Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
- Target 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe
- Size 75KB
- Sample240531-sytypscf4v
- SHA256 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d
- MD5 4b989924ddf40b0da23a40de83bd2b8e
- SHA1 a0a6811bf05d38b8bce3b8f86de9574f330a124a
- SHA512 c5e030a2a1818a2db968885be31e7913162dc56df495a0a42ac1fb1b9305e846199ce8e6173c377c105bb9ffc85b00d540801385e0c134ba4d1cb2b541a1155f
- SSDEEP 1536:/BVsrz8VuJlMXaDuiN/EToa9D4ZQKbgZi1dst7x9PxQ:/BY8ulMXaKYlZQKbgZi1St7xQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 4636 Logo1_.exe 4244 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe File created C:\Windows\Logo1_.exe 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe 4636 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3336 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 83 PID 1616 wrote to memory of 3336 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 83 PID 1616 wrote to memory of 3336 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 83 PID 3336 wrote to memory of 2004 3336 net.exe 85 PID 3336 wrote to memory of 2004 3336 net.exe 85 PID 3336 wrote to memory of 2004 3336 net.exe 85 PID 1616 wrote to memory of 1212 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 88 PID 1616 wrote to memory of 1212 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 88 PID 1616 wrote to memory of 1212 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 88 PID 1616 wrote to memory of 4636 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 90 PID 1616 wrote to memory of 4636 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 90 PID 1616 wrote to memory of 4636 1616 86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe 90 PID 4636 wrote to memory of 2116 4636 Logo1_.exe 91 PID 4636 wrote to memory of 2116 4636 Logo1_.exe 91 PID 4636 wrote to memory of 2116 4636 Logo1_.exe 91 PID 2116 wrote to memory of 1044 2116 net.exe 93 PID 2116 wrote to memory of 1044 2116 net.exe 93 PID 2116 wrote to memory of 1044 2116 net.exe 93 PID 1212 wrote to memory of 4244 1212 cmd.exe 94 PID 1212 wrote to memory of 4244 1212 cmd.exe 94 PID 4636 wrote to memory of 3000 4636 Logo1_.exe 95 PID 4636 wrote to memory of 3000 4636 Logo1_.exe 95 PID 4636 wrote to memory of 3000 4636 Logo1_.exe 95 PID 3000 wrote to memory of 3880 3000 net.exe 97 PID 3000 wrote to memory of 3880 3000 net.exe 97 PID 3000 wrote to memory of 3880 3000 net.exe 97 PID 4636 wrote to memory of 3512 4636 Logo1_.exe 55 PID 4636 wrote to memory of 3512 4636 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe"C:\Users\Admin\AppData\Local\Temp\86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A09.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe"C:\Users\Admin\AppData\Local\Temp\86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe"4⤵
- Executes dropped EXE
PID:4244
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1044
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3880
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 68c254e4a94926e48dda2811138fac91afef667c3da61e3838c104fd16397f81
- MD5 716cf04b905e9d25d89e76dd2b521b7a
- SHA1 4464bc7b43656fce19a801c5a77f53027b5748fa
- SHA512 cbebb128990ece59a3d052e5d6edfc8bacf33d74aad72f31bd6a98a91194088a5d9a460ac8000fec4cedbe019dc6bfca38912832be0e151bcd2e1f4984b4e578
- SSDEEP 6144:3G5KFgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:3PSitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\ResumeClose.exe
- Size 309KB
- SHA256 ff30bce0c79d16bf1f503277cd91fda7389dc0d4c12854686f4f256e251cbdcc
- MD5 c97cab99923653b714814098def0399c
- SHA1 858add3f951060b2cf1715dd4ae922309931f0b8
- SHA512 0a5954739b46ac625f65d18959b2d66612019dcc651059dc74f5306ca301c33f41360f17f43d24e0c97646d5977dc1d525d0669d2defc4cd07bbab8612bc1785
- SSDEEP 6144:3G5KjRsAebs5YJK+ek0jIGpTG7zg7aTa4i6XItuEisbXb5dgxBaRXp5WLz:3PjRsAe4uV0jI5zg4aVKG1db52xEYv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30
- MD5 11e0853d537d2721ecc655c1fc527e91
- SHA1 c8e23d103e93073ba7c93374878ae9a9f926c944
- SHA512 3e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2
- SSDEEP 12288:gBPh5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:IPh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a4A09.bat
- Size 722B
- SHA256 be41c44fb3aa534b419ef06ae71350995dcfa483d7cd88586a84701868a2836e
- MD5 fa87112c1aec1d8829ec24bdf09a704b
- SHA1 d484aac401784b78e647af5f39e9acd7c3c661ac
- SHA512 bbd69d1a0e2c23f655e75263622960dd309891af817444063b958908122c207a3cbd4f14549f635c2c1da6677d4ab0a08e501f30e1fccff83d85b4aa84ecd74b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\86ebdd99de03c4329fb377700a143e431063593235a5988bbd8d3010eefa059d.exe.exe
- Size 41KB
- SHA256 cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
- MD5 977e405c109268909fd24a94cc23d4f0
- SHA1 af5d032c2b6caa2164cf298e95b09060665c4188
- SHA512 12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
- SSDEEP 768:w3V/q1Boa9cUlxLcbdVOm4KbwFIKZi1dstYiI09/yOPxWETQN:SEToa9D4ZQKbgZi1dst7x9PxQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 814446fb9e1cb93b974ec91e848733bb349d66dc7cc8d9220a98eec278613c8e
- MD5 696135503b001f31cb4cd7844c3e430c
- SHA1 92344ef238d4e3e40fc6e7172d91f58d81bb088a
- SHA512 b0fdf9962a73ce5307fa7283767cc3a6909a02d36ac0776550499c0a81e160917c3e4dd907fa83e617138013107e59dba116f90e3500c13e60f3f0340ebc65ee
- SSDEEP 768:mYBldh+Vxr1x5cE9Fl5pz8UOutDlMXaoSunjXWNN:/BVsrz8VuJlMXaDuiN
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3906287020-2915474608-1755617787-1000\_desktop.ini
- Size 9B
- SHA256 8f1b205bcc3039e60fbcea0063608e012fd662abb41bba5469d530e2c305174d
- MD5 0e9e05c07df1bfb27555d84deb706050
- SHA1 48ebafcf728d66a097bc66ad41b73d7a757c1a0c
- SHA512 d88c9a9bdf6f386278ba86cf3523334eeb5e9efefa9776bc92bdffa41f0c4937e64a7b5f3821b324e13372fa662aa4fb028676f7ed0a73c989edabd490bd05f5
- MD5 SHA1 SHA512