24c553d7fd37ffb22b3267b63f9025f2c2e64141a188c985e601b2d511a09016

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
herobrine.bat
Size 214B
Sample261024-rfw5nsfb23
SHA256 24c553d7fd37ffb22b3267b63f9025f2c2e64141a188c985e601b2d511a09016
MD5 5a8b72980c3aa287461d59de310a450b
SHA1 cd8a202b83afd7b14198c173aa44e77550807e4d
SHA512 b79bf100c2077d7fd004500ad1d0ef8782a4cbe095de955f45c11bfe6bb8d2c39817b45bcea4950903ad4353bcc61b52a9bacb950e5210e1185d855c79f4fa35
TLSH
T11ED08C00CC03448A5DB19C14078D3BAAF45FC16C84DC418D508524A0ECEFCAF3B20A32
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe
File opened for modification	C:\Windows\system32\azman.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6012	mspaint.exe
6012	mspaint.exe
1268	mspaint.exe
1268	mspaint.exe
1124	mspaint.exe
1124	mspaint.exe
3264	mspaint.exe
3264	mspaint.exe
4548	mspaint.exe
4548	mspaint.exe
3864	mspaint.exe
3864	mspaint.exe
3796	mspaint.exe
3796	mspaint.exe
4988	mspaint.exe
4988	mspaint.exe

Suspicious behavior: SetClipboardViewer 6 IoCs

pid	Process
4100	mmc.exe
5264	mmc.exe
1936	mmc.exe
3780	mmc.exe
3040	mmc.exe
4772	mmc.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: 33	2032	mmc.exe
Token: SeIncBasePriorityPrivilege	2032	mmc.exe
Token: 33	2032	mmc.exe
Token: SeIncBasePriorityPrivilege	2032	mmc.exe
Token: 33	4100	mmc.exe
Token: SeIncBasePriorityPrivilege	4100	mmc.exe
Token: 33	4100	mmc.exe
Token: SeIncBasePriorityPrivilege	4100	mmc.exe
Token: 33	5264	mmc.exe
Token: SeIncBasePriorityPrivilege	5264	mmc.exe
Token: 33	5264	mmc.exe
Token: SeIncBasePriorityPrivilege	5264	mmc.exe
Token: 33	1936	mmc.exe
Token: SeIncBasePriorityPrivilege	1936	mmc.exe
Token: 33	1936	mmc.exe
Token: SeIncBasePriorityPrivilege	1936	mmc.exe
Token: 33	3780	mmc.exe
Token: SeIncBasePriorityPrivilege	3780	mmc.exe
Token: 33	3780	mmc.exe
Token: SeIncBasePriorityPrivilege	3780	mmc.exe
Token: 33	3040	mmc.exe
Token: SeIncBasePriorityPrivilege	3040	mmc.exe
Token: 33	3040	mmc.exe
Token: SeIncBasePriorityPrivilege	3040	mmc.exe
Token: 33	4772	mmc.exe
Token: SeIncBasePriorityPrivilege	4772	mmc.exe
Token: 33	4772	mmc.exe
Token: SeIncBasePriorityPrivilege	4772	mmc.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
6012	mspaint.exe
6012	mspaint.exe
6012	mspaint.exe
6012	mspaint.exe
2032	mmc.exe
1268	mspaint.exe
2032	mmc.exe
1268	mspaint.exe
1268	mspaint.exe
1268	mspaint.exe
4100	mmc.exe
4100	mmc.exe
1124	mspaint.exe
1124	mspaint.exe
1124	mspaint.exe
1124	mspaint.exe
5264	mmc.exe
5264	mmc.exe
3264	mspaint.exe
3264	mspaint.exe
3264	mspaint.exe
3264	mspaint.exe
4548	mspaint.exe
1936	mmc.exe
1936	mmc.exe
4548	mspaint.exe
4548	mspaint.exe
4548	mspaint.exe
3780	mmc.exe
3780	mmc.exe
3864	mspaint.exe
3864	mspaint.exe
3864	mspaint.exe
3864	mspaint.exe
3040	mmc.exe
3796	mspaint.exe
3040	mmc.exe
3796	mspaint.exe
3796	mspaint.exe
3796	mspaint.exe
4772	mmc.exe
4772	mmc.exe
4988	mspaint.exe
4988	mspaint.exe
4988	mspaint.exe
4988	mspaint.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 816	4380	cmd.exe	90
PID 4380 wrote to memory of 3292	4380	cmd.exe	91
PID 4380 wrote to memory of 6012	4380	cmd.exe	93
PID 4380 wrote to memory of 3524	4380	cmd.exe	100
PID 4380 wrote to memory of 5460	4380	cmd.exe	101
PID 4380 wrote to memory of 3316	4380	cmd.exe	102
PID 4380 wrote to memory of 2032	4380	cmd.exe	103
PID 4380 wrote to memory of 4856	4380	cmd.exe	104
PID 4380 wrote to memory of 4748	4380	cmd.exe	105
PID 4380 wrote to memory of 1268	4380	cmd.exe	107
PID 4380 wrote to memory of 5500	4380	cmd.exe	108
PID 4380 wrote to memory of 4348	4380	cmd.exe	109
PID 4380 wrote to memory of 4704	4380	cmd.exe	110
PID 4380 wrote to memory of 4100	4380	cmd.exe	111
PID 4380 wrote to memory of 3328	4380	cmd.exe	112
PID 4380 wrote to memory of 3088	4380	cmd.exe	113
PID 4380 wrote to memory of 1124	4380	cmd.exe	114
PID 4380 wrote to memory of 5580	4380	cmd.exe	116
PID 4380 wrote to memory of 5996	4380	cmd.exe	117
PID 4380 wrote to memory of 1224	4380	cmd.exe	118
PID 4380 wrote to memory of 5264	4380	cmd.exe	119
PID 4380 wrote to memory of 4804	4380	cmd.exe	120
PID 4380 wrote to memory of 1876	4380	cmd.exe	121
PID 4380 wrote to memory of 3264	4380	cmd.exe	122
PID 4380 wrote to memory of 2444	4380	cmd.exe	124
PID 4380 wrote to memory of 2412	4380	cmd.exe	125
PID 4380 wrote to memory of 2548	4380	cmd.exe	126
PID 4380 wrote to memory of 1936	4380	cmd.exe	127
PID 4380 wrote to memory of 5548	4380	cmd.exe	128
PID 4380 wrote to memory of 5136	4380	cmd.exe	129
PID 4380 wrote to memory of 4548	4380	cmd.exe	130
PID 4380 wrote to memory of 3296	4380	cmd.exe	132
PID 4380 wrote to memory of 1748	4380	cmd.exe	133
PID 4380 wrote to memory of 4484	4380	cmd.exe	134
PID 4380 wrote to memory of 3780	4380	cmd.exe	135
PID 4380 wrote to memory of 3116	4380	cmd.exe	136
PID 4380 wrote to memory of 4704	4380	cmd.exe	137
PID 4380 wrote to memory of 3864	4380	cmd.exe	138
PID 4380 wrote to memory of 3200	4380	cmd.exe	140
PID 4380 wrote to memory of 2924	4380	cmd.exe	141
PID 4380 wrote to memory of 4664	4380	cmd.exe	142
PID 4380 wrote to memory of 3040	4380	cmd.exe	143
PID 4380 wrote to memory of 2548	4380	cmd.exe	144
PID 4380 wrote to memory of 3896	4380	cmd.exe	145
PID 4380 wrote to memory of 3796	4380	cmd.exe	146
PID 4380 wrote to memory of 3180	4380	cmd.exe	148
PID 4380 wrote to memory of 2760	4380	cmd.exe	149
PID 4380 wrote to memory of 5788	4380	cmd.exe	150
PID 4380 wrote to memory of 4772	4380	cmd.exe	151
PID 4380 wrote to memory of 4944	4380	cmd.exe	152
PID 4380 wrote to memory of 2880	4380	cmd.exe	153
PID 4380 wrote to memory of 4988	4380	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\herobrine.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3292
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6012
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3524
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:5460
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:3316
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2032
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:4856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4748
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1268
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5500
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:4348
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:4704
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4100
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:3328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3088
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1124
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5580
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:5996
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:1224
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5264
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:4804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1876
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3264
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2444
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:2412
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:2548
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1936
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5136
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4548
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3296
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:1748
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:4484
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3780
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:3116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4704
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3864
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3200
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:2924
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:4664
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3040
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:2548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3896
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3796
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3180
- C:\Windows\HelpPane.exe
  HelpPane.exe
  2⤵
  PID:2760
- C:\Windows\hh.exe
  hh.exe
  2⤵
  PID:5788
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\azman.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4772
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:4944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2880
- C:\Windows\system32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 a24bb68f005cc40eb90c84f89f27c05c45afbeba979fac613e30e487ff6314c9
MD5 3cbab85104074c76832c5feea5709863
SHA1 f59c7a01d251a11f8616626e3c6a7d161bc8700c
SHA512 a3b62e4ec8a6c58953c2af30206746161b534d837340b525fe68a7b40040eaac8b56bd4332d198bdb572ab4d41ade2c8c601d7160c7a4bde53b8cc772bd4a8e0
TLSH
T1FF31FFC4C451AC6BE7CF7009D6A522E42B9FEBC644E200210A2F7AD9906E08D8FE7426
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 48cf9a5fa872e4cdeb79e3071b1fe26e4a5924967eb5d4c5e960ecbaeef55def
MD5 c28375929dfdcdf8e8827c48c7c64dc9
SHA1 81f093e1598377653ce928bebdb3dd0e9a9b4c02
SHA512 0a778eaeb7912e216ef91544695fa3bcddc5876e2e230680436c8d241b5fe30366dd7dd3f00b71ead1e3e12ebe0da31dc84c04e7c28ec2fb29deb9820b674cfd
TLSH
T1F05101D5C5526C5FEB8B300AC7A511D51FAFBBC654E210210A3F7B99D0AE04D8BE7417
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 7e8a95a21100ffe1bb2ae1e1541ad7b088f08d2b8a756b76490dbb8e46359f0f
MD5 f42d811f86f11ed2d8a87a630bf65452
SHA1 3b0273f267c1b54927364b9531e3a95704393d50
SHA512 81527e963b29e3b2776af58ad9b0b99f5d9e99996f478c77fdce3ad08a0bba560f53264fc17ee3e0bdb06d829016f36abdc0f68abc2c79afacb5d7af5f32c908
SSDEEP 192:0dSmLSKSISwkS3RzoeRxS3RzoDR5KSmOSYSJSwkS3RzoARAS3RzoARelSmiSRSmV:0dSmLSKSISwkSfSwKSmOSYSJSwkSSS4H
TLSH
T15BF1DCD4C4826D5BE7CB300AC7A410D51F9FE9C698E210610A3FBED9A0AE14DCBE7816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 21beb3f179f557e2f834b371c647d7ae3c6122bb03f06b38bd5b2244800ab99e
MD5 35ba82cdbc90f66a90150c5ee561f9b0
SHA1 f20753d2c2c74a29da31fba221bd01ab32d87926
SHA512 15cd8b902da26b4e56f3154135de981438c81bebb612dc2ee5f382955fb944aafa7ea0abbb8e4fa256fb380ef38292a450789d701679ec8570921fa3704aef5d
SSDEEP 192:0dSmLSKSISwkS3RzoeRxS3RzoDR5KSmOSYSJSwkS3RzoARAS3RzoARelSmiSRSmb:0dSmLSKSISwkSfSwKSmOSYSJSwkSSS4R
TLSH
T1C922FDD4C4826C5BE78B700ACB9421E41F9FA9D669E210710E3FBFE590AE14DCBE7416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 12KB
SHA256 5ede8a42c9e9aa077d7a5f718067410062dd3ff4c995b9b25603054ddc45baeb
MD5 b3fafcfe74908700ea047d1808e30ef2
SHA1 8beb9c6cc6a1cbe0ab29a700a17506e37f4ec0fd
SHA512 04264a4deb0265353ddc0fee25f9fda2329847c6c01e5841866a70d7e502c61b94c949cf98979769c1f88fa230d23ee92e8606720f1b0c803808df44b5b633ed
SSDEEP 384:0dSmLSKSISwkSfSwKSmOSYSJSwkSSS4lSmiSRSmSw4SSSpzSmGS2SYSpSLSwiIS5:y9LtznkiY9OHwnk1T9iSNn4DQ9G9l8gW
TLSH
T18A42ECD4C4826D5BE78B700AC79520D41F9FE9D6A8E210710E3FBEE990AE14DCBE7416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 f13886c9574a9bda795761012e96c32fb8bbad8241225c8d9a57495f1dbcbf43
MD5 c36491323e9bdbf4681a60bd04eaa312
SHA1 f83f9cbbbc91bca8bae8eb43dd68eee7076389e4
SHA512 d4dd3c1d1364f7502a166f173ce8833881742332e8984c84f2113dbd67d6b30e4a65b852178c866d7a724842d971509c3beb0ee0cc977b8006bf575da9ca3f8f
SSDEEP 96:0dSmLSKSd6SwuLS3RzoXuRHMiS3RzoDRHPRTOSmOSYSdXSwkS3RzoARHgS3RzoAP:0dSmLSKSISwkS3RzoeRxS3RzoDR5KSmF
TLSH
T137A10FD5C5526C5FEB8F300AC79411D51FAFAAC698E210210A3F7BD9A0AF14DCBE741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 bce426ace770dac4d496cd907a998cf9784bef52ed74e9c7af3f731a186593a5
MD5 8d2b4e3d0d2b2427e55893caf4a00b7e
SHA1 82ade473c7b3f1d86925e6c560b2af1cc3c9d39e
SHA512 823c82957eac705e3b375dadb814e383131a1a36d3ccc010f234285c838ad3a183512063fe77db9f998d9026d79f1e211cc6e61a174a2bb4799c8fd0d8d51305
SSDEEP 192:0dSmLSKSISwkS3RzoeRxS3RzoDR5KSmOSYSJSwkS3RzoARAS3RzoARelSmiSRSmj:0dSmLSKSISwkSfSwKSmOSYSJSwkSSS4h
TLSH
T16CD1FD94C5826D5BE7CF300AC7A420D91FAFE9C658E210610A3FBFD990AE14DCBE7456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-11-0x0000000003010000-0x000000000303B000-memory.dmp

Download

memory/2032-2-0x0000000002F60000-0x0000000002F8B000-memory.dmp

Download

memory/3040-22-0x00000000026D0000-0x00000000026FB000-memory.dmp

Download

memory/3780-19-0x00000000034F0000-0x000000000351B000-memory.dmp

Download

memory/4100-3-0x00000000031A0000-0x00000000031CB000-memory.dmp

Download

memory/4772-28-0x0000000002600000-0x000000000262B000-memory.dmp

Download

memory/5264-9-0x0000000003020000-0x000000000304B000-memory.dmp

Download