Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
Wic Reset Connect_NEW.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Wic Reset Connect_NEW.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Wic Reset Connect_NEW.exe
- Size 12.3MB
- Sample261012-vnqjmsg12k
- SHA256 7ffb725767c8ca659afc119dbef273b5327047b5b4b1744d87773e53850a58ec
- MD5 e7995b10115c8e04c5734be132d2b738
- SHA1 47f8157ad2d28364e2ea5a4a112b9242b8d2b89a
- SHA512 9040c0090a409602f4ff4008733dc7e3b0604e332b2e3c25ce03dd7981de65eee68330faed2f62a72537447f1535b29386f6b2f62c575914488d8aef5b6d6599
- SSDEEP 196608:L3M4cauCjYueGNA3w/7zHRMjdc8ojDIg9Cbk/V8YSqViSHF2m/lPd1/43V1dMeaa:L3CauodeMA34MjCDMKiS5616ewfe
- TLSH T133D6F112BFDA8071D492153189BFE7FE6979AEA01B3456C356903D2BBD303C2193A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETCE0C.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETCE0C.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\eusbstub.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\DRIVERS\SETCF51.tmp Wic Reset Connect_NEW.exe File created C:\Windows\SysWOW64\DRIVERS\SETCF51.tmp Wic Reset Connect_NEW.exe File opened for modification C:\Windows\SysWOW64\DRIVERS\eusbstub.sys Wic Reset Connect_NEW.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbstub.inf_amd64_b9de7c1cded4a198\UsbOverTcp.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\UsbStub.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDCC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDCC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\eusbstub.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbstub.inf_amd64_b9de7c1cded4a198.ini DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDBB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDCD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\UsbOverTcp.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbstub.inf_amd64_b9de7c1cded4a198\eusbstub.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbstub.inf_amd64_b9de7c1cded4a198\UsbStub.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDBB.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3ea9327d-035f-824e-8dc8-2eb1ff6d2108}\SETCDCD.tmp DrvInst.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log Wic Reset Connect_NEW.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Executes dropped EXE 2 IoCs
pid Process 1108 fusbhub.sys 4736 eusbstub.sys - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wic Reset Connect_NEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wic Reset Connect_NEW.exe - Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver Wic Reset Connect_NEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver Wic Reset Connect_NEW.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Wic Reset Connect_NEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Wic Reset Connect_NEW.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3180 DrvInst.exe Token: SeBackupPrivilege 3180 DrvInst.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe Token: SeDebugPrivilege 1100 Wic Reset Connect_NEW.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3420 Wic Reset Connect_NEW.exe 3420 Wic Reset Connect_NEW.exe 1100 Wic Reset Connect_NEW.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3420 wrote to memory of 1100 3420 Wic Reset Connect_NEW.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wic Reset Connect_NEW.exe"C:\Users\Admin\AppData\Local\Temp\Wic Reset Connect_NEW.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\Wic Reset Connect_NEW.exe"C:\Users\Admin\AppData\Local\Temp\Wic Reset Connect_NEW.exe" as_admin2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1100
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{566b44cc-3f17-264d-ae96-097bd7042e5d}\UsbStub.inf" "9" "43136b9fb" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "C:\Users\Admin\AppData\Local\Temp\helpwire-portable"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
C:\Users\Admin\AppData\Local\Temp\helpwire-portable\fusbhub.sysC:\Users\Admin\AppData\Local\Temp\helpwire-portable\fusbhub.sys1⤵
- Executes dropped EXE
PID:1108
-
C:\Windows\System32\DRIVERS\eusbstub.sysSystem32\DRIVERS\eusbstub.sys1⤵
- Executes dropped EXE
PID:4736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Electronic Team\HelpWire\gui.log
- Size 342B
- SHA256 e7b4fc9371a57ebf7265092f7ad82470f3d9cd0249f1c83f8043a8bb699e67fe
- MD5 dd66c19c310c66391c00c11f8e78a215
- SHA1 96f0f278c83954e4c31686b6e44f368c09625408
- SHA512 f644e4fd07a05064f5511281b7fe0dd3ef7dfa52c7eeabd47766a8bc13ba581975047c11fbc851dd91e001fad435373ce781700ed242b2fb9f37b3e0839af847
- TLSH T182E0C739405421A037A34022B723FC30C232E9D6130EC039F64C0228A3BA3C0EEB91CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HELPWI~1\UsbOverTcp.cat
- Size 10KB
- SHA256 1d47389ff4a9ceed2b784640b33d334848c7c07ead454167b286993d4699ee50
- MD5 179908a29b19f6c42174a62890c03f7f
- SHA1 c16f2e234e819efd7f279a910494e534bdcc4fff
- SHA512 621e92c14532c0b67039c997d878dc6e2d9b2a0966b599a618871559c9b8ee2f99a0d3e67b802c04b5d655089cd50f52dad9668e7592388c16e2c2629957ec30
- SSDEEP 192:fDtsW7yK3J8EsSCcWMXooyKfPFWQFc8JxZAqnajKsB3GUV:p3WGrPFRK8J/AlGsB35V
- TLSH T1DA32D8D249AC0083D993A97057E8E5977C3D6BD76C10857E21ABF7A40D93BC6E70843E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HELPWI~1\eusbstub.sys
- Size 44KB
- SHA256 be15b80911f6e0aa7af90a093ae088897923d9c455958cc0e666162e7376d1f8
- MD5 e18a1dc29e88f76475d177c6aac4c54d
- SHA1 9cf220c508d854e21ef7f9e7726d763d74778f40
- SHA512 8b5196b966f07bd2e209795c6aa6b525a368a60ce25a83b448637f089897f32b05149113c7ab9946a842789a4061efd745309a3d8776cf2aa7cd15a3212d61bc
- SSDEEP 768:cV0EfHZ3LOit6Dp9E+8iROobNGOiwvp9E+8iROhw:cVPfRLOIGQ+8iA+NGO9Q+8iAhw
- TLSH T121236CE24A7824C2EA93A870D2E8D66BBD7173A27F5041DB14B5C14A1E97FE07B3501F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\helpwire-portable\UsbStub.inf
- Size 2KB
- SHA256 8e47beba55d12ea598c4726dc291e93ec03e0bc0e8b60354a571dd99fe01880e
- MD5 e0d9b5fca4da4ce80dfa0ae5a024bd46
- SHA1 180efd641dbdc38c908d5ed5b9fe4b5ffcb155a4
- SHA512 35bcf8221cdef8c06ec1a415aaa9baf40a0f0efef6b08f1e683128461b23b27d7e9072ecd27513a65b7048d3be5da11143353d778fd3954bbf7f299b312a56ba
- TLSH T15C412F0A6A7B8EA47093D3B136875CCFE4143D4951CD044AB16CD090ABB0A9C7ADC3EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\helpwire-portable\fusbhub.sys
- Size 127KB
- SHA256 a89a9f7c0fde1f951992757cceaeefa09f1a969ccd983cfd2d72e3c959eed3ef
- MD5 b5ff7b6259e54dab0fa90b3a1a2a6363
- SHA1 dad1d7e7d4bc8ca79e7f4d0bf385a2769f98515c
- SHA512 4c8afb95d70ff4174409a165de812d558dc6dfac917dd11fb1349ee7a9be75b423989b081db541b03626d41d3ff7218f53b48430afca23b97b0d15cbf591075e
- SSDEEP 1536:U8faNzECltkdD+0hT/ctuxVL6GCtrhKyZTeUg9oJbLIpuzHsKUvW7O+Q+8iA1nOQ:7yq+0h4uVmGC/eUgaMpumOAD23Da
- TLSH T151D35B8622BC10D9D2E294B8C251C55BEFB1B45A5711A3CF03B8C68E1F5B7E0BE79319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\usbstub.inf_amd64_b9de7c1cded4a198.ini
- Size 420B
- SHA256 6c3f872935f3b2f0809d191bfad42f4f91678d33f019c53a826d4b8df3db1a40
- MD5 5005ba6d78cc16970b5d8125070b6de0
- SHA1 c06d723abb4b15d6372d7d809a3c52941672a3ff
- SHA512 3d46701c99f7f7d397b583a0956d4014f991c803c14bfd2e4b6632222d1829f7f811460fda8ccdb95fe7b1c5bd5494665122d448ec87933b690c53deae71f5d6
- TLSH T10BE0A00586F6F6CE0D0D5617210CB17FF429E201AC033C96B140B4C0AF88590D4D6B9E
- MD5 SHA1 SHA512 TLSH