b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d

Analysis

max time kernel
53s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
Size 12.7MB
Sample240521-kasfzaed79
SHA256 b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d
MD5 89b7b7ef9b767dcd0ff8d0581127136b
SHA1 98d6040d7f8e49baf06b3f35cc07878e6a1c9830
SHA512 7af4233ee2262d64f470556d4a9614e943b878cc53a4665523ea208f14607ae6734c90d4b9b371627f17a925e3ca96a619c869161d690488bd0bc90e560e7524
SSDEEP 196608:q07lhv4+zaZK4DT81o3LAKmP0R/7pS2E5RV9BYb3mnSdK/zvwpyFl1v6psjLm:N7zxzaZKt1o3IP0RsLRVk4fFl1v6pQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence ransomware upx

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0003000000000493-33.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4536	drawerror.exe
4580	Ghost.exe

Loads dropped DLL 1 IoCs

pid	Process
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "c:\\cc.ico"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000000493-33.dat	upx
behavioral2/memory/2064-39-0x0000000010000000-0x00000000100B3000-memory.dmp	upx
behavioral2/memory/2064-45-0x0000000010000000-0x00000000100B3000-memory.dmp	upx
behavioral2/memory/2064-51-0x0000000010000000-0x00000000100B3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	cmd.exe
File opened (read-only)	\??\q:	cmd.exe
File opened (read-only)	\??\u:	cmd.exe
File opened (read-only)	\??\g:	cmd.exe
File opened (read-only)	\??\l:	cmd.exe
File opened (read-only)	\??\n:	cmd.exe
File opened (read-only)	\??\r:	cmd.exe
File opened (read-only)	\??\e:	cmd.exe
File opened (read-only)	\??\h:	cmd.exe
File opened (read-only)	\??\j:	cmd.exe
File opened (read-only)	\??\i:	cmd.exe
File opened (read-only)	\??\t:	cmd.exe
File opened (read-only)	\??\w:	cmd.exe
File opened (read-only)	\??\s:	cmd.exe
File opened (read-only)	\??\v:	cmd.exe
File opened (read-only)	\??\x:	cmd.exe
File opened (read-only)	\??\y:	cmd.exe
File opened (read-only)	\??\z:	cmd.exe
File opened (read-only)	\??\k:	cmd.exe
File opened (read-only)	\??\m:	cmd.exe
File opened (read-only)	\??\o:	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "1.bmp"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
3956	taskkill.exe
5588	taskkill.exe
1176	taskkill.exe
2420	taskkill.exe
4852	taskkill.exe
5592	taskkill.exe
4472	taskkill.exe
4532	taskkill.exe
5596	taskkill.exe
5176	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\TileWallpaper = "2"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.msi\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gho\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.png	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.com	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.chm\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jfif\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ra	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ico	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.msi	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "c:\\cc.ico"	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mvb\ = "txtfile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\ = "txtfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ico\ = "txtfile"	cmd.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	4936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4936	AUDIODG.EXE
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	5592	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4580	Ghost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
4580	Ghost.exe
2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4536	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	93
PID 2064 wrote to memory of 4536	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	93
PID 2064 wrote to memory of 4536	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	93
PID 2064 wrote to memory of 4580	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	97
PID 2064 wrote to memory of 4580	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	97
PID 2064 wrote to memory of 4580	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	97
PID 2064 wrote to memory of 2868	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	98
PID 2064 wrote to memory of 2868	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	98
PID 2064 wrote to memory of 2868	2064	b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe	98
PID 2868 wrote to memory of 3424	2868	cmd.exe	100
PID 2868 wrote to memory of 3424	2868	cmd.exe	100
PID 2868 wrote to memory of 3424	2868	cmd.exe	100
PID 3424 wrote to memory of 2364	3424	cmd.exe	102
PID 3424 wrote to memory of 2364	3424	cmd.exe	102
PID 3424 wrote to memory of 2364	3424	cmd.exe	102
PID 3424 wrote to memory of 4012	3424	cmd.exe	104
PID 3424 wrote to memory of 4012	3424	cmd.exe	104
PID 3424 wrote to memory of 4012	3424	cmd.exe	104
PID 2868 wrote to memory of 3956	2868	cmd.exe	106
PID 2868 wrote to memory of 3956	2868	cmd.exe	106
PID 2868 wrote to memory of 3956	2868	cmd.exe	106
PID 2364 wrote to memory of 4888	2364	cmd.exe	107
PID 2364 wrote to memory of 4888	2364	cmd.exe	107
PID 2364 wrote to memory of 4888	2364	cmd.exe	107
PID 2364 wrote to memory of 4824	2364	cmd.exe	109
PID 2364 wrote to memory of 4824	2364	cmd.exe	109
PID 2364 wrote to memory of 4824	2364	cmd.exe	109
PID 2364 wrote to memory of 3548	2364	cmd.exe	111
PID 2364 wrote to memory of 3548	2364	cmd.exe	111
PID 2364 wrote to memory of 3548	2364	cmd.exe	111
PID 2364 wrote to memory of 232	2364	cmd.exe	113
PID 2364 wrote to memory of 232	2364	cmd.exe	113
PID 2364 wrote to memory of 232	2364	cmd.exe	113
PID 3424 wrote to memory of 2484	3424	cmd.exe	116
PID 3424 wrote to memory of 2484	3424	cmd.exe	116
PID 3424 wrote to memory of 2484	3424	cmd.exe	116
PID 3424 wrote to memory of 3320	3424	cmd.exe	117
PID 3424 wrote to memory of 3320	3424	cmd.exe	117
PID 3424 wrote to memory of 3320	3424	cmd.exe	117
PID 4824 wrote to memory of 1628	4824	cmd.exe	119
PID 4824 wrote to memory of 1628	4824	cmd.exe	119
PID 4824 wrote to memory of 1628	4824	cmd.exe	119
PID 4888 wrote to memory of 1472	4888	cmd.exe	121
PID 4888 wrote to memory of 1472	4888	cmd.exe	121
PID 4888 wrote to memory of 1472	4888	cmd.exe	121
PID 4888 wrote to memory of 2136	4888	cmd.exe	122
PID 4888 wrote to memory of 2136	4888	cmd.exe	122
PID 4888 wrote to memory of 2136	4888	cmd.exe	122
PID 4824 wrote to memory of 1848	4824	cmd.exe	123
PID 4824 wrote to memory of 1848	4824	cmd.exe	123
PID 4824 wrote to memory of 1848	4824	cmd.exe	123
PID 3424 wrote to memory of 5044	3424	cmd.exe	124
PID 3424 wrote to memory of 5044	3424	cmd.exe	124
PID 3424 wrote to memory of 5044	3424	cmd.exe	124
PID 4012 wrote to memory of 944	4012	cmd.exe	125
PID 4012 wrote to memory of 944	4012	cmd.exe	125
PID 4012 wrote to memory of 944	4012	cmd.exe	125
PID 4888 wrote to memory of 5200	4888	cmd.exe	133
PID 4888 wrote to memory of 5200	4888	cmd.exe	133
PID 4888 wrote to memory of 5200	4888	cmd.exe	133
PID 3548 wrote to memory of 5208	3548	cmd.exe	134
PID 3548 wrote to memory of 5208	3548	cmd.exe	134
PID 3548 wrote to memory of 5208	3548	cmd.exe	134
PID 3320 wrote to memory of 5264	3320	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe
"C:\Users\Admin\AppData\Local\Temp\b0eddf8fe0c88774498c5bc1cdb2af6f0ff3501f7eaf04a7b3f70b6e4809bb9d.exe"
1⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- \??\c:\drawerror.exe
  c:\drawerror.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- \??\c:\Ghost.exe
  c:\Ghost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\ÓðÒí.bat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:1472
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:2136
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:5200
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:5788
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:1628
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:1848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        
        PID:5688
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:5208
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        
        PID:232
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        6⤵
        Modifies registry class
        
        PID:5304
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Modifies registry class
        
        PID:5332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Modifies registry class
        
        PID:944
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        
        PID:5676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      PID:2484
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Modifies registry class
        
        PID:5620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\1.bat
        5⤵
        Modifies registry class
        
        PID:5264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\1.bat
      4⤵
      Modifies registry class
      PID:5280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 360tray.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\SysWOW64\reg.exe
    reg add
    3⤵
    PID:5296
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v nodrives /t REG_DWORD /d 60 /f
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\subst.exe
    subst b: C:\
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\subst.exe
    subst h: C:\
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\subst.exe
    subst i: C:\
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\subst.exe
    subst j: C:\
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\subst.exe
    subst l: C:\
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\subst.exe
    subst m: C:\
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\subst.exe
    subst n: C:\
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\subst.exe
    subst o: C:\
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\subst.exe
    subst r: C:\
    3⤵
    PID:6116
- - C:\Windows\SysWOW64\subst.exe
    subst t: C:\
    3⤵
    PID:6140
- - C:\Windows\SysWOW64\subst.exe
    subst k: C:\
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\subst.exe
    subst p: C:\
    3⤵
    PID:920
- - C:\Windows\SysWOW64\subst.exe
    subst q: C:\
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\subst.exe
    subst s: C:\
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\subst.exe
    subst u: C:\
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\subst.exe
    subst v: C:\
    3⤵
    PID:5320
- - C:\Windows\SysWOW64\subst.exe
    subst w: C:\
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\subst.exe
    subst x: C:\
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\subst.exe
    subst y: C:\
    3⤵
    PID:5644
- - C:\Windows\SysWOW64\subst.exe
    subst z: C:\
    3⤵
    PID:5868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im explorer.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideClock /t REG_DWORD /d 1 /f
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 01000000 /f
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 0 /f
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
    3⤵
    PID:6012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\1.bat
  2⤵
  PID:5568
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\±øÍÅ.bat
  2⤵
  - Enumerates connected drives
  PID:6104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\ascaris.bat
  2⤵
  PID:1312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:4472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:4532
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:2420
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:5596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:5176
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 360tray.exe
  2⤵
  - Kills process with taskkill
  PID:4852

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
1⤵
PID:5384

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4224

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\1.bat
Size 28B
SHA256 3c32ecce41201efa27dd4e18d5d0b88c429fc9427829f565512e44b487ce120e
MD5 ccff006fd8c4150a18669ced52244d6a
SHA1 743fe1b7fe0a8215fbb5eeeb95e55ba4f39cb01e
SHA512 114e98ad958e4cbdad94d24753c2a67a1080160c4fa35d9839420aa5de9f28446794c606b29d58f342f7316421ecfb877741957cd979736ea9fcfae06981bf79
MD5 SHA1 SHA512

Submit Download

1.bat

Path C:\1.bat
Size 18B
SHA256 edc099fdfa8210f123cdc51dfb3256cc7dc3c0af614fd63e3c1d6182bf37ae21
MD5 c6c7b4dcc81c27c76c49dfd2acee715e
SHA1 ef6a2a2ccb276bc9a057cd0d6f0bd3867d1988b7
SHA512 b9d1aba58a20238e3870c9785a43d1c64273b3c332d545f8c363d02844214f6dcd3332c35281b2663ed2192728c33d915d457615c6f4057a1dccdea188d38898
MD5 SHA1 SHA512

Submit Download

Ghost.exe

Path C:\Ghost.exe
Size 20KB
SHA256 a70f454dd1b123be4dda9ee8e22e3a5f414397b8a7ce221647d2e12f9244146a
MD5 69c97e6fcc20eda26024caedc87449f3
SHA1 1d784041e60c83b6b5bd1a644a5daff8d7ddb627
SHA512 de7f603f33ac35ceb1ef769e9a349f3887be451af1d7ea71996496db9584f820c483ae4c6db672b2b47b2c9330effe2cffac6a30aafe9396edb78fb680f776ec
SSDEEP 96:/lxJWhvEEEyg/ybZa7fvnk1XotBEEi8yGKN0fIaUhJoo5Q5D2dlQEsEEE:/TEhVg0k7fveJz0QlhwD24E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ascaris.dll

Path C:\Users\Admin\AppData\Local\Temp\ascaris.dll
Size 224KB
SHA256 9b2c140b6c47666024128b8ac9f1e8b2fe041caf6d286eec638018beb48394cd
MD5 4520eee1da294b6c8428cea200b81d18
SHA1 2d1478c5aef0934db397b8c593ec2432d9809b83
SHA512 aff152ec0672597c483d15fe04fe7ddf55155827a2df588ab83efc45301cedb670be23a566ee8c268e497d33e21b48ee8723ad812d253f9d1f284e3324734ac0
SSDEEP 6144:0dw0RNOTRFf5hTuKpaqKRsih6rZDC/dRoS:WifTu0icpwdRoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 840B
SHA256 1aaf0d85389d6359d30f2d0f0942f8e1369871e75350f4fbcf1edd79836d9926
MD5 cc86e1a5224fcaa035e618fa766d5b53
SHA1 09913248e3983ee751bddca919599e9f5a07685a
SHA512 177ecec47415e30c91e46576f472b9371818c73964b02c275a3e8f525fc5f6436d911cbb36ee72de15907f8e9b4c2bc2b5bbe662f44762ecec1120a99a2eef3b
MD5 SHA1 SHA512

Submit Download

drawerror.exe

Path C:\drawerror.exe
Size 9KB
SHA256 2eba41b0399d91c5677f9ead8beb2610f94026a6a91c84ff7a4f19cfafbe61ad
MD5 a4b655c4580fad879c431ac265bd1409
SHA1 f98d37a7c2a5a24f7d6871c87d150de4417e00ad
SHA512 af7124caef5babde34421550f1aef4c74b88ddd657c3eaf4af5887a61b6b8c31b09b199886cab92a87eb089502f049c11da266c900de02c8310058b4c704e854
SSDEEP 96:RAfpZTzqH3WL26v3df7wlap1akXHNasE73KK/QyWV7SZ:GzTBKU3dfU2Isa7LKxVOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ascaris.bat

Path \??\c:\ascaris.bat
Size 13KB
SHA256 b085349f14e199ee7344ae9120898da281b6d410d6b595dffddb55f3645a251f
MD5 54552eebfc4c487d01daa63048efa72c
SHA1 7f0ef347eeae3b26efb3c24a83d03958cb7fa3ab
SHA512 a1dc49c221da7ebe12229807664b164bc99bff4fa918cfd31a818ce779566b9e8d7eef22355b187dfa8d064d4ed92d164465a604ef79c824065a7e5e60669b23
SSDEEP 96:TNOMORMk/3b3jVvSGSwnHjuISxx7b1TITS491ZoxlC9jqd7nDbxHoiSJVePCoRZ4:57G9SGSy67x4F6wVePCoGVZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

±øÍÅ.bat

Path \??\c:\±øÍÅ.bat
Size 166B
SHA256 80552c862831e82ffa22045b26efeef84e89576f0ab385b5b87d8467d98b9e94
MD5 32f678c01c8d5edca7ecaf35937259f6
SHA1 7079515682536cf2366bcdf0f44a8ce83a17c806
SHA512 2833b2fd557b51505d8a2a251b664e51944c1a5e65109b76719d6ac970c3058159460b3d9205ab98ce65c32c066d52f1320fc79170c2b06a02c5ecbecaadcc7a
MD5 SHA1 SHA512

Submit Download

ÓðÒí.bat

Path \??\c:\ÓðÒí.bat
Size 2KB
SHA256 6db71de3499a83a9602d693e99d36127772c743b595e26f36c69cba2e2186f2e
MD5 8f0b90a560cc05a8fe5068d4db3087bd
SHA1 1d53e5256d162964cf38cf1d73ae6db8a633ea6d
SHA512 df375eac9903fbe5675806f078e0faf0bb7342737ee34359edd3e55866ce5ecd27b09c5e8fff06e1463fe2ebb18bfbf93ce19adbcee986effa1dcbcd34a602a6
MD5 SHA1 SHA512

Submit Download

memory/2064-39-0x0000000010000000-0x00000000100B3000-memory.dmp

Download

memory/2064-45-0x0000000010000000-0x00000000100B3000-memory.dmp

Download

memory/2064-51-0x0000000010000000-0x00000000100B3000-memory.dmp

Download

memory/2064-0-0x0000000000400000-0x00000000010C9000-memory.dmp

Download

memory/4536-25-0x0000000000400000-0x0000000000409000-memory.dmp

Download