Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/05/2024, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe
- Size 98KB
- Sample240508-rmfq9sgf3v
- SHA256 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871
- MD5 8e969a1f2381657f18de466ba4f9ecc0
- SHA1 b95798444a7ad167dfa21ec01f4191c434d622a8
- SHA512 a38bd87d16f5ba768f714b07c7c574c1774f0542151fc3d0872665894a7d4c5d16bbde2b262132d9b32a80a41a6b325e400ffa0beab339e5047c420fa851c61e
- SSDEEP 1536:gLPQsrz8haFpmqr76/Y3WLpQQwFxV7qjh3rmKPNIwW:gLPN8QFda/2hAjZqMNId
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 3884 Logo1_.exe 2704 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe File created C:\Windows\Logo1_.exe b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe 3884 Logo1_.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4528 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 84 PID 2820 wrote to memory of 4528 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 84 PID 2820 wrote to memory of 4528 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 84 PID 4528 wrote to memory of 4252 4528 net.exe 86 PID 4528 wrote to memory of 4252 4528 net.exe 86 PID 4528 wrote to memory of 4252 4528 net.exe 86 PID 2820 wrote to memory of 4668 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 90 PID 2820 wrote to memory of 4668 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 90 PID 2820 wrote to memory of 4668 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 90 PID 2820 wrote to memory of 3884 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 91 PID 2820 wrote to memory of 3884 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 91 PID 2820 wrote to memory of 3884 2820 b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe 91 PID 3884 wrote to memory of 3740 3884 Logo1_.exe 92 PID 3884 wrote to memory of 3740 3884 Logo1_.exe 92 PID 3884 wrote to memory of 3740 3884 Logo1_.exe 92 PID 3740 wrote to memory of 2880 3740 net.exe 94 PID 3740 wrote to memory of 2880 3740 net.exe 94 PID 3740 wrote to memory of 2880 3740 net.exe 94 PID 4668 wrote to memory of 2704 4668 cmd.exe 96 PID 4668 wrote to memory of 2704 4668 cmd.exe 96 PID 4668 wrote to memory of 2704 4668 cmd.exe 96 PID 3884 wrote to memory of 4284 3884 Logo1_.exe 97 PID 3884 wrote to memory of 4284 3884 Logo1_.exe 97 PID 3884 wrote to memory of 4284 3884 Logo1_.exe 97 PID 4284 wrote to memory of 1444 4284 net.exe 99 PID 4284 wrote to memory of 1444 4284 net.exe 99 PID 4284 wrote to memory of 1444 4284 net.exe 99 PID 3884 wrote to memory of 3548 3884 Logo1_.exe 56 PID 3884 wrote to memory of 3548 3884 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe"C:\Users\Admin\AppData\Local\Temp\b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4252
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45A4.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe"C:\Users\Admin\AppData\Local\Temp\b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe"4⤵
- Executes dropped EXE
PID:2704
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2880
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1444
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 265KB
- SHA256 796386a95ca9b7bd73cdeeb4a5974272cb2aee380a9176213e7f90930ada8506
- MD5 144a07f0eb9ee08baff92603553bb51b
- SHA1 0cf1b6d320f8f167584209cd250c1d2e8fb31aaf
- SHA512 712139a7c7ba2f695d3a96440ea855505ad7b80b05657e1c31f1254168de57a2d688f21333751fe9fa4f3a6d439a506214894358aa0578a807ade561fa5050ae
- SSDEEP 6144:vaGgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:vatitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 584KB
- SHA256 1337ca183f3b289a2d7919a1b00f6aa195bbeb5038123ba7aa281fee198936ee
- MD5 71bf6bdc8615ef7c5de0df63604695eb
- SHA1 70441d785313ea209b9028cd12e34c0f1bc4cc4f
- SHA512 0a1b1768e02621d916f88df3b3b2c2e1c9688eb8b874e47864a4f0a3ee23c9d673f1ef92f40e24735392df26bc4f06b3abfeb6e36c95268fa98f1404715c7e5f
- SSDEEP 6144:zaPE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+n:za87a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 650KB
- SHA256 d09336ea46c4c6e8b83dff2aa4bd31d9e993bcd572e6b274449adc5f9e51627d
- MD5 c0651f5f5ed8c9967b91a89a86cc4dc4
- SHA1 6866b91667021c6cc7fd680451a5ea183dce3cd1
- SHA512 1cf7354f1b204415fd099c1fdaeecda5f0daec86948cee48da433d847d0ce94fee7fcf2365675868e82450891244b04902d730d6b0e0dfb5c29df1cd4b5d8ad6
- SSDEEP 12288:Zbac5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:9/5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a45A4.bat
- Size 722B
- SHA256 8245e9f05f7e495786edf6c97d4cd9e0c98e5ef3e528a4a01b8e0483583f8f58
- MD5 00bfc285b588f3beec73766f73662e51
- SHA1 fccbe3a47332fda1874c2aed5f9ba0f16d6090b6
- SHA512 ed0d14fa38352112cd84b08096083c568644bce77f2cb202e1753e8568e8a4897eff4bc02f1a31ced4ee938632ed90dbcac7981b7b07904517ebed5b5a3c3661
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\b8ca31703c834baf0e7c0d3d0f16f28710ebd7101407e5003acea8539c660871.exe.exe
- Size 57KB
- SHA256 5122bb9ce0e46f847cf1920c4e2fcead16b3101f6f03d3225e92a5f80a2f1c1c
- MD5 fa71e60855b37c3c26d9ebbb52a0c3de
- SHA1 e608fea1cd4d5a34d7a86ca4e64d1db67f539f29
- SHA512 1b8cc9b37c24c9a5661e26cfb162fd1cb6419a4beb472bf100f4fbb61dfe9c353e8d3502af3d9a55d44a5f07dc0bf49412d5ca0d0d20fe466e3156ad1a88886b
- SSDEEP 768:qQwmKxyA5dmtdLAuDeGJiqrmehiVSrmaBP39VCwLC:qQwFxV7qjh3rmKPNIwW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 40KB
- SHA256 2e77a08e9801594b1f91a8467a15f4e3078d4a9804e3a25567ac0f6a594f6eb1
- MD5 ee15a6a567557bb41533caabe57892ef
- SHA1 9507149eb9a8a36be2fddca32ffc2ee56b1c0712
- SHA512 41c4fcfc250209b1bf9e3d4d99030ff558a46089083ef92b23f924e7c6de8d9a2dcc8013957183bf544bdff2fa3ddfd5198511c2f19989f2736bef73a8adc9e4
- SSDEEP 768:gPL2NETPfY+Vxr1x5cE9Fl5pz8hY16sFpmqraWrUE0PNNj56F3Bk7LpQL:gLPQsrz8haFpmqr76/Y3WLp
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini
- Size 8B
- SHA256 2b4efa4e113d3044c8e47f59a7b75225cc7736c2fa28f9e52949b9441f3d77ca
- MD5 ec89b9cba2f5e7b9394fdd901d6c3977
- SHA1 63b0db3abcd08b863a9a3944799b41efa264db40
- SHA512 901f7d44754e59fba0b1b90341927744f670463f4d18e2694617f74fe4e3f456e9088530bccc16e758fc67a23f91380a3655121ba911e8ff5173f3ac4cb0f1d2
- MD5 SHA1 SHA512