Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
- Target 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe
- Size 70KB
- Sample240603-r2laasba87
- SHA256 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf
- MD5 0b4293db4ed1d6ea2f1a92fa4eac1f81
- SHA1 3786ddfec1795f654974cdabe592a613ce62466b
- SHA512 413e5ba391caa5a8dfca35119a0ada1ee8218b7a313bde68e71c1cd914acf4544b336b1cc0151b1d5432698ed6aeac6249b88eab0f7afb6cb654c5ff2332136a
- SSDEEP 1536:6gcx1aeg1v9OQZVUKM6+kKpRriw+d9bHrkT5gUHz7FxtJ:6gf9lOzKM5pRrBkfkT5xHzD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 1948 Logo1_.exe 4136 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\97B42B05-DC65-4D4A-BB22-7A16E7E75EDB\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe 1948 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3996 wrote to memory of 1392 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 84 PID 3996 wrote to memory of 1392 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 84 PID 3996 wrote to memory of 1392 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 84 PID 1392 wrote to memory of 3332 1392 net.exe 86 PID 1392 wrote to memory of 3332 1392 net.exe 86 PID 1392 wrote to memory of 3332 1392 net.exe 86 PID 3996 wrote to memory of 3660 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 90 PID 3996 wrote to memory of 3660 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 90 PID 3996 wrote to memory of 3660 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 90 PID 3996 wrote to memory of 1948 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 92 PID 3996 wrote to memory of 1948 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 92 PID 3996 wrote to memory of 1948 3996 2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe 92 PID 1948 wrote to memory of 3572 1948 Logo1_.exe 93 PID 1948 wrote to memory of 3572 1948 Logo1_.exe 93 PID 1948 wrote to memory of 3572 1948 Logo1_.exe 93 PID 3572 wrote to memory of 4640 3572 net.exe 95 PID 3572 wrote to memory of 4640 3572 net.exe 95 PID 3572 wrote to memory of 4640 3572 net.exe 95 PID 3660 wrote to memory of 4136 3660 cmd.exe 96 PID 3660 wrote to memory of 4136 3660 cmd.exe 96 PID 1948 wrote to memory of 1408 1948 Logo1_.exe 97 PID 1948 wrote to memory of 1408 1948 Logo1_.exe 97 PID 1948 wrote to memory of 1408 1948 Logo1_.exe 97 PID 1408 wrote to memory of 3832 1408 net.exe 99 PID 1408 wrote to memory of 3832 1408 net.exe 99 PID 1408 wrote to memory of 3832 1408 net.exe 99 PID 1948 wrote to memory of 3312 1948 Logo1_.exe 55 PID 1948 wrote to memory of 3312 1948 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe"C:\Users\Admin\AppData\Local\Temp\2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7947.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe"C:\Users\Admin\AppData\Local\Temp\2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe"4⤵
- Executes dropped EXE
PID:4136
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4640
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3832
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 b7fef75f8492b4117af80b0968ef4b769e83d58f92c1d103239a106d91689007
- MD5 49c3209b5ddfe05fc167e61053968a7a
- SHA1 34a49c3f868b51ff2fb4b19fcf21c5c0faa0ba9b
- SHA512 9641b6672a2fb6f13d97b0bb60290f576288b7c995500cf3b21a5bbcb58de0db04ace91276769d764b95092c1053ad75a5c7256a22089d40c6a843ed98128e33
- SSDEEP 6144:f1NM5pHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:f1upk7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 643KB
- SHA256 a31829ad88d68b47eea131646207d5b3b53468a9bdd665365f608b6ce186b8ba
- MD5 ab26006fce082246aa3ffd6ff4cbcf89
- SHA1 f8686e05d1aeb169e13c8d3889b01dd3988d5124
- SHA512 0b7f2d8dab9c10a6619970c6e0568380d79951ec942f79bc035b8c93ebe8b23d925e42b62e22aaacce6ff981fbd719526aa797031b50a036e7e6f5aef0728df5
- SSDEEP 12288:D51upk5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:N1Ak5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a7947.bat
- Size 722B
- SHA256 a0be8b4cc367afa67e5ca472b7155cb8c0f6ac17e6d08bfb7c6d771d6859c2b7
- MD5 3ebdbc3963ea8ea67c65c023d9e118fc
- SHA1 5fbf931d96587e599b8abe76611099342e817b90
- SHA512 e15730bc1240fbfefceecec25d611e99bfe93a7b930970ad8f5b3104cc3093330bc5c9a97acfe9c631a0f24c0b7d88c6a0c3af2f5d88ee10a5786faef0f62d95
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2234400405f40a87596e5628f68ee7cb736ce3a4302a57049d36844b7686f1bf.exe.exe
- Size 36KB
- SHA256 8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
- MD5 9f498971cbe636662f3d210747d619e1
- SHA1 44b8e2732fa1e2f204fc70eaa1cb406616250085
- SHA512 b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
- SSDEEP 768:CNic1iTEpgSG9TJVQBWZrvW5TNDWfKgUkKtzYiguHAMxkEZ2e:mriw+d9bHrkT5gUHz7FxtJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4cfe7ef820ad159971bf6e87a816e11feae81964e3f656a212d84a74c43f4006
- MD5 7b70e6dab95d1383e221bd720217a020
- SHA1 4d248bfe66b232b60235c064bbead86a7f7b19e3
- SHA512 f28ce6f14fec3910892929610e1c66f84546d7b7059b605a584734ff2d0a2393b7a6141aba9d8a39911464406a73ab427c4d143e8ab84923dbf11394dbb0e632
- SSDEEP 768:6UmrpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpa:6gcx1aeg1v9OQZVUKM6+kKp
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512