98aa14a1acdb9aafb212c27f7dbfca84f2d8c65961fd6b3dbe387347cdc9a7ae

Analysis

max time kernel
1s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
Size 24KB
Sample261014-mdrd7as1es
SHA256 98aa14a1acdb9aafb212c27f7dbfca84f2d8c65961fd6b3dbe387347cdc9a7ae
MD5 0fd31b9b7c1e55daa5fdfe67196fc3ea
SHA1 445de71ea43e94b416b7732b91fce7dd5590f3c2
SHA512 383e3e2ec04244b7b87cb0bc39138a5b70bb6453abd5a1bc7d683ce1a56e79620a610fd565d292ba27ed61e4f319270843b463f49cb98468f7a1e7b279c7448b
SSDEEP 384:HD+qvPXAq7l8jQCy81MfIrr4AX9HzTXCu4R+N:CqvcsUHzTXCDE
TLSH
T167B265A3B79CD8A7D7D285B20876C9E45129FD244681CF5F8199392CEC352A3BCF071A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	write.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	mspaint.exe
432	mspaint.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
432	mspaint.exe
432	mspaint.exe
432	mspaint.exe
432	mspaint.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1944	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	84
PID 2636 wrote to memory of 432	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	85
PID 2636 wrote to memory of 2100	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	86
PID 2636 wrote to memory of 3052	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	90
PID 2636 wrote to memory of 1656	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	133
PID 3052 wrote to memory of 4724	3052	write.exe	93
PID 2636 wrote to memory of 4988	2636	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:432
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4988
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1796
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:1440
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4080
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:1548
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3788
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3184
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3780
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:624
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:2196
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3116
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2476
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3532
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:2256
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1588
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4224
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2712
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1704
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4848
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1488
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3360
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:64
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4380
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:3696
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4720
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3432
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3424
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:368
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4180
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4436
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4240
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:812
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2924
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:1656
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:3008
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3452
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3688
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4232
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:1140
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4144
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4788
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2988
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4628
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:1508
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:680
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1884
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2076
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4680
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4156
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:384
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1204
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4240
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3044
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:3744
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1464
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4840
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4416
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2644
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4824
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:2792
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:2964
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2176
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4112
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4124
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1792
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:2744
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4908
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5140
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5284
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5380
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5364
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5400
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5444
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5640
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5784
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5736
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5760
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5828
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5948
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6036
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5996
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6020
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6096
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:3980
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1736
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1204
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4564
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5300
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:3640
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5436
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5696
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5248
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5272
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5668
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6088
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5852
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6000
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6012
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5124
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6160
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5920
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5492
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6212
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:6352
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6476
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6412
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6448
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6528
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:6640
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6732
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6696
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6720
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6792
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:6984
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:7120
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7024
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7044
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7072
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:1744
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1352
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6364
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6360
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1932
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4644
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6988
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6208
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2436
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2420
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4092
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4060
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6396
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6332
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6672
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:7064
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5604
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6660
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6384
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5708
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5920
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4780
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6872
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2152
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1956
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:2188
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:416
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1628
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5524
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1396
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:6684
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1016
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6612
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6660
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6228
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:4764
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6744
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5796
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1552
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6788
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5792
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4796
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5644
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6904
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4632
- C:\WINDOWS\SysWOW64\write.exe
  C:\WINDOWS\SYSTEM32\write.exe
  2⤵
  PID:5476
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1740
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5720
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4432
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 13KB
SHA256 48c7ec411940c3abf780fe63f1b03d332a76d980e2c74fd45cf46b638069d286
MD5 3a083170c3db4ff50a007fddd733886a
SHA1 077926a2241453e584c05656685941322549eaca
SHA512 e5e8f0c4b4d5a5d329358f6222714ea5f09d181ed33d30f5922e61aa7cddd51da578fdb0ea81fa18807db8c42dea376c3db52cf6e86cf17e4bc483ddac1aec85
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSD:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWm0
TLSH
T19852FEC4C4816D5BD78BB04ECB9901E51FAFA9C659F210320A3FBF95A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 14KB
SHA256 16e35adc2ad4a181ab7f7d3ae81ca968d9d6c3bb88f3286325331a2c701040cd
MD5 9b7fb9d31ab781edcb14e5890eb05675
SHA1 8131b4cf7c850844d1bb00d10bbe8d87bd953d36
SHA512 f8096c1431eba6040c66be41f80d9a7810ef9947f1c1fd1c1801a44e94a2fdbd6f43fb9aefe9fe7fed7100ce4e53f31bcc1b6ec15d49b6a0bde1953deae63313
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMS6:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmt
TLSH
T19E62FEC8C4816D5BD78BB04ECB9901D51F9FA9CA59F210320A3FBF95A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 16KB
SHA256 cd8c7cb033e4be3c440f4528e60c9f1ff77ff967b38e2f1513b9683c03658437
MD5 fb2ceeea6344476d7f955c28150fb0e7
SHA1 d716e3b4241eff7b7ef3a4054f82d75cfbeedeb4
SHA512 2028dd358be279ee825f7ebf76e939f58032046fb06ee379fc11488b69102714f83d39439dc9a2ea421975667f197d69fd574293d876d926ebd150f1e437a29f
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSZ:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmc
TLSH
T16072FCC8C4816D5BD78B704ACB9901D91F6F99C659F210320A3FBF95A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 17KB
SHA256 ce12d75d6b7de11c3b3b4146a77371773cb8517a23c649c32fed55c8210babab
MD5 0eef4bd81ebeaa0b54b952d7aa0046b0
SHA1 be3d4de37a321b150ae4e7d786f6d49177298a8b
SHA512 0d7017d3f3216e749aff7790ac4f9b57442ef2093d564c4e36f7739b310c568641e22618cc6b511a2fcbf392a9847ebaa970ab947387abb37cf0b394d0897e42
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSG:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmh
TLSH
T1DE82FBD8C4812D5BD78B704ECB9501D91BAFADCA59F210320A3FBF95A0AE14DC7E7852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 19KB
SHA256 28a6440b2f3a8c4f0584193e9c80120a3a47de729e9694d56af950a4fda237eb
MD5 3aa7bdc2bb82519921ad6c8b6d2b88a4
SHA1 79a28b02471ea294ded0b74f0375463256895337
SHA512 b0edec704c0c9125db300d8c0431f671f0d2aaa44767b05ad463427ef5531356b3c591fbfc0c7321cb729759d42fcf85dc71c448878f5afe5f8fe21e1972dc1c
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSt:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWm8
TLSH
T11F921DD8C4812D5BD78B704ECB9501D91BAFADC659F210320A3FBF9590AE18CC7E7866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 20KB
SHA256 5782ee74d8988dde90336f427bde1157ad683257b6e80ed5417356bde7498c67
MD5 6dc0d22062bc365bd44c918208979cec
SHA1 def742a065ebc180f82bc9e3f01ac42959f8ce5e
SHA512 b95f5e0d085aa0e532fcaeccb59baeeb9444a28fc94f7d99884b353f7235b508938f31b35ccb65e3302ba2223ef14e9851b89ba89fc3e5be385fa3910db0c3de
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSD:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmg
TLSH
T16DA21DD8C4816D5BD78B704ECB9501D81BAFADC659F210320A3FBF9690AE18CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 22KB
SHA256 4461c8ab0b120c03ec1720d328df054d91e87f4cba82025dd9de6327346ea314
MD5 6926c2994f8029d32051871d66366c39
SHA1 eb29c4e109c456c3dcd68d8a93896fc84ef3b1f0
SHA512 c0bcf9d658d65318a37bd3e0d1ca49a9d2f7f7326ab64cbea799e09169ec3d82b7d336ff56d7caacb4a4a2c1150a47c34a92ec67521289560daccc64eb08a63e
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSy:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWm3
TLSH
T134A21DD8C4816D5BD78B704ECB9501D91BAFADC659F210320A3FBF9690AE14CC7E7852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 23KB
SHA256 7b6ac71d2652ce8d007e0bcdacb70ea6bb4a48bdac7bb2b9efc07e1450eace47
MD5 8598f171aaefa00dd82dd75316a6f088
SHA1 d5f75460354ee43bb00992dd955e0e4c78459232
SHA512 1b963b1fd56add79696930aca9ec8b0ea9b582b9833d7fa4db668c467f94ee96796662a73b6fb0e86b44efe9fb2e102dcc7e91585f074633ff51b8c8dd2b408d
SSDEEP 384:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwisSmiStS/SwASdSWPSm+SCSISBS3SwiMSI:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmP
TLSH
T1EEB22DD8C4816D5BD78B700ECB9501D91BAFADC659F210320A3FBF9690AE18CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 25KB
SHA256 eb5c5f83ca0f47e00638babb9195e65b5faa3a1b593aadca94d0cc284c76d670
MD5 5e0b5a845a0ddc5dcaff832a5109dadb
SHA1 d31a76030ba37b9a8b20221127d802c916142f7d
SHA512 5e0d558023de589fbeeb15f8ddc37de7cf908855343e16e815ec41d9abfe515b5cd4c63967fe0d970b86f45192fe3de21fe1b1a229eb455a980c538fc610f08c
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//a7:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWm3
TLSH
T1F1C22ED4C4816D5BD78B700ECB9501D81BAFADC659F210320A3FBF9690AE18CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 26KB
SHA256 d79a4557351600d49818aa0a92b9629f2d7513434021e05e644c7c5ad7dbfde7
MD5 1a5d116e862020af88214f2b723879e2
SHA1 ef972512ac3afe9b6c9b2d4175c0fe93fc178a57
SHA512 2e218721686c7135154e5c38c5851a7446bf2e04bb547f6316a6229303e279973c034cb1b262588c92a912a80a4d05ff61bb244fad547f3815b61744c3f56f05
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//a8:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmA
TLSH
T1EBC22ED4C4816C5BD78B704ECB9501D91BAF9DC659F220320A3FBF9690AE18CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 fef1a4bea6894e5c7fc06deb06b69efba4663434f7f456b5c02f9b97ed8d50d5
MD5 fbd0d68374d43a0039c5110e76277722
SHA1 06191f16052ed556f53331e42f3bd8876c666272
SHA512 172fe500e23abbf3e423104dfcf6f821023afcf23133ee718a3afd9f4b7a8f34fcaaa4a7e7ee6a5b9a61f7bf95ee06655b9d38276c1b80118dd0836d85f9b299
TLSH
T16F31CDC5D1816D8BD7DB704ACE9A00E50B5F99C649F110211A3F7A8690FE1498BF7816
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 28KB
SHA256 ee751d280645fc2201103be4d53fe87f6f497c34819adf1bc73744a0383cf1af
MD5 a6e85ecf54eaa67ce5d7b608eeecaa5e
SHA1 f0b2b13d979a5de0d482e986bca8fc769464b487
SHA512 c6024b6e57c50da308910fad3348cef20c66978211e222d37ea06c98809bed9488c743fd377d9d62b9422a59cd802070bf7b5fb23676585fec1b7f172de9e629
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aq:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmG
TLSH
T185D22DD4C4816C5BD78B700ECB9501D91BAF9DCA59F210320A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 29KB
SHA256 3e0b0421ce100a3ea8fa4327e119738cc4c86316d7592352af98e243da48bc8e
MD5 ee1e48966b05f6b74562eb9402782c1e
SHA1 76bac2842f864d52cdd2741ec6a832b6d3f42e32
SHA512 ebc468aae113d8702e1c62ab39fd41347e904260f5c349fea206dcaafbfdce1421a5aa2abf1c3bdffd2c76a1dfc0cce89caa1ad54e3cbd3c54eaeeeb017e196a
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//av:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmz
TLSH
T1BFD22DD4C4826C5BD78B700ECB9501D91BAFADCA59F210310A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 31KB
SHA256 937e490257c81185296c147f60976bbac009155b34d8ddf95006969f9517e864
MD5 9df21cae538c64fde4261a4365869068
SHA1 51652b38f57ae37bb5e5779c2710e57d81886db8
SHA512 c82795fb2a161150ba2d3214afa909280ad7efe31b805390b95a1f5fedc71ef7467a3fd9fae98ef0cf2581c798c87a6856f8c3bc93fff03d1def92d0138e90a4
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aA:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmU
TLSH
T126E21DD4C4826C5BD78B700ACB9501D91BAFADCA59F210310A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 32KB
SHA256 a51222229d0283720bde7d15b8e3fcde7025d38cf4d97532638d0c381c661d95
MD5 a9263bcdfd4940dfaf138f35ac99e8c8
SHA1 7c34d4375de68b181bfd9fec6979af971cb543e7
SHA512 af928202b7d3d3a35d8a960da0db84abf7eb486d5b1408069b1a41299d278646cf18450f8bc4ae4fc2e7aef3e93656355e3a8c376a8069a0ecddec1afeebf5ec
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//ac:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmw
TLSH
T19FE21ED4C4816C5BE78B700ACB9501D91BAFADC659F210310A3FBFDA90AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 34KB
SHA256 99476f52e7a78312b72d600be0cb2e597a3e3577a2c3a3119f556410a62ddb83
MD5 254e8704fe643b96c2488aa0f898d168
SHA1 a1d0b7df4a9e135144f6c2ca63075413adaf28ec
SHA512 e5135a3a29677995cb72c5c2d42038e1abadffdd0567b79cf87afee28e850ae12ef0e2fea2d5954b148ee3ea50a30813062b71588a56ea50befaf804294e4963
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//ak:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmA
TLSH
T182F21ED4C4816C5BD78B700ACB9501D91BAF9DCA59F210320A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 35KB
SHA256 5ec2d6109095f8aac270e04190a5d08ddee74d47064223e199793db8e40e8e33
MD5 a4c5d36dd1147a53c95b1bda796ec6db
SHA1 786e7615dea2e266ffc84d5be6d211ddd8b9c9eb
SHA512 d78a404075e835a96582fc42a4057b9c6af02edbe9aea2373c47b2953cd0d8bd4760da945e7fd3dd63fcbdb1bdbcb98842ce1d1dcf59cd487d547643fae85675
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aD:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn
TLSH
T173F21ED4C4826C5BD78B704ACB9501D81BAF9DCA59F210320A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 37KB
SHA256 e4f16a71cc558ad85e72cf3a9859fb464ec6f3e25135387a801d2e718fa75227
MD5 f3e5678dcee354bba7d6d3e5aece01d6
SHA1 c0834c996df2cf06df36e3ee553cc6cafede53ec
SHA512 922ed52b4ad76a1858a20db642bce716997c640dc2f8f2e0c4d39796e995b9bf7dc16a12958590316d3a76940610b5600386a4fcc15c4271009ba9fc649205f9
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//ao:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmk
TLSH
T17C030ED4C4826C5BD78B704ECB9501D41BAFADCA59F210310A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 38KB
SHA256 edb0a779629d2e2ab1761cbcf22b3f355eb665aaab1ed9be29e2ed74def8a4c7
MD5 7c445e45fa8deb0a80f5d4b7ba4c82b7
SHA1 960d027dc8ffcff4f717de64fbbbb1809367346c
SHA512 bebf0e7760d402ad1836dd8d9b917c5ab743d19e5260ef89627c036f488cc90e122b9830694c1bb09aa90075b232c4b5c175e11c64965bb707c44ab444620e3f
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//al:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmZ
TLSH
T19A030ED4C4826C5BE78B704ECB9501D41BAFADCA59F210310A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 40KB
SHA256 8a45951488b3edda13c3da533b650925ca90f8cbe4a9983f1add18e93ddd2520
MD5 38ba349dc27c9296e48d9f515e88ac0f
SHA1 7046b2596aa7350c0917676cefa7a5325a068b2c
SHA512 88b1ee98797d56e1e534065402e5766ba01bf7b01491bc1ecc90f7f8f6a83e241ba700e4624ab785d12c1d326914b485a0bf261fe247bcdf184982d643ffe62f
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aP:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmb
TLSH
T1F5130DD4C4826C5BE78B704ACB9501D41BAFADCA59F210310A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 42KB
SHA256 a83fc625e8b45a16eb7b71905322cf41d2d4adac6f0fd7d2a063fc862956df23
MD5 6b837d6ed73c8e75b3553aa1222f0610
SHA1 35df322df6c6934b9271b3a60c89911ce686a4a1
SHA512 959896a86a44b670ff9ce79b123a7b28952bedd17b884fc77f7e9f97d1360ae4883d681819408500f6a47af3eb69f79977f217c6388aa7ac5b810e4a999a3403
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aS:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWm2
TLSH
T12A130ED4C4826C5BD78B704ACB9901D41BAFADCA59F210310A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 2KB
SHA256 2ab400c7429027e55741b3ae6ae81bf566674a792e5bdd0f1c242b1068b714d1
MD5 1b16fe04dd304cbba1e08e616d2dfc1a
SHA1 c8757d05ed1a1b15e9ae27b16276d82015545c19
SHA512 3c8dc9da0cbd889011929c23affd04a55d8a2566136258c6cea2818fd1db353cd9094ed571ade78d39677c3e03ca3590c086e1471472a763f9a4a81f9b23e9ca
TLSH
T1FB51DFC9C0816E8BD79BB04ECADA00E51B5F99CA49F120310A3FFAD591AE149C7F7C56
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 43KB
SHA256 3b20905786e0c4b1806c770c82c6b4cb49e35213d469806f1280b38d277c4bf0
MD5 c003fca714a6294594434a5724e11af5
SHA1 afd6ee4d6b90f1cfedda7cb73366f54f969c8e84
SHA512 88a67145337962976177d8126471d514f6f78a220360c0098ac928e053afab368e9cff71724691061b0a5efdbae0bfc920f745ea1ce397138f2cb06fc6f94dfb
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aP:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmr
TLSH
T198130ED4C4826C5BD78F704ACB9901D41BAFADCA59F210310A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 45KB
SHA256 9cb859a6a0aff1367fe6225797f39cd81a3dd0d5debb7e8765fe2d53bbbf388f
MD5 13c1ebc0a0a9a13adc39357818dca50a
SHA1 0250dd6f2d73c7da9cd32fcc99cee7c88be00384
SHA512 30f343abac1af2daa3ae911ad66fbd6490412df41f2755d25be081b5500ef338cb3356a730271c9cf2ea431f60fadad4a4d1cd8b914567a9ad7db39b50f681d1
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//aO:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmK
TLSH
T19F230ED4C4826C5BD78B704ACB9901D41BAFADCA59F210310A3FBF9690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 46KB
SHA256 b646dc8d500b7e09212f76c8af1f653f88c5dbd81c6c0d1830359240809f8d79
MD5 33f770fd8d33fa47567820f255165bf3
SHA1 0f32f0b98ea471b183a32f1122dcb1a90b1a37a3
SHA512 f4c1438660d3a60c9c5d3e12862fa5cc01433ae1d2670cc03712b3326314f34ba8166b821d3a2d82e640d4a50fd448b6f5c3e261db11366fa296f97d56bd882c
SSDEEP 768:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99ATTfnfnU9VumIcnw9qG4hEnt9f//af:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmz
TLSH
T172230DD4C4826C5BD78F704ACB9901D41BAFA9CA59F210310A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 48KB
SHA256 c50c78d0f62dbb68f611307e421aa840d999ac150fde77a1129212722429796f
MD5 27b9ad2097860d0b747316df9ce63926
SHA1 94011086ee8a3441633a56c3ae122d0b1d18b1e6
SHA512 619215686200e784e23728d8c93369b2421eedc6eda1232889809d7e851d06b8a00f1e4daa14ff572f5a97e2cf7dd02ae1ee133696dbfcbb48e58fa3bdf52d87
SSDEEP 1536:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99AHfnfnU9VumIcnw9qG4hEnt9f//aPi:oDjm6nJRkI3Fzn50mQnA4zopFWmn9SHt
TLSH
T184230ED4C4826C5BD78F704ACB9901D41BAFA9CA59F210310A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 49KB
SHA256 c0ac4b260fd991da0745fa66eb350734de2c178c07e6c502e3b07e1505940428
MD5 7c8ed86bf452ca2ed551038682bd14f1
SHA1 05098f606d8c178940785ab6f176e143c7b3840a
SHA512 286528ffb46d1cbcfc63dd7d1b4e739ec79173cc66e48b200c16b6a723afe4d304abe2acab9c627736819db37c5c0eb84bb8d4285f9315e54cd068f936d43e75
SSDEEP 1536:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99AHfnfnU9VumIcnw9qG4hEnt9f//aP+:oDjm6nJRkI3Fzn50mQnA4zopFWmn9SH7
TLSH
T1B4330ED4C4826C5BD78F704ACB9501D41BAFA9CA59F210320A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 51KB
SHA256 55ba81c6dde9b2efbfe0256a51def79327847227fde246cb85a6c3e0d8fac48b
MD5 75efcd8de4b4b8f8fa6fd1ba765821db
SHA1 0032514464a4c01bf820579dfe7bc31b6c48cbee
SHA512 da926b5795f1aeea759ec01aceb5204a3b3604a7f685ce67cbef2fa399c7a51cba1edc7e80fe8468706b89bddb38b287127bda400760ddab3e484a2afc7b3e14
SSDEEP 1536:o9Vjm6nJR9aI3Fzn59imQnA4z9+pFWmn99AHfnfnU9VumIcnw9qG4hEnt9f//aPD:oDjm6nJRkI3Fzn50mQnA4zopFWmn9SHI
TLSH
T18F330ED4C4826C5BD78F704ACB9501D41BAFA9CA59F210320A3FBFD690AE18DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 fdc44ad1f57c027aab4c835d908d6e9f8b15b5441d5bb54c2ae3a35a22542e9b
MD5 bb62ece6d115951030fcdbb2c760e0f3
SHA1 d4de1d881183b890176be9a8e072875eaa162c69
SHA512 c879f9b0deb85147b31866b1a073af368226e35944c6b0f7bd18b0f356593a27b3418e425a3af31833edf311167822c53675d455fadbf0cb024b6c50df16fa60
SSDEEP 96:0JSmVS0S3Rzo1RHoSdTSwJS3RzoLRH/bxXSmuXSSgXS3RzoTSRHWvbXS3RzoTSRI:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmX
TLSH
T10191CBC9C0816D8BE79BB04ACED500E51F5F99CB58E120314A3FFA95A0EE14DC7E7866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 5KB
SHA256 310dc872a5dd032a91a9c3dd107ffe78735b2f38ab8e6e184a5c03ff1ffbef16
MD5 a88ad254192f8e988713624e1b4c7cd9
SHA1 228b5ab9b53137a8a9d9be1aba4256c993cee79b
SHA512 ec9a75572228f2cb23ce2562478443636ba22fc6bf979dfe2a42624b7455f03ed45793e2b36976241afce18d361e62efd69898a917897b1e5579e9add8434c6b
SSDEEP 96:0JSmVS0S3Rzo1RHoSdTSwJS3RzoLRH/bxXSmuXSSgXS3RzoTSRHWvbXS3RzoTSRO:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmT
TLSH
T17FC1CBD9C0812D9BD78BB04ACE9501E51B6FD9CB58F120310A3FBE96A0AE14DC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 77e2bc124eed58d077fa59ff0cbdf1850150c69acc61c1ba2fa88e60fe450c73
MD5 ebad85ee4fcb5a44cab2107d3bdcc596
SHA1 3d2435105c332c18ff6f96ffbdeea8ecf3abf9d5
SHA512 824e9dfba6ebdbb76c8e72d550c604a40b65ffe799935e9ca13d8095a20215f94f4195b1ab23306010838a69dfa2f26331741720f37e4df753702d2c5ca59877
SSDEEP 192:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmaS7S3RzoWRYS3RzoWRKSoSwisSmiStS/b:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwid
TLSH
T1C0F1EDD4C0816D9BD78BB04ACF9601E51B9FD9CB59F220310A3FBE95A0AE14CC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 8KB
SHA256 507f678eaa3c247a33d42b46fa50f6f96d21eeeee947740319de10efafb9ff42
MD5 8f046b43eb4236b78420f0ed8359379c
SHA1 6f5c0b8ec691e682fca80c99837bdc935b4f14ff
SHA512 4c4afc210e9b3ed65660516287bd384101874c31dc97ff24c222c61df6ea4d38a5489436065820f1614f800d24ea7424f602f2ad324171211cd74fbb86cbb829
SSDEEP 192:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmaS7S3RzoWRYS3RzoWRKSoSwisSmiStS/I:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwiS
TLSH
T19012FDD5C0812D5BD78BB00ACB9501E51B9FEDCB99F210320A3FBE95A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 f3d9b810b277e28d9e90f5dcb727bc9e08797f47cbe49ef62c387ec2a80868c6
MD5 2c1776e34e003be6a2473dc783763ed0
SHA1 7d610aada539ba5de624fa289ca07a89dfa55fed
SHA512 667cd3a0c5871437ecc2f5c4429d4f1481001364d083d829a2580f8c17fa2dac832d4947445a6012b4a252829b1ec8bb011bc6cce44c8858013daab586116b89
SSDEEP 192:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmaS7S3RzoWRYS3RzoWRKSoSwisSmiStS/L:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwip
TLSH
T12D220DC4C0816D5BDB8BB04ACB9501E51F9FE9C659F210320A3FBF96A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 11KB
SHA256 7c64c316d86450e1b66f5baeb1017449ddc45f1db2b8ab65223435eda29e1058
MD5 11470fb970d7ec90da3de47346a02ca4
SHA1 1b1e6b766c1022c37e15fb2c5ae4077ff7b012e6
SHA512 d7407cd4502a50cf68a212eae0bcf8cccddea9c037ed5c39cdcfcfa6aef5de71b5eb9a1f192e2ac06457c817a517b84a7634ae2f2beeec6f26f7325e1c6a977b
SSDEEP 192:0JSmVS0S3Rzo1RIS1SwJS3RzoLRD1SmaS7S3RzoWRYS3RzoWRKSoSwisSmiStS/E:0JSmVS0SbS1SwJSq1SmaS7SqSESoSwii
TLSH
T1E842ECD4C0816D5BEB8B704ECB9501D51F9FA9CA59F210320A3FBF96A0AE14CC7E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download