947b00d882febdb5a090f6b4111860397a90adf822776ed66d7afc
MD5 891e93ba2888fd834b9f22a1e86e909d
SHA1 7e415d4da43efd08b7e19fd6cf00cafab8f89c83
SHA512 60cd49abec0880433c55b085716614da84a1332b73b47fde89b71e25a519dfa7fe55bfbc83062ed2f7ff20ad4f89c753ff70bd48c9f92afd6d3971465b5f63f5
SSDEEP 384:03Sm9SuSvSwnSiSlxSmESoSXSdSwaSKLSmwSOSZSwlSgSxCLSmdS4SYSw3SCSVMy:w999GnnJ69EPg0naD9wLYnlP5L9dLZn8
TLSH
T1B6B2F1D4C4812C5FEB8B710BCAA501D41F9FADDA59E220260E3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 25KB
SHA256 fb244a2eeedb3b9f95a8e15c4d8cc0ee5ff1695210ec9b88dd38fb31a08b4fbc
MD5 6ff28174af99663bd4e5382b95bfd5ce
SHA1 3a9f8456c2b0606fba26b03a6de54b502cb8d795
SHA512 8debbfc14168c017353a9ba76bcdc1f4ead379d9414bdaf2d16592dcef07c03390ae87963b49d5a2344d146ceee76e5a98a6d729734cd1cab0593fbde03dd911
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi4:w999GnnJ69EPg0naD9wLYnlPV9dLZn3j
TLSH
T175C201D4C4813C5FEB8B700ACAA501D41F9FADDA59E220260E3FBED590AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 27KB
SHA256 0bfbc7c1361768f8a4e6100d859e0163d45cd4b8df04323e4bc92264045e5595
MD5 a4b303d8e26b64e7b59a764c56e4d3b4
SHA1 ce380febd7fb14b68f668e14393962aa918a5492
SHA512 091635a91fcc46ecfa11906d39d60305b57fd84600a3cb6f526870f71a7502ff08d3123828f01a68df6a3674cb7a860af4930db7c473c66acda71b15fb3acf5e
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi7:w999GnnJ69EPg0naD9wLYnlPV9dLZn3Q
TLSH
T10AC200D4C4813D5FEB8B700ACAA401D41F9FADDA59E220260E3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 28KB
SHA256 76ac89e6504bd2c6cbd4e2d6f8590e39a2045926c6e2c9bfe81937dc8601c2de
MD5 1cb1bcf96ba16bc35a3d48149ae475ac
SHA1 fc360b431be3d2db4186a1856e2838e17ef76893
SHA512 27c6a85ce6a141aea1368cc451dadaba57171cbe59c123bcb390ddcbe68e456a9a1dfaa46f6262e5168177f2c42f5128338247677be99015b4ed9642d7286442
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiv:w999GnnJ69EPg0naD9wLYnlPV9dLZn36
TLSH
T107D2F0D4C4812D5FEB8B700ACBA501D41F9FADDA59E220260E3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 31KB
SHA256 6e07e51f24d4f83a97611627b02638ee72591cdd99225259d5d103a06e2339dc
MD5 84d032aaffcebcf55c19ef948b55fa48
SHA1 906798cca1d919d5e787542a031033799b57faa5
SHA512 00d6f962d1e327ffe08e2ad1a112e7c249c2b0c37a45b2efc0fabf83fe840f385821f1a91c29df40c4100350aec667227b75f2cc78ccfa93f04be7a876f6ad45
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiZ:w999GnnJ69EPg0naD9wLYnlPV9dLZn3+
TLSH
T1FCE2F0D4C4812D5FEB8B700BCBA411D41F9FADDA59E220260A3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 34KB
SHA256 dfe1b9310784e699d89672933b66d30c7ec4753fa47b5c9d9acefdec0b4b1909
MD5 0bc1251feeb31b68f05598a2ded0f896
SHA1 c0b483ce897a026fd982efe61c278a5fbf1da4d0
SHA512 7b5a56267be59d88e5c16ed2dfc57c45aebc5ba328d92678cada477dc3762521b15a060bd9ba31d8abaea9d6c4126bc50023f721a371db4336e3b0a915786791
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFio:w999GnnJ69EPg0naD9wLYnlPV9dLZn3t
TLSH
T1B6F201D4C4816D5FEB8B700BCBA411D41F9FADCA59E220260A3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 34KB
SHA256 392e41261e11d5c9e28c70dbdc909598fceefe5e5faaa5e2d5eb7c22c5823de5
MD5 c2ad277d181af9d2301b417e3c265d16
SHA1 4f7bb179748a3e56eedb8e86ac0b7c64b2c6c591
SHA512 8a8b77d621786a40f25feceb455be3f82bb578eeea61d0675c4e44923bb54b18077722f5bbd1d7413b5fc116055f11b7556fb0c9ebc6a34f6b42ec998136f2c8
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiT:w999GnnJ69EPg0naD9wLYnlPV9dLZn3g
TLSH
T1CCF200D4C4812D5FEB8B700BCBA411D41F9FADCA59E220260A3FBED590AE14DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 35KB
SHA256 4cc71b79ba9ddd2ec108b332a867c63d39fe9d136f86891fd69cd7a123054ccb
MD5 dc01749cf22831e61cc05cfe4af830e4
SHA1 5dc58f38155c9b34f167cbefea1dbe4b895ab6be
SHA512 2f1147f7cd4e8a6b16e82204abde1c34402e84414151092fc45ac8b5a24ea17bfbb0e66fa17ef50d0309c7a37ec2d7c0509ed73e966521ff1ca73463784c5ce8
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiP:w999GnnJ69EPg0naD9wLYnlPV9dLZn3y
TLSH
T1ACF2F1D4C4816D5FEB8B700BCBA411D41F9FADCA59E220220A3FBED590AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 37KB
SHA256 b0b262faae39688bfd238292b8b4cae1d179e6a29d2ac7c503eae8acb47402cc
MD5 36a294f064d423d765be4ef3ea16beec
SHA1 3fdf34a6736c34d256b28b0a19e17ce6ed210036
SHA512 dfb9513aefc2564c2b3d23a64efb4d6cbc12f389187ddfdc7640f8becb39c649aad9a6cfeb1ed139bae8d51e590640508b5efca49119b6b1b569ab51f14ab8b2
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFik:w999GnnJ69EPg0naD9wLYnlPV9dLZn3v
TLSH
T1DB0301D4C4816D5FEB8B300ACBA411D41F9FADDA59E220320E3FBE9590AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 38KB
SHA256 71b186f3faafa3787976d9ffdd35812b4e5d72bd37268afa02a7ec386e9dc464
MD5 a97569ae31b4e6207c38f0c3ed90c2ae
SHA1 a90ef4a87277a5fb3f020f2d9e759d9b47d7adec
SHA512 bb46f75164b939a63675ae0e6b0eaf1935a33da4ecd5e01c4d64e2fc8dd77eb3c7c1823f11bc1b59fe53422f46ccb6bf6987f0829e3d62161ce513acf3cec00d
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiq:w999GnnJ69EPg0naD9wLYnlPV9dLZn3H
TLSH
T1350301D4C4812D5FEB8B700ACBA411D41F9FADD659E220310A3FBED590AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 40KB
SHA256 6f11f1fe24c853d0a098224981a5459374b1632a0e1161df0c933b37b2c0e741
MD5 a0c810f5298020683aecea3758a0639a
SHA1 90e429e9d79c83ea350b61c6daf0ce3cae459953
SHA512 69db1eb9fed673cb8688d0bca90aa5c81bb0917e7cc1f0dbf541a93eedd4472a0fbc4cdd18a0915c431391adb7124cdc62e396b492f00055a9fef88f31a7a9d8
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiX:w999GnnJ69EPg0naD9wLYnlPV9dLZn3A
TLSH
T1310301D4C4812D5FEB8B700ACBA411D41F9FADDA59E220310A3FBED590AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 41KB
SHA256 79a951be2684c9319c100ed3ff6ff764d7055ba3dd3bd1e22cfdda3231cff2ee
MD5 11a8a37a3b152eaaecb6449e11da72d7
SHA1 072cce88329824e915adbc0a047f9f725d6045e7
SHA512 0135a6cb6fb33ee89317e75e35b6deaa7121d62b91ccd9d10f11fd764543d033d9dc5f59d2e7909996753a61d70d61db8e067e91b50043a1c66233c276e18bae
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiy:w999GnnJ69EPg0naD9wLYnlPV9dLZn3N
TLSH
T1DB13F1D4C4816D5FEB8B700ACBA411D41F9FADCA59E220310A3FBED690AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 43KB
SHA256 87bec805798532f617737ac221846ebf0b07aa3056eb5c734650cfa95548bc28
MD5 6a50d50f06f29274bee09ddede2de9eb
SHA1 1d563bb1219489efed8335665ffced07ea1ced3c
SHA512 71dbe8a25211d6a5114f02cf8f57d507c7cfddfd2bda0b7904304c449cfa38e9de809507b5f7f9a5debfaa1fab7583d45e506ba56bc191f3e0d11257e5fccfe6
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFiQ:w999GnnJ69EPg0naD9wLYnlPV9dLZn3F
TLSH
T19313F1D4C4816D5FEB8B300ACBA411D41F9FADC659E220220E3FBED690AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 44KB
SHA256 e5dd86fb4b584ba7763fb9e4cc50af0bf0646537aa9d339787361f8ae660b51d
MD5 269332b0fb46a5d069be0955e615eee5
SHA1 ab6cc4980a268251121fee430ec53ec53aa4b5cb
SHA512 ccef4fdb45606d4be2f5ed7df635fc041f058afb1a451845a28bc3b95b0d42998bde1fee8c9649cf35da5b46188a6cc4c1a4dbc6a0423422680629b51a9301ca
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFio:w999GnnJ69EPg0naD9wLYnlPV9dLZn3J
TLSH
T11523F1D4C4816D5FEB8B710ACBA411D41F9FADC659E210210E3FBED590AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 46KB
SHA256 2ff608bc0ca77090626980b546032fb78fc30529e9fd11fccef717c519b0ca60
MD5 653bddbd80427e1f01fa966f0403d120
SHA1 1f3e92669d50c4b9a7e3365bc91be270d2270596
SHA512 173f2a5b3ce4b206538acf50ea9fa69e68d4224a33b40bc831904e30edeb7b20c7910e781a1a0508e053aaa90c86e3fe59eb3f501a8758ea9dbfb0b0a410722c
SSDEEP 768:w999GnnJ69EPg0naD9wLYnlP5L9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFii:w999GnnJ69EPg0naD9wLYnlPV9dLZn31
TLSH
T12923F0D4C4916D5FEB8B310ACAA411D41F9FADC659E220220E3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 48KB
SHA256 6cbd3bff809127415b1f310965ab57411b3acbab8a22606d25c31369adebf86d
MD5 a6ef189b11dd7e4fc8e75e390e4eedcb
SHA1 48ec2651d1582e641c925bf912726c615240afae
SHA512 1b205267cddb5b3892abe77e365d63e982680d406fb8181de262e3fb08c56f1021a4d76e8ded9eb532844ed54ee20c9a07566f56443e37697ba132e0ab460d07
SSDEEP 1536:w999GnnJ69EPg0naD9wLYnlPV9dLZn3NP9X4zrInr9ePa3MnQ97tB4rnD9heFi3e:wT9GnnJ6OPg0naDWLYnlPVDLZn3NPl4+
TLSH
T15F2300D4C4816D5FEB8B700ACAA511D41F9FADC659E220220A3FBED590AE18DC3E7857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-3-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-20-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-4-0x0000020A505C0000-0x0000020A505E2000-memory.dmp

Download

memory/1800-5-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-6-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-7-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-8-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-9-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1800-0-0x00007FFBA7BCF000-0x00007FFBA7BD0000-memory.dmp

Download

memory/1800-10-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/1840-67-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-63-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-62-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-68-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-72-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-69-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-70-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/1840-71-0x00000204B4570000-0x00000204B4571000-memory.dmp

Download

memory/5372-22-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Download

memory/5372-34-0x0000000074E90000-0x000000007564C000-memory.dmp

Download

memory/5372-26-0x0000000005160000-0x000000000516A000-memory.dmp

Download

memory/5372-21-0x0000000000200000-0x0000000000706000-memory.dmp

Download

memory/5372-25-0x0000000074E90000-0x000000007564C000-memory.dmp

Download

memory/5372-23-0x0000000005780000-0x0000000005D3A000-memory.dmp

Download

memory/5372-24-0x00000000051C0000-0x0000000005252000-memory.dmp

Download