Dynamic Analysis Report
Created on 2024-10-01T19:35:22+00:00
OKLA.exe
Windows Exe (x86-32)
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "3 minutes" to "10 seconds" to reveal dormant functionality.
Remarks
(0x0200004A): 1 dump(s) were skipped because they exceeded the maximum dump size of 16 MB. The largest one was 256 MB.
| Filters: |
There are no files for this filter
There are no files in this analysis
| File Name | Category | Type | Verdict | Actions |
|---|
| C:\Users\OqXZRaykm\Desktop\OKLA.exe | Sample File | Binary |
Malicious
|
|
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 2.40 MB |
| MD5 |
bf6a432fedd9b27af14379c6c566676d
|
| SHA1 |
cc0805ebbac42ee05b4e046014040a426580bc36
|
| SHA256 |
520ff5c9f793f5d7abe6bb80c6420dcb797cc25bd3b73e8e82105f9f89b02335
|
| SSDeep |
49152:nILLyvOacuT9fbDxw6++uxp+NqiurJoP6rZ0B1qxtVujoiJ67XoifXUGOOnx:nxzfaJ+uxp+8rZ9t8JQfEQx
|
| ImpHash |
0ae9e38912ff6bd742a1b9e5c003576a
|
Memory Dumps (2)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| okla.exe | 1 | 0x001A0000 | 0x00216FFF | Relevant Image |
|
32-bit | 0x001C3BEE |
|
|
| okla.exe | 1 | 0x001A0000 | 0x00216FFF | Process Termination |
|
32-bit | - |
|
|
| \\?\C:\Users\OqXZRaykm\Desktop\xmrig.exe | Dropped File | Binary |
Malicious
|
|
| Also Known As |
C:\Users\OqXZRaykm\Desktop\xmrig.exe (Accessed File)
xmrig.exe (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 6.06 MB |
| MD5 |
5fba8ae226b096da3b31de0e17496735
|
| SHA1 |
d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
|
| SHA256 |
ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
|
| SSDeep |
98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
|
| ImpHash |
12806e48b853545b536463546db4baa1
|
Memory Dumps (44)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| xmrig.exe | 6 | 0x7FF67CF40000 | 0x7FF67D7F6FFF | Relevant Image |
|
64-bit | 0x7FF67D3538E0 |
|
|
| buffer | 6 | 0x001D0000 | 0x001EFFFF | Content Changed |
|
64-bit | - |
|
|
| buffer | 6 | 0x0014C000 | 0x0014FFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x001D0000 | 0x001EFFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A77A0 | 0x004A781F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A7A60 | 0x004A7B55 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A7B90 | 0x004A7C0F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A9850 | 0x004A98CF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A9AF0 | 0x004A9B75 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A9DB0 | 0x004A9EA7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004A9F30 | 0x004AA027 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AA220 | 0x004AA29F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AD6E0 | 0x004AD75F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AE3E0 | 0x004AE4EF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AED20 | 0x004AEF1F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AF090 | 0x004AF164 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AF2A0 | 0x004AF397 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004AF4E0 | 0x004AF707 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004B0A20 | 0x004B0DE7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004B0DF0 | 0x004B0F47 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004B1BE0 | 0x004B1CD7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004B2D00 | 0x004B2E57 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004C2240 | 0x004C233F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004C3020 | 0x004C421F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004C4230 | 0x004C522F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004CFAA0 | 0x004CFE2F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004CFE40 | 0x004CFF37 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004CFF40 | 0x004D007F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004D00A0 | 0x004D0197 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004D11B0 | 0x004D12A7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004D12B0 | 0x004D13A7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 6 | 0x004D2540 | 0x004D293F | First Network Behavior |
|
64-bit | - |
|
|
| xmrig.exe | 6 | 0x7FF67CF40000 | 0x7FF67D7F6FFF | First Network Behavior |
|
64-bit | 0x7FF67D2FAFB9 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | First Execution |
|
64-bit | 0x00460EC0 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x0046D000 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x0046B000 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00460EC0 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00468EC0 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00470DC0 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x0046A000 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x0046D000 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00469000 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00460EC0 |
|
|
| buffer | 6 | 0x00460000 | 0x0047FFFF | Content Changed |
|
64-bit | 0x00468EC0 |
|
|
| \\?\C:\Users\OqXZRaykm\Desktop\WinRing0x64.sys | Dropped File | Binary |
Clean
Known to be clean.
|
|
| Also Known As |
(Accessed File)
WinRing0x64.sys (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 14.20 KB |
| MD5 |
0c0195c48b6b8582fa6f6373032118da
|
| SHA1 |
d25340ae8e92a6d29f599fef426a2bc1b5217299
|
| SHA256 |
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
|
| SSDeep |
192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
|
| ImpHash |
d41fa95d4642dc981f10de36f4dc8cd7
|
| c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\notifications\wpndatabase.db-wal | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 2.77 MB |
| MD5 |
8bdd83eac01e01a7dc779f0100c6baaf
|
| SHA1 |
0b820cc2df8e76e5ffb2e34886a19fea1b05e1f3
|
| SHA256 |
1466821ae8a19d75f2f14ff0da58062b3a6fe3261f53a3559b77962cc77257c8
|
| SSDeep |
6144:aCY86dlS7yq64Ffg7VZSDaeQZDve4qtMjjOzjaXgQjeXlUqzECA2y4n9TnR+gEyG:Edksj+j8jzuR+gEyo05W+O6
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\edb.log | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.25 MB |
| MD5 |
f553aa1b257ba06b681dcdb6f4687045
|
| SHA1 |
0cf200d1081a485af433a551573141ab3a8032da
|
| SHA256 |
2d4836d14580f7f7029d4e12b18b854df38322ff85e44aa78958adc16da40bb6
|
| SSDeep |
1536:xJPOR1dPEBmHlvDul3u/ia+ciyzkOsK+4rO1P+9V01IV:xJPORnDTDy1q01IV
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\system.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.06 MB |
| MD5 |
047e1bd0998cab9d21ff5bf2d78e6da6
|
| SHA1 |
e350b27bc99139798b91d69ecff7e150423e9a48
|
| SHA256 |
0869d3e9e5380c9e058ff79fded21261297899e4f1a84c11f5cf62fa88a0a65f
|
| SSDeep |
1536:8kW/blLiCyjIr+76fSmacynEGxWZhRbd6a/wXh2S9qjKpaOt7xx6KtuKVmflXF9X:8kkblLiCyEprL/WzNxclrSXjT5P
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\application.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.06 MB |
| MD5 |
f6f06d84fb9d8b0af83e228a8596c8d5
|
| SHA1 |
24002137bc661a0e0374e06851c9dabeaa59bd10
|
| SHA256 |
afd964ced57f8e50995ef4d239b63ed6b0141bbd2a5c3b43d30ec6e53db8ed35
|
| SSDeep |
3072:0z6/3lAzcocqcmL/olxcNcyVcFmMcKcNcViGBcTcccgM8cpcx0RPTh5aKaxcpccc:0/olweaKa
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-wmi-activity%4operational.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.00 MB |
| MD5 |
19d51139154382e0f2d31c30770ea7b5
|
| SHA1 |
824f563e0824c244236040a809d8465613c38aa7
|
| SHA256 |
a5fbc033290d6be3d2af1bfeace9d3b3798188270ffa6e06e5851ad6bf3e78e0
|
| SSDeep |
384:B3h4RFRRObx3RurDRkmR51RdRjRxRSzvRhRnR9x6RgRqYRZxRRRaR7RDRLRWRaRP:lthlhziooz1gLNjWKLZWOs
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-pushnotification-platform%4operational.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.00 MB |
| MD5 |
4be1bdacfac1d300c62db13a582178a5
|
| SHA1 |
d182c4812b66ad47c9f5310c504beeab8acc291a
|
| SHA256 |
1d28be66536bfb7508e218d759c69f11d036837545b7754da8bab89bdbcab155
|
| SSDeep |
6144:iYQcXZLJcOjICjO95nrISLL9vttPhoaPEWxZBu7nBl5YGfP8D5w3L1/Wxxs3cyxN:XF
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-appxdeployment%4operational.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.00 MB |
| MD5 |
a09a17f06f048add70fdf46eb5430f80
|
| SHA1 |
516e62456bd0a0d2c8615afa7eb20289cec14127
|
| SHA256 |
c47e77b09b269aef7213f5ea1dba9c5c4c0c800fe14b909924b47b916466b1d0
|
| SSDeep |
768:cToJoquY2efqu8OYH+quU809yMaG9umqHDS/Y34LzV2OBy/rUHoIC:SoWquLefquw+quEY49u6nLx2HYX
|
| ImpHash | - |
| c:\windows\system32\perfstringbackup.ini | Dropped File | Stream |
Clean
|
|
| Also Known As |
c:\windows\system32\perfstringbackup.tmp (Dropped File)
|
| MIME Type | application/octet-stream |
| File Size | 777.08 KB |
| MD5 |
4dd537f1ea92c248c3ee76e94eeaa7de
|
| SHA1 |
d5a1afdd6e856fc15d54f09509544cc2148f503d
|
| SHA256 |
34d047689cb731eead66c75e1daf1f2e0c6fd68155dd53dfd4fc352c39a4aa81
|
| SSDeep |
3072:NJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc76:A1nqgsp2gOKihb
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\qmgr.db | Dropped File | Unknown |
Clean
|
|
| MIME Type | application/x-ms-ese |
| File Size | 768.00 KB |
| MD5 |
ca93b1f731964faaccb37247f3feb757
|
| SHA1 |
9658229afe477ab4ca96ea05824a7df9932007a8
|
| SHA256 |
9801ba911831343861799b4f086bd61e72199d9b89d2b8202d19f9037a2dae74
|
| SSDeep |
384:LW0StseCJ48jL4fW0StseCJ48jMTSjlK/wXsC1r:LSB2iSB2ISjlK/wXsC1r
|
| ImpHash | - |
| c:\windows\logs\cbs\cbs.log | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 255.82 KB |
| MD5 |
a259708896a19a57208c81f03f2dabb3
|
| SHA1 |
71c21d3bb6f7e255c9db2d200517502c236110ae
|
| SHA256 |
9599c91fec4ce1c770a95e4fe4eddf8e45df962e51297786970ca78090907c45
|
| SSDeep |
384:RwVe3S5+VQSmzVeO5PBgzM5+sx7ruvr8uI4JvDQRo3nTV7wJD:RGei5+VnmzVeOvgzM5+sx8VQRo3nTV
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-bits-client%4operational.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 68.00 KB |
| MD5 |
75c784044f0814af3107eeccf6d41ffa
|
| SHA1 |
296e7e03fd11795224f5746f9c93fe73acb1d8ae
|
| SHA256 |
e1a2e097970f1e18402cb3c9a2bbe971329f7e98f91553979874e1094ceff3a8
|
| SSDeep |
384:3xhnGjGahbVXGVkGnGogGqXbGIVGaGGk4G8Gz1GkGnhG8GTDG8G1RGAGaBGjGJGO:B6QTAXtg3OWC
|
| ImpHash | - |
| c:\windows\inf\wmiaprpl\wmiaprpl.ini | Dropped File | Text |
Clean
Known to be clean.
|
|
| Also Known As |
c:\windows\system32\wbem\performance\wmiaprpl.ini (Dropped File)
c:\windows\system32\wbem\performance\wmiaprpl_new.ini (Dropped File) |
| MIME Type | text/plain |
| File Size | 29.03 KB |
| MD5 |
ffdeea82ba4a5a65585103dd2a922dfe
|
| SHA1 |
094c3794503245cc7dfa9e222d3504f449a5400b
|
| SHA256 |
c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
|
| SSDeep |
384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\qmgr.jfm | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 16.00 KB |
| MD5 |
02d1f4b7ec8f79b89ba058f015860c1d
|
| SHA1 |
8cfbdaa116188022cc5b189aaab871f729fb782a
|
| SHA256 |
e84f7cff73b90af098b82944cae7cebffe4058ece7e7323238d7d027e9bbe067
|
| SSDeep |
3:tmjpIYD1M2mlllTWADBYZMvSbllllHtHvhlllalleillllXl:Aox/IoBYqvSb/VHvh/AQid
|
| ImpHash | - |
| c:\windows\inf\wmiaprpl\wmiaprpl.h | Dropped File | Text |
Clean
Known to be clean.
|
|
| MIME Type | text/plain |
| File Size | 3.36 KB |
| MD5 |
b133a676d139032a27de3d9619e70091
|
| SHA1 |
1248aa89938a13640252a79113930ede2f26f1fa
|
| SHA256 |
ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
|
| SSDeep |
48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
|
| ImpHash | - |
| C:\Users\OqXZRaykm\Desktop\1.cmd | Dropped File | Text |
Clean
|
|
| Also Known As |
1.cmd (Accessed File)
\\?\C:\Users\OqXZRaykm\Desktop\1.cmd (Accessed File) |
| MIME Type | text/x-msdos-batch |
| File Size | 183 Bytes |
| MD5 |
25dd5e79a650043821b67f5acd70ff92
|
| SHA1 |
91ae7ca0f1f03ab364add8fed7b76b82c130405b
|
| SHA256 |
c0b8774d6bdb8fe949a1e03352f43f7725399171adbd12bd6d8557a9bfb2c9ad
|
| SSDeep |
3:mKDDVBF//IyXI7ghKTEQfhX0dcVLKaEndoFemPkgU7rKtIMInvuZv:hyEIJT5fhXvVLKlQemFU7Oavgv
|
| ImpHash | - |
| c:\users\oqxzraykm\desktop\__tmp_rar_sfx_access_check_23361906 | Dropped File | Empty |
Clean
|
|
| Also Known As |
__tmp_rar_sfx_access_check_23361906 (Accessed File, Dropped File)
|
| MIME Type | application/x-empty |
| File Size | 0 Bytes (not extracted) |
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SSDeep |
3::
|
| ImpHash | - |
| c:\windows\system32\perfh009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 659.38 KB |
| MD5 |
c146afddee532240a480e79429e42d4c
|
| SHA1 |
1e1ffe476cf77929da882bdff7ce417c6771b5ba
|
| SHA256 |
b072e19af57494727c1fa78e2e6bd8fea07567b6d570fb1fba52e311736b5779
|
| SSDeep |
3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRa:78M6d0w+WB6X
|
| ImpHash | - |
| c:\windows\system32\perfh009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 646.33 KB |
| MD5 |
e40274085a7456e341b393828a83a204
|
| SHA1 |
b37899dbd6dc8da64b8ceb2afee684ee4471317c
|
| SHA256 |
a4bbd4981bf03910e2a7ab2e87bd8b3415afbf371b56dd04ead9a4e6d9e10668
|
| SSDeep |
3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRJ:78M6d0w+WB6Q
|
| ImpHash | - |
| c:\windows\prefetch\agapplaunch.db | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 326.33 KB |
| MD5 |
269f389b2ee5576a9f920c0866ee7a23
|
| SHA1 |
feb9d7e5f2b02ea1840afd8fdad6b136af73d090
|
| SHA256 |
00f950c25f0c32fbb93b7f91c1dcd99011d248c24db440a594b2bd22d59f1a34
|
| SSDeep |
24:ANZZ31MTLYTR41KGbRViLzyIB+cuOyrP5fMMM+cuOyrP5iRVyMM+E:AB3aKK1K+VX0LuXFMMMLuXKVyMM
|
| ImpHash | - |
| c:\windows\system32\perfc009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 122.47 KB |
| MD5 |
a1c55f2a9c41899549af8593bf5e4ce7
|
| SHA1 |
d8d4ca6afedc87e1bec3f819dba897095b6fea8e
|
| SHA256 |
a57660cb5ec3beec908ee2fb8cbafded9afb23bd91d0273ccf31f17fe206ef1f
|
| SSDeep |
3072:XBnfw8ld9+mRDaUR28oV7TY+7S0bCDhUHL:c
|
| ImpHash | - |
| c:\windows\system32\perfc009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 118.55 KB |
| MD5 |
ba6c49f98e2451a28974da13c598d0ea
|
| SHA1 |
de82a1fcdd6b98c421a9cf36f4eb9dde6fe26859
|
| SHA256 |
5d8988f2bcf7284cd96510e6735d7be5371103a83c85d04168d01f793becc960
|
| SSDeep |
1536:X1i4nfw8ld9+mRDaUR28oV7TYfXLi7NwrgSwQ:XBnfw8ld9+mRDaUR28oV7TY+7S0bQ
|
| ImpHash | - |
| c:\programdata\microsoft\windows\apprepository\staterepository-deployment.srd-shm | Modified File | Stream |
Clean
Known to be clean.
|
|
| MIME Type | application/octet-stream |
| File Size | 32.00 KB |
| MD5 |
bb7df04e1b0a2570657527a7e108ae23
|
| SHA1 |
5188431849b4613152fd7bdba6a3ff0a4fd6424b
|
| SHA256 |
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
|
| SSDeep |
3::
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\edb.chk | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 8.00 KB |
| MD5 |
cc21a393cfe53b36e339b3d1c50b622f
|
| SHA1 |
c4870f9f2baf41e8d7c3e378cf71701e3bbcca7c
|
| SHA256 |
58c2a465ccaf743b18c6771011b970fd7962ef3800a12dd04febd0fac1c2165d
|
| SSDeep |
12:KLaaD0JcaaD0JwQQQeLaaD0JcaaD0JwQQQ:KLtgJctgJwnLtgJctgJw
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\edb.chk | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 8.00 KB |
| MD5 |
471ac3982bee99948e5646022f9d8d08
|
| SHA1 |
c5f05927438f2e9c40113136e4cb855f65a68fa9
|
| SHA256 |
85829b875bfa7398880e5121711bd2dacf9a95bedb558ea274a30e51ebbc5d1b
|
| SSDeep |
12:BQLaaD0JcaaD0JwQQTsdQLaaD0JcaaD0JwQQTs:+LtgJctgJwbDLtgJctgJwb
|
| ImpHash | - |
| c:\programdata\microsoft\network\downloader\edb.chk | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 8.00 KB |
| MD5 |
2eb1251ecda3304c2fac0a89e0a66ccf
|
| SHA1 |
d7371e08c129dc443dd0cf12ebbfe50755c487c1
|
| SHA256 |
b960f13e2856ed37c0dddd6429acd6a7ae2a0f450e0539b71b1e74dcd88c712d
|
| SSDeep |
12:ELaaD0JcaaD0JwQQaQLaaD0JcaaD0JwQQa:ELtgJctgJwHLtgJctgJw
|
| ImpHash | - |
| c:\windows\system32\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask | Modified File | Text |
Clean
|
|
| MIME Type | text/xml |
| File Size | 4.57 KB |
| MD5 |
1a9285e1b5fc525b0218a94cbf170ed7
|
| SHA1 |
a59bf331878323c6db5997062ee5d14556bca3cc
|
| SHA256 |
76df716ec217bddbb005673483524f59d4ac6704e5dcbe82109c78df48cb47c6
|
| SSDeep |
96:pYMguQII4iz6h4aGdinipV9ll7UY5HAmzQ+:9A4r/xne7HO+
|
| ImpHash | - |
| 6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994 | Extracted File | Image |
Clean
Known to be clean.
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 15.36 KB |
| MD5 |
7b678b6cb96c363d9e0adc3a1b3b4893
|
| SHA1 |
c7e817672b686eb66bf5907da1efaef1dec8e06e
|
| SHA256 |
6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994
|
| SSDeep |
384:cCVOnt2MQzUHLz8NE/IEToowoF9VCN6eqiRYSSSSHDNMPi:wZuMv8EIETxryMZDN3
|
| ImpHash | - |
| 1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2 | Extracted File | Image |
Clean
|
|
| Parent File | \\?\C:\Users\OqXZRaykm\Desktop\xmrig.exe |
| MIME Type | image/png |
| File Size | 6.24 KB |
| MD5 |
d2b3b44dd5992d99b061cec9f87c5e3b
|
| SHA1 |
694991076e6bd92f29800d5f4fd4b136e9583a03
|
| SHA256 |
1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2
|
| SSDeep |
192:cpIADVqc29SUu1hqr2QTLpaNfnVWnvK4NhzC5Zaw4819E:cpBDEpIU8hqrtv4N4to5Zaw4819E
|
| ImpHash | - |
| 27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68 | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 5.41 KB |
| MD5 |
e6ccfb6d9ffd4e1a907a47761c64bd79
|
| SHA1 |
d6a2994dedae3527a878140aa60dcaa087b90445
|
| SHA256 |
27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68
|
| SSDeep |
96:ioA0HldODFNSZCbgEZohRodU3vMg2vLWT3m5RQgVH0SmAMPzzZ2OC9vd/GrW4jD/:FlkDFNSWggWf3ILWTeMPzzZc9vd/yWe
|
| ImpHash | - |
| a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 2.81 KB |
| MD5 |
63486a769bbe3f49d5848b9c69734a25
|
| SHA1 |
e48bd36c2f23c238206bdddf3ebb6d6862905710
|
| SHA256 |
a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c
|
| SSDeep |
48:Tppthbcpv0j+3MIG68XIZm2iVAMd+1pzX7JGkVdxU6UPyoarDZICZXBIYB8bn0eP:7bev0j+3r0JCM8zb7JGkhU68yoanZHZc
|
| ImpHash | - |
