a6f48afd03aaa15824a2182e20088a4595f795766f78d679416d123ec17e1de5

Resubmissions

25/02/2025, 18:31

250225-w51ava1jt9 8

11/03/2024, 23:35

240311-3leclahf51 8

05/09/2023, 14:57

230905-sbr6lagd82 8

12/04/2023, 00:00

230412-aaqx2ahh3w 8

Analysis

max time kernel
140s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/09/2023, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Elo.exe
Size

96KB
MD5

26b12d61e9e62412748069275521be1a
SHA1

6206f2f1256774a058998da3517cbffc5e70270e
SHA256

a6f48afd03aaa15824a2182e20088a4595f795766f78d679416d123ec17e1de5
SHA512

0e28b335d373c7d1d92f15bd412886472db66ad9b1ab9a4fcae6f1338df07785a62b03ff069aea9543a850c95e9990e3107e0114d63f207721e897b859956491
SSDEEP

1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfswociK1CFOU:T7DhdC6kzWypvaQ0FxyNTBfspwYp

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	sethc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\Desktop\Wallpaper	sethc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2008	timeout.exe
2320	timeout.exe
2312	timeout.exe
2964	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Desktop\General	sethc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource	sethc.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2888	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2044	powershell.exe
1104	powershell.exe
2044	powershell.exe
2044	powershell.exe
1972	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1624	cmd.exe
Token: SeSystemtimePrivilege	1624	cmd.exe
Token: SeSystemtimePrivilege	1624	cmd.exe
Token: SeSystemtimePrivilege	1624	cmd.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1624	2300	Elo.exe	29
PID 2300 wrote to memory of 1624	2300	Elo.exe	29
PID 2300 wrote to memory of 1624	2300	Elo.exe	29
PID 2300 wrote to memory of 1624	2300	Elo.exe	29
PID 1624 wrote to memory of 2072	1624	cmd.exe	30
PID 1624 wrote to memory of 2072	1624	cmd.exe	30
PID 1624 wrote to memory of 2072	1624	cmd.exe	30
PID 2072 wrote to memory of 2460	2072	net.exe	31
PID 2072 wrote to memory of 2460	2072	net.exe	31
PID 2072 wrote to memory of 2460	2072	net.exe	31
PID 1624 wrote to memory of 1980	1624	cmd.exe	32
PID 1624 wrote to memory of 1980	1624	cmd.exe	32
PID 1624 wrote to memory of 1980	1624	cmd.exe	32
PID 1624 wrote to memory of 2156	1624	cmd.exe	33
PID 1624 wrote to memory of 2156	1624	cmd.exe	33
PID 1624 wrote to memory of 2156	1624	cmd.exe	33
PID 1624 wrote to memory of 1748	1624	cmd.exe	34
PID 1624 wrote to memory of 1748	1624	cmd.exe	34
PID 1624 wrote to memory of 1748	1624	cmd.exe	34
PID 1624 wrote to memory of 2756	1624	cmd.exe	35
PID 1624 wrote to memory of 2756	1624	cmd.exe	35
PID 1624 wrote to memory of 2756	1624	cmd.exe	35
PID 1624 wrote to memory of 2816	1624	cmd.exe	36
PID 1624 wrote to memory of 2816	1624	cmd.exe	36
PID 1624 wrote to memory of 2816	1624	cmd.exe	36
PID 1624 wrote to memory of 2056	1624	cmd.exe	37
PID 1624 wrote to memory of 2056	1624	cmd.exe	37
PID 1624 wrote to memory of 2056	1624	cmd.exe	37
PID 1624 wrote to memory of 2652	1624	cmd.exe	38
PID 1624 wrote to memory of 2652	1624	cmd.exe	38
PID 1624 wrote to memory of 2652	1624	cmd.exe	38
PID 1624 wrote to memory of 2908	1624	cmd.exe	39
PID 1624 wrote to memory of 2908	1624	cmd.exe	39
PID 1624 wrote to memory of 2908	1624	cmd.exe	39
PID 1624 wrote to memory of 2656	1624	cmd.exe	40
PID 1624 wrote to memory of 2656	1624	cmd.exe	40
PID 1624 wrote to memory of 2656	1624	cmd.exe	40
PID 1624 wrote to memory of 2540	1624	cmd.exe	41
PID 1624 wrote to memory of 2540	1624	cmd.exe	41
PID 1624 wrote to memory of 2540	1624	cmd.exe	41
PID 1624 wrote to memory of 592	1624	cmd.exe	42
PID 1624 wrote to memory of 592	1624	cmd.exe	42
PID 1624 wrote to memory of 592	1624	cmd.exe	42
PID 592 wrote to memory of 2044	592	WScript.exe	43
PID 592 wrote to memory of 2044	592	WScript.exe	43
PID 592 wrote to memory of 2044	592	WScript.exe	43
PID 1624 wrote to memory of 2888	1624	cmd.exe	45
PID 1624 wrote to memory of 2888	1624	cmd.exe	45
PID 1624 wrote to memory of 2888	1624	cmd.exe	45
PID 1624 wrote to memory of 1940	1624	cmd.exe	46
PID 1624 wrote to memory of 1940	1624	cmd.exe	46
PID 1624 wrote to memory of 1940	1624	cmd.exe	46
PID 1624 wrote to memory of 760	1624	cmd.exe	48
PID 1624 wrote to memory of 760	1624	cmd.exe	48
PID 1624 wrote to memory of 760	1624	cmd.exe	48
PID 1624 wrote to memory of 1104	1624	cmd.exe	47
PID 1624 wrote to memory of 1104	1624	cmd.exe	47
PID 1624 wrote to memory of 1104	1624	cmd.exe	47
PID 2044 wrote to memory of 2096	2044	powershell.exe	49
PID 2044 wrote to memory of 2096	2044	powershell.exe	49
PID 2044 wrote to memory of 2096	2044	powershell.exe	49
PID 1624 wrote to memory of 1972	1624	cmd.exe	51
PID 1624 wrote to memory of 1972	1624	cmd.exe	51
PID 1624 wrote to memory of 1972	1624	cmd.exe	51

Views/modifies file attributes 1 TTPs 17 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1940	attrib.exe
1688	attrib.exe
1748	attrib.exe
2756	attrib.exe
1980	attrib.exe
2652	attrib.exe
2656	attrib.exe
2072	attrib.exe
1980	attrib.exe
2816	attrib.exe
2908	attrib.exe
2540	attrib.exe
2348	attrib.exe
2460	attrib.exe
2680	attrib.exe
2156	attrib.exe
2056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Elo.exe
"C:\Users\Admin\AppData\Local\Temp\Elo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4BC0.tmp\4BC1.tmp\4BC2.bat C:\Users\Admin\AppData\Local\Temp\Elo.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2460
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Elo.exe
    3⤵
    - Views/modifies file attributes
    PID:1980
- - C:\Windows\system32\attrib.exe
    attrib +h +s 17530.vbs
    3⤵
    - Views/modifies file attributes
    PID:2156
- - C:\Windows\system32\attrib.exe
    attrib +h +s 9727.vbs
    3⤵
    - Views/modifies file attributes
    PID:1748
- - C:\Windows\system32\attrib.exe
    attrib +h +s 12662.vbs
    3⤵
    - Views/modifies file attributes
    PID:2756
- - C:\Windows\system32\attrib.exe
    attrib +h +s Automate.bat
    3⤵
    - Views/modifies file attributes
    PID:2816
- - C:\Windows\system32\attrib.exe
    attrib +h +s Test.vbs
    3⤵
    - Views/modifies file attributes
    PID:2056
- - C:\Windows\system32\attrib.exe
    attrib +h +s Test.bat
    3⤵
    - Views/modifies file attributes
    PID:2652
- - C:\Windows\system32\attrib.exe
    attrib +h +s Detect.vbs
    3⤵
    - Views/modifies file attributes
    PID:2908
- - C:\Windows\system32\attrib.exe
    attrib +h +s Detect.bat
    3⤵
    - Views/modifies file attributes
    PID:2656
- - C:\Windows\system32\attrib.exe
    attrib +h +s bsod.bat
    3⤵
    - Views/modifies file attributes
    PID:2540
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17530.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process Detect.bat -Verb RunAs -windowstyle hidden
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Detect.bat"
        5⤵
        
        PID:2096
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Detect.vbs"
        6⤵
        
        PID:2164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process Test.bat -Verb RunAs -windowstyle hidden -wait
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Test.bat"
        8⤵
        
        PID:2412
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Test.vbs"
        6⤵
        
        PID:708
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\MEMZ.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2888
- - C:\Windows\system32\attrib.exe
    attrib +h +s MEMZ.txt
    3⤵
    - Views/modifies file attributes
    PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noprofile -
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type NirCmd.ps1 "
    3⤵
    PID:760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell gci -Recurse -Filter *.zip |ForEach-Object {Expand-Archive -Path $_.Fullname -DestinationPath $_.BaseName -Force}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\system32\timeout.exe
    timeout 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd.txt
    3⤵
    - Views/modifies file attributes
    PID:2348
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd.bat
    3⤵
    - Views/modifies file attributes
    PID:1688
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd2.txt
    3⤵
    - Views/modifies file attributes
    PID:2460
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd.zip
    3⤵
    - Views/modifies file attributes
    PID:2072
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd.ps1
    3⤵
    - Views/modifies file attributes
    PID:1980
- - C:\Windows\system32\attrib.exe
    attrib +h +s NirCmd.exe
    3⤵
    - Views/modifies file attributes
    PID:2680
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2320
- - C:\Windows\system32\timeout.exe
    timeout 20 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2312
- - C:\Windows\system32\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2964
- - C:\Windows\system32\sethc.exe
    sethc 250
    3⤵
    PID:2780

C:\Windows\system32\sethc.exe
sethc.exe 101
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
b65aeb1b3da0b96313cc6e10dde4afe0

SHA1
34039989280d6d5a45793deaab79665c79b74b8d

SHA256
0254d776e25aeb83f195aacc7d477cd37683932586b27fdb7f09836d08296a3c

SHA512
be5c22848ee3491061feaab9c8e708e04e5d34bc0d8b46e816e059e6616c0114cfe5f40aee935f9d5dee546a990efa3bca00bdec03bcc29fedad37d0dbda95ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
05471356f0ea1c0f5f5b8deb29c3ebd1

SHA1
12b14b737d1e0f76ca2494fb7a6841e5792a0504

SHA256
cf59479c75a8803468dd2a2c1d2803a2694c41992d5a0b3b65b1c69c28d1eac7

SHA512
942285259612792c2b3a45a65483e0775314841e397e815d447fd8f69f63f5de1ac48653a051c0121bd73415655c468772d39ce72bb1ba3d8ae367f78143502b

Download Submit
C:\Users\Admin\AppData\Local\Temp\12662.vbs

Filesize
218B

MD5
a5ffacb76079366b573d25fec3dccf7f

SHA1
5039dc66332fdade2b16d3b9065fb5fc9061f6ba

SHA256
24ab295f3ea0d46fc827398c8b1d3b23752de36c8100bcfc4b5f011915b4f4f8

SHA512
85b40e401e88dd13f84ec781956980c59ccb338f3953240da0be5bf17ce7d42d1654cada7e8fc70a52a2a1befb697f7ad63622c2f97f7659d481e315fb4f1046

Download Submit
C:\Users\Admin\AppData\Local\Temp\17530.vbs

Filesize
128B

MD5
de77acb4970462a84d1418426ef768c0

SHA1
9f9420eecfda1a228b31ba6a7a7cac2a2885d59e

SHA256
533d3759b2dc9f801b1440002bbe45a19099d87378faa7cd1ca38b6ed15c91cf

SHA512
c9bd51a8f42d51e4ecf3b699aaf5c907fb85d4c727f376677604f7bac369740a13953631c4164c988707e64494c8ecb7164074b782ce2a544220b1abd0aef0dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp\4BC1.tmp\4BC2.bat

Filesize
7KB

MD5
481a357d27e7c1a2cfbe617f14600b8b

SHA1
5c29901995a3d345eaa0d3cc9ee763ec21638b89

SHA256
970b56f67e1996e434fc45c12b5157fb96ae4886b3ea4e77fad2e86fc78321aa

SHA512
3504010edfa0f8a17b888fdaa1631c5a2efc20a5689bb8cc06fe1a6a95067cc1ebd6ef52d2ea8c52867b7e16280292972025358beccf0937313822c6199b2bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\9727.vbs

Filesize
147B

MD5
9e058306bf7f9c484a7553dcd1a080ad

SHA1
98670b4b9c36eea14078343272418104aee382c0

SHA256
245c3a8cf02aa38b997b3a4eea47b1872c68d882a2e63c19e142b5f3e72a9d0c

SHA512
bd4455afc947671eae07099d026124aeeda1c2f0ecac05f1fdf48bbe7ad2213d42dc797282cf1e7a206232d2463d8765944e6e9db8ce5c404f64b6d0c6f16fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Automate.bat

Filesize
249B

MD5
e8deb513d9050736b3f4a8ec8c9645a4

SHA1
dd47fba6ee3b5ea80176af7ea302f9aae22f226a

SHA256
87a0817da57464dee6c6ed36311ba76ae523884e2a6b4be77592c2c285924cc6

SHA512
5d256b53c62654529601d0c210060655ad708d2ac5c6c57fd4d8d5ee6d872e9b6c746ae94a637a01e37554835d2f2029c1c37f8195956f5db41667852a739dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Detect.bat

Filesize
111B

MD5
3cb76846869bcbb44cebf7c7e4c6218c

SHA1
6d05544d37255fff5b838d3f3b7e0113fbb67c03

SHA256
a6c5a78cb4cb2427005933c394abc76ed075e3c7fb996e14802b306a7838bcf2

SHA512
a6017cccc5692992bcd9069f4593d3d56af9146628d9716daa0a663941a22522d2fe265dc1bc727b9eaeef1b06027c6d2b077db9ee2ea73802621ff89c980e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Detect.vbs

Filesize
220B

MD5
0ba0411f0d555bebb7752316e799f779

SHA1
4bdc902ee5300a65a4bad277f2a8b0175da7674d

SHA256
d7c456e54e9a5621b7df7cce19994ac3dd348ee98b086ae43112348c7935da06

SHA512
6738b93630327a2c2ef326abc4b896533523c602d57cd8a2305b151efd1e727938f6afce4e090e92d74964a01d748666a24847d537caf46e1a562c98927f9275

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ.txt

Filesize
202B

MD5
c6e2a6fe68bdcf28fd4632bcdea5a8ee

SHA1
4b8239cdafbba61992260695dc0e5249e37cb18c

SHA256
1a790c636b4b92759ff47ea50792fec9d7da67d2764b49d64644fc562c35a908

SHA512
0115a40e16647873223d6450b00b2168a00282b6decebbd92722a64c9625bdfa79bc65645e8fe021f76201f72a78c46676037953ea2918114e26b1076a912067

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ.txt

Filesize
202B

MD5
c6e2a6fe68bdcf28fd4632bcdea5a8ee

SHA1
4b8239cdafbba61992260695dc0e5249e37cb18c

SHA256
1a790c636b4b92759ff47ea50792fec9d7da67d2764b49d64644fc562c35a908

SHA512
0115a40e16647873223d6450b00b2168a00282b6decebbd92722a64c9625bdfa79bc65645e8fe021f76201f72a78c46676037953ea2918114e26b1076a912067

Download Submit
C:\Users\Admin\AppData\Local\Temp\NirCmd.ps1

Filesize
104B

MD5
66f27c86f734b28d170f3c4e1db8958e

SHA1
25557a67a5dc675e518e1bd83b32d346cc95025c

SHA256
1e9a3e5b03f1f763274fd17b8f5c64e2629923dd0c9cfc94865eadef9c69e90b

SHA512
f793c9742586e3150974e490c849dd0ed7a6a57e31d7affcc02406662e81378218991e6dbe63105db01cf7c352f1e76b4e71249fe8781a880258f9e9cab7fd7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Test.bat

Filesize
18B

MD5
e57a11eb25dd25ed755c1839d0e4a9b7

SHA1
e26d908081f93f2f28cef5091fd43a3ca1920dcf

SHA256
c196c15d05b0197ea127877380a5001d6b294083c4fd92e62be55438e6a7bdff

SHA512
1e2b50c39b67f0f1ac0cec2126817b033355147923ae8303b82ea9e19194820e9796c5cbff4af4f89683b471f4b7262dbd3953bdd7d87bfcd2cdaaf0991ad607

Download Submit
C:\Users\Admin\AppData\Local\Temp\Test.vbs

Filesize
10B

MD5
7aba77b3cbdf0b7c78cee71d55dd6f50

SHA1
e1c06f4fc0029aa239aa2a8d5d6a0ec6bbd89516

SHA256
9b972e91c3c303336561ca43420e9a808c34812246b9fe6d85c22bf005254e3a

SHA512
d6e8770db9f96c32dc76fa2d8a78f50a24938be6e2aabd3214080a4db0ec497ec5ce6ae1b481d8b0bb442779812e7222e435d8f5e6b5dd763c46a959a4c14f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\bsod.bat

Filesize
40B

MD5
e9ca92728d880c80a242d55390769d37

SHA1
c82e73e41912b3543150d2f8e520b77e66c64876

SHA256
a67f7e91a028d2695cdacf984b5fd2f33ee90e95d84467df1e33a94e3573e19e

SHA512
70fc9d051486e2ec964baefedf4fb8959baa3dee74887028dd4ff4337ecf0f70012c9eec855f1a65e9f141d3b76d9c616039a292e779ce690f1e191397eb088c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3812ad0f97e49c3b17159b77fbac1b14

SHA1
d20e98479941c68ac8b128a61c68f7200f0b5562

SHA256
f43ad74273df8a99d90709993f5db44b38e1ff943db77c9986a2c091055b0e3e

SHA512
003340fdfd0b7fe6a5fafe19ed09bd5b428461f36e2411915091dd95ee893991b792b7caa8019deeca651ec2da12f5c79b77f3f4278cf9194b04408e14c175b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3812ad0f97e49c3b17159b77fbac1b14

SHA1
d20e98479941c68ac8b128a61c68f7200f0b5562

SHA256
f43ad74273df8a99d90709993f5db44b38e1ff943db77c9986a2c091055b0e3e

SHA512
003340fdfd0b7fe6a5fafe19ed09bd5b428461f36e2411915091dd95ee893991b792b7caa8019deeca651ec2da12f5c79b77f3f4278cf9194b04408e14c175b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3812ad0f97e49c3b17159b77fbac1b14

SHA1
d20e98479941c68ac8b128a61c68f7200f0b5562

SHA256
f43ad74273df8a99d90709993f5db44b38e1ff943db77c9986a2c091055b0e3e

SHA512
003340fdfd0b7fe6a5fafe19ed09bd5b428461f36e2411915091dd95ee893991b792b7caa8019deeca651ec2da12f5c79b77f3f4278cf9194b04408e14c175b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OEEYS7MVFQPQWPMJE7MG.temp

Filesize
7KB

MD5
3812ad0f97e49c3b17159b77fbac1b14

SHA1
d20e98479941c68ac8b128a61c68f7200f0b5562

SHA256
f43ad74273df8a99d90709993f5db44b38e1ff943db77c9986a2c091055b0e3e

SHA512
003340fdfd0b7fe6a5fafe19ed09bd5b428461f36e2411915091dd95ee893991b792b7caa8019deeca651ec2da12f5c79b77f3f4278cf9194b04408e14c175b9

Download Submit
memory/1104-135-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1104-137-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/1104-134-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/1104-132-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/1972-170-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/1972-172-0x000007FEF4E00000-0x000007FEF579D000-memory.dmp

Filesize
9.6MB

Download
memory/1972-156-0x000007FEF4E00000-0x000007FEF579D000-memory.dmp

Filesize
9.6MB

Download
memory/1972-155-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/1972-153-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/1972-157-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/1972-162-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/1972-160-0x000007FEF4E00000-0x000007FEF579D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-128-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-127-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-130-0x00000000025FB000-0x0000000002662000-memory.dmp

Filesize
412KB

Download
memory/2044-126-0x00000000025F4000-0x00000000025F7000-memory.dmp

Filesize
12KB

Download
memory/2044-118-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2044-121-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/3004-220-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-218-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-219-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-217-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-221-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-222-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-223-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-224-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-225-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-216-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/3004-214-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download