7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
Size

1.8MB
MD5

aeec9d4e8e49b8c3cbd8ec691e0c071c
SHA1

e24dfe791a6d0f988c76e1bdda149abde418fd6f
SHA256

7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc
SHA512

858280134baefb8a8076c966f665145573efc7a9c620a4e33725bd80217b396f4dfc57ed485224e96327ee4729e88a66a269c9df611023c42095ead833d42c5c
SSDEEP

49152:07DYbVtugvKlSA+n32pWx43UxThfAToZqScjc3tu:O+rvgz+n32kCUxTRog

Score

7^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4448	Logo1_.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
File created	C:\Windows\Logo1_.exe	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserMachineCode	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserMachineCode\MachineGuid = "A2259C96E7CCB8C63444E82409505F52"	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
4448	Logo1_.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
1704	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4380	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	86
PID 2264 wrote to memory of 4380	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	86
PID 2264 wrote to memory of 4380	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	86
PID 2264 wrote to memory of 4448	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	87
PID 2264 wrote to memory of 4448	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	87
PID 2264 wrote to memory of 4448	2264	7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe	87
PID 4448 wrote to memory of 4680	4448	Logo1_.exe	88
PID 4448 wrote to memory of 4680	4448	Logo1_.exe	88
PID 4448 wrote to memory of 4680	4448	Logo1_.exe	88
PID 4680 wrote to memory of 440	4680	net.exe	91
PID 4680 wrote to memory of 440	4680	net.exe	91
PID 4680 wrote to memory of 440	4680	net.exe	91
PID 4380 wrote to memory of 1704	4380	cmd.exe	93
PID 4380 wrote to memory of 1704	4380	cmd.exe	93
PID 4380 wrote to memory of 1704	4380	cmd.exe	93
PID 4448 wrote to memory of 3136	4448	Logo1_.exe	41
PID 4448 wrote to memory of 3136	4448	Logo1_.exe	41

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3136
- C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
  "C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8695.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe
      "C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      PID:1704
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
484KB

MD5
c6d74bb54c8490994fbcee53ed3d7104

SHA1
61896a81c095d9327925f3779047707bb3b90ae6

SHA256
5fd194326856bc19a3e9121f8d1f6c56039ef475c867bc6c8fa7c62f71af824d

SHA512
85a1b9fd25b89b282f3ced2f995e42aa28ebf576627d039045eff0ae7122e7ead6efc96980ac3185b549df26dc69d2ebcb3a3c8b9651a3eb681e95e9990c9d58

Download Submit
C:\Program Files\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8695.bat

Filesize
722B

MD5
54c3a45699e28f82bfeffc8ff047abe5

SHA1
f1ffbf9ea85423fdd37426687bf6a7bd2632ada0

SHA256
57db0fc93efd2c37cf6004eee1c14a95d89903978c4e32dbad199ee1feda662e

SHA512
dc05d0653fc9c98743d764d4ea8aa33e18f19263ce9d43c6808232eb425722d0d59d713b03cec9fd1f050ef2037f4439d136548a473fb29626096fcf26fdb9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe

Filesize
1.8MB

MD5
8f6a1effaab5bc3aa41a210fbe858148

SHA1
daab0e4852dfeb944d5fa13f5a9039880c9023f9

SHA256
ce537a333ddb3271a3bc68b9f1cd1d22808c0808eac1fe4225c9ad95e771c7e5

SHA512
bbe79b942937cf19a76ee5b320bf46e33323e09d587dc42066131ab83ad4da86181725560dd919c9316e67e34fded1f472a43235f99c4e3d3e1b780f4d5263b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e62fabd24864f6e937e3f4eb7b0d584eab1c7a1fea79074ae458d9d838a6edc.exe.exe

Filesize
1.8MB

MD5
8f6a1effaab5bc3aa41a210fbe858148

SHA1
daab0e4852dfeb944d5fa13f5a9039880c9023f9

SHA256
ce537a333ddb3271a3bc68b9f1cd1d22808c0808eac1fe4225c9ad95e771c7e5

SHA512
bbe79b942937cf19a76ee5b320bf46e33323e09d587dc42066131ab83ad4da86181725560dd919c9316e67e34fded1f472a43235f99c4e3d3e1b780f4d5263b1

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c438cd45dba79de60cfe6dedf51add8b

SHA1
9a84bde939cfeae643e96ce34a3bceee2e9f640e

SHA256
2d8f4cf4e9edb7b563432e0974e2de11b776c274739521674577c9242e509f9c

SHA512
7f28a39c22247d5ff2c14f02c415defa68f960b7448f87ca8c50ea2ca0f41454c313b57e76505f24ac5430da4f2afd487b3e32c10841fea01c86c5816a4f997c

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c438cd45dba79de60cfe6dedf51add8b

SHA1
9a84bde939cfeae643e96ce34a3bceee2e9f640e

SHA256
2d8f4cf4e9edb7b563432e0974e2de11b776c274739521674577c9242e509f9c

SHA512
7f28a39c22247d5ff2c14f02c415defa68f960b7448f87ca8c50ea2ca0f41454c313b57e76505f24ac5430da4f2afd487b3e32c10841fea01c86c5816a4f997c

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
c438cd45dba79de60cfe6dedf51add8b

SHA1
9a84bde939cfeae643e96ce34a3bceee2e9f640e

SHA256
2d8f4cf4e9edb7b563432e0974e2de11b776c274739521674577c9242e509f9c

SHA512
7f28a39c22247d5ff2c14f02c415defa68f960b7448f87ca8c50ea2ca0f41454c313b57e76505f24ac5430da4f2afd487b3e32c10841fea01c86c5816a4f997c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-919254492-3979293997-764407192-1000\_desktop.ini

Filesize
10B

MD5
81570c50286369016cef7a9f904c4b04

SHA1
b5758b23667cb35cad0adb23371b830fcee4f4e5

SHA256
b882f41a5c84d248a75714eaf215a9e363a49361b6a14beedb921ee3dfdb46a1

SHA512
0e6c479b0252e24635810b7d030cc9b5b17603ee20ccf62812446b8d15884521c6c7be65dfc0090bb1502e859fae27c2a63b3e58be714021f473a88407982162

Download Submit
memory/1704-24-0x0000000000CF0000-0x0000000000ED0000-memory.dmp

Filesize
1.9MB

Download
memory/1704-32-0x0000000000CF0000-0x0000000000ED0000-memory.dmp

Filesize
1.9MB

Download
memory/1704-18-0x0000000000CF0000-0x0000000000ED0000-memory.dmp

Filesize
1.9MB

Download
memory/2264-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-43-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-1121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-1284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-2759-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download