bfdb4e964a9bd972f3946b43c5962e35a3859c8bc3cc639c6ab1277373d9f065

Analysis

user interaction
yes
max time kernel
7s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memz_payload.exe
Size 1.5MB
Sample260930-tff5kayhpc
SHA256 bfdb4e964a9bd972f3946b43c5962e35a3859c8bc3cc639c6ab1277373d9f065
MD5 2a81a07e2aec3a507aebccfcf82a8ddc
SHA1 00078a9a4a214716555461d8db363dbf71675e59
SHA512 ca009db83e23aa83a39facca47cc18e49e82021471e7ea0ab8b52ea49dbd27ec4053cb55701432403ab0824dd333e558402e303a7745ee5fa337a0afe7bff17d
SSDEEP 24576:T90RLgMROWi1cDG/Wx1QWhnMXRpvlGB7n6sBtXR7hfw:TOZg+OWV1h6UnV7T
TLSH
T1DE754B03A7E6CDEAC896B73591CB2719B634FC5017A3ABCB531052216E537D99E3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2316	bcdedit.exe
1336	bcdedit.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5736	cmd.exe
1812	cmd.exe
3660	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3540	snippingtool.exe
5952	snippingtool.exe
3244	snippingtool.exe
1784	snippingtool.exe
6404	snippingtool.exe
6908	snippingtool.exe
4204	snippingtool.exe
6228	snippingtool.exe
6856	snippingtool.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2148	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1712	vssvc.exe
Token: SeRestorePrivilege	1712	vssvc.exe
Token: SeAuditPrivilege	1712	vssvc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4204	snippingtool.exe
1364	wordpad.exe
1364	wordpad.exe
1364	wordpad.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 5736	1884	memz_payload.exe	91
PID 5736 wrote to memory of 2148	5736	cmd.exe	93
PID 1884 wrote to memory of 1812	1884	memz_payload.exe	96
PID 1812 wrote to memory of 2316	1812	cmd.exe	98
PID 1884 wrote to memory of 3660	1884	memz_payload.exe	99
PID 3660 wrote to memory of 1336	3660	cmd.exe	101
PID 1884 wrote to memory of 4204	1884	memz_payload.exe	102
PID 1884 wrote to memory of 2380	1884	memz_payload.exe	103
PID 1884 wrote to memory of 5384	1884	memz_payload.exe	104
PID 1884 wrote to memory of 5184	1884	memz_payload.exe	105
PID 1884 wrote to memory of 1504	1884	memz_payload.exe	106
PID 1884 wrote to memory of 4620	1884	memz_payload.exe	108
PID 1884 wrote to memory of 6140	1884	memz_payload.exe	109
PID 1884 wrote to memory of 1760	1884	memz_payload.exe	111
PID 1884 wrote to memory of 3272	1884	memz_payload.exe	113
PID 1884 wrote to memory of 4892	1884	memz_payload.exe	114
PID 1884 wrote to memory of 5352	1884	memz_payload.exe	115
PID 1884 wrote to memory of 892	1884	memz_payload.exe	117
PID 1884 wrote to memory of 736	1884	memz_payload.exe	118
PID 1884 wrote to memory of 5240	1884	memz_payload.exe	119
PID 1884 wrote to memory of 3540	1884	memz_payload.exe	120
PID 1884 wrote to memory of 5752	1884	memz_payload.exe	121
PID 1884 wrote to memory of 5188	1884	memz_payload.exe	122
PID 1884 wrote to memory of 2428	1884	memz_payload.exe	123
PID 1884 wrote to memory of 2072	1884	memz_payload.exe	124
PID 1884 wrote to memory of 5952	1884	memz_payload.exe	126
PID 4892 wrote to memory of 1364	4892	write.exe	125
PID 1884 wrote to memory of 5224	1884	memz_payload.exe	129
PID 1884 wrote to memory of 2032	1884	memz_payload.exe	130
PID 1884 wrote to memory of 5348	1884	memz_payload.exe	131
PID 1884 wrote to memory of 1524	1884	memz_payload.exe	133
PID 1884 wrote to memory of 4524	1884	memz_payload.exe	135
PID 1884 wrote to memory of 4648	1884	memz_payload.exe	137
PID 1884 wrote to memory of 6068	1884	memz_payload.exe	138
PID 1884 wrote to memory of 4756	1884	memz_payload.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\memz_payload.exe
"C:\Users\Admin\AppData\Local\Temp\memz_payload.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1336
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4204
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:2380
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5384
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1504
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1760
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:3272
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1364
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5352
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:892
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:736
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5240
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4480
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3540
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5752
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6132
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5188
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:2428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2072
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5952
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:4524
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:4648
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:2084
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:3644
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:3812
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3244
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6080
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:3316
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1784
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5860
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5976
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:4884
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:3388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5288
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:5652
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:4612
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:3696
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5448
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5872
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:284
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:5848
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:4048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3720
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4044
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6172
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6228
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6288
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6588
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6320
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6372
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6404
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6464
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6504
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6532
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:7144
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6568
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6628
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6704
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6760
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6784
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:6828
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6856
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6880
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:7592
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6908
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:6948
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6420
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:6484
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:6472
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:400
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:7684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6888
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:1340
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:7204
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:7252
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:7308
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:7364
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:7404
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:7468
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:7504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:7560
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:7604
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:7664
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:7704
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:7752
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1836
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:7808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:7880
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:7940
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:8028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 896f1d855c6ed5e0796890ea370785bee07b098a4ee01ff5f8466269614ee1b8
MD5 3e1a3fa765dd032ebe97ab006138b58a
SHA1 d8a13a580be99f9e2cdb80ee34fbd58787da287b
SHA512 cd86ad262b79a10ef986998edb65a77a295a29b5e43b73e30ff27e405e2de1ad5d6e1dfa96e30551b1b9159c0002dcd6558aba29b6c03a6f9022baa661019069
SSDEEP 192:0UOSm/SHS3Rzo5R0S3Rzo5RkSDSwiOwSmESbS3RzoCRSESmFSRSw6S3RzoSRy+SZ:0RSm/SHSNSBSDSwiOwSmESbSaESmFSRg
TLSH
T15AF10DD0C4817D0BD78B700ECB9911C41F5FB8D669E260620A3F7ED9A0AE19DD7E7846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 9KB
SHA256 451bf0efba18b3b5e993de384a6b405fff26ea1c7d7f97095a8438dbeab85610
MD5 40f75867900ffafea6dcf5ddf59fc63e
SHA1 a1d2b468b28074d7ad8f7d82ae28cfe00a9f6c50
SHA512 fb05f7f839bfbbbfb65362562e7f29748812e081fb009bdf160f86e11d2203ab134e779c411923824214f5289c4358c38cb0df65e41d16ee7ea583afc8c6dda1
SSDEEP 192:0UOSm/SHS3Rzo5R0S3Rzo5RkSDSwiOwSmESbS3RzoCRSESmFSRSw6S3RzoSRy+SK:0RSm/SHSNSBSDSwiOwSmESbSaESmFSRp
TLSH
T1F8121CD4C4817D1BDB8B700ECB9811D41F5FB9D658E260620A3FBAD9E0AE18CC7E7846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 21d061b3df694acfcf7b4461bbdd0c702b53a0904ce5057033e382d9ff495e3f
MD5 86b74469781240939fed1411f736636c
SHA1 542b2b8c25571bfdf86e9986300140ad6212e7e4
SHA512 c03c7639288d444bf34d9affbc9763e0561ef19c59aa53c93fbf6369a62dbf03ebde03f71b736f989a18a20e0e9df205076074e34bfaea76ec633383e70c7c6e
SSDEEP 192:0UOSm/SHS3Rzo5R0S3Rzo5RkSDSwiOwSmESbS3RzoCRSESmFSRSw6S3RzoSRy+SG:0RSm/SHSNSBSDSwiOwSmESbSaESmFSR/
TLSH
T1D132FBD4C4817D1BD78B700ECB9811D41F9FB9D658E260620A3FBED9E0AE19C87E7846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 16KB
SHA256 625a6ca3c2073d64e5ad2f5d9f147ec815bda348d9ad5a79a7b5c38f4fba4467
MD5 f9143fd2e474e686e4553ec603323a0f
SHA1 d62c83fd51b67952abedb1b2d4ad9cb5834eb462
SHA512 ec8efdc9182be3c02f8c2b1252879984e7796d716f1af8eba7a4be21d001c1efb58232460df5ce0c0d76c77ca9587d98c1fae2b4a469dadde878ab0c5c5a2de4
SSDEEP 384:0RSm/SHSNSBSDSwiOwSmESbSaESmFSRSw6Sa+SmlSESOSn/Sm7SXSMSYSJS4SMSu:Q9/cOSWnfw9EwI9F8n6m9lHXS970fD+T
TLSH
T1DB720CD4C4823D1BDB8B700ECB9811D41F9FA9D659E26062093F7ED9E0AE19CC7E7446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 18KB
SHA256 8a67af5a9aeee15709daa52aa5a3e9e6f8f98eae0794199875534de2a2aa04cd
MD5 88f5bdda8dc4796ad270a7fb1cb3686a
SHA1 02060fa6c6f7f5891955cd1ae441410cc7a97c5d
SHA512 27c80c2523859f75a07ad8dc6c138fb99e5c3cabdac147efe7114c86e42f9c9ed8cb692e2f0798ee18f68f5b5c18b311a4e4ce4963cfd194c97d2bd61cc56377
SSDEEP 384:0RSm/SHSNSBSDSwiOwSmESbSaESmFSRSw6Sa+SmlSESOSn/Sm7SXSMSYSJS4SMSi:Q9/cOSWnfw9EwI9F8n6m9lHXS970fD+t
TLSH
T130820DD4C4822D1BD78B700ECB9811D51F9FADD659E260220A3F7EDAE0AE19CC7E7446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads