Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe
- Size 723KB
- Sample240603-sxesdsca84
- SHA256 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589
- MD5 c756a642492e79c54620883910b891cd
- SHA1 c9a49f83cae2696e90edd40b901fd6a6a1226375
- SHA512 b096c625130bfdc9606d3f29e54b893a772138fc6049b14a1b540bfb7de278d500f1c518d47191c960c552524522b9a5168e62ebaefb490568257f370b37e332
- SSDEEP 12288:N+a7fC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:NBrLOS2opPIXV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 3060 Logo1_.exe 4252 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe 3060 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 728 wrote to memory of 3796 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 81 PID 728 wrote to memory of 3796 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 81 PID 728 wrote to memory of 3796 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 81 PID 3796 wrote to memory of 1008 3796 net.exe 83 PID 3796 wrote to memory of 1008 3796 net.exe 83 PID 3796 wrote to memory of 1008 3796 net.exe 83 PID 728 wrote to memory of 1048 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 87 PID 728 wrote to memory of 1048 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 87 PID 728 wrote to memory of 1048 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 87 PID 728 wrote to memory of 3060 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 89 PID 728 wrote to memory of 3060 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 89 PID 728 wrote to memory of 3060 728 dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe 89 PID 3060 wrote to memory of 4448 3060 Logo1_.exe 90 PID 3060 wrote to memory of 4448 3060 Logo1_.exe 90 PID 3060 wrote to memory of 4448 3060 Logo1_.exe 90 PID 4448 wrote to memory of 1492 4448 net.exe 92 PID 4448 wrote to memory of 1492 4448 net.exe 92 PID 4448 wrote to memory of 1492 4448 net.exe 92 PID 1048 wrote to memory of 4252 1048 cmd.exe 93 PID 1048 wrote to memory of 4252 1048 cmd.exe 93 PID 3060 wrote to memory of 1476 3060 Logo1_.exe 94 PID 3060 wrote to memory of 1476 3060 Logo1_.exe 94 PID 3060 wrote to memory of 1476 3060 Logo1_.exe 94 PID 1476 wrote to memory of 2104 1476 net.exe 96 PID 1476 wrote to memory of 2104 1476 net.exe 96 PID 1476 wrote to memory of 2104 1476 net.exe 96 PID 3060 wrote to memory of 3532 3060 Logo1_.exe 56 PID 3060 wrote to memory of 3532 3060 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe"C:\Users\Admin\AppData\Local\Temp\dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3808.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe"C:\Users\Admin\AppData\Local\Temp\dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe"4⤵
- Executes dropped EXE
PID:4252
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1492
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2104
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 264KB
- SHA256 9da3db4094a033f920f9aad3266e823e9d592ad78acac24dd0e358ebb059ec3b
- MD5 c0ad9453492036edf7c366cdfd9970e4
- SHA1 b43b223cad6f8c349b5138a0d2ccc439d435b303
- SHA512 776b87da0cab39e6ee8daade00f9ce91a6d46bfc097aec78c46460ba0e8644ae71b43d1b458167966bdee97312b6d3ab4be71b55da4f9a5181e9bd1255483b26
- SSDEEP 6144:S+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:S+aYitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 583KB
- SHA256 9f9434143eb8b7666b0d0c8c88cc350c0c03ba8ae0ba25e611056fcd5a955c19
- MD5 cadbc1b25e26e7b616fcc198937dd36f
- SHA1 ff565fb87f0e0ce560bcc77c59b2b5ce14b18328
- SHA512 37fa017e93645b5a28e105dee37e3b9cb850689a2627509ce26b0f34545c684767875f38d90d6e905f05a9a11d05840f4f0a8f866b5a5565750c79b9dd2dd774
- SSDEEP 6144:N+aezDE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:N+aB7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 649KB
- SHA256 834cd914a6bc7c3eadf3b23bacc01433aa6a32411ab547d958604a1c434518b7
- MD5 1ad09ab121869e9bedf81b1e82331d05
- SHA1 21270e52207071b7d304acb7d776c9abba38c15c
- SHA512 4b1f28d726ec031fd0350a21ea7091087ae2688818716f7add7524fdf06a07d5937a4aa53c6029d2fab093714b1b48b8032927b56e2c207158946f6c71e6646b
- SSDEEP 12288:ml+aP5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:iBP5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a3808.bat
- Size 722B
- SHA256 72def09fe3689da83b4f1e2df8a4fb45e6131352b462567d270e783f2e6758ee
- MD5 da91b753bc5de0ead8e2cdef97551f52
- SHA1 5fee16a2a097aa2c7c3d85f6810a243b800302a4
- SHA512 50b09e5926767d96279da439107bc464544c5b75793a646fc5daad26e99236c5a15b57411d7850d67f8fb26b4324bd54d0f0e0071411689aea5389bab211f744
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd8c016c9592837494f207453582da377e55b50705c427a11463b4d8e75c2589.exe.exe
- Size 684KB
- SHA256 b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
- MD5 50f289df0c19484e970849aac4e6f977
- SHA1 3dc77c8830836ab844975eb002149b66da2e10be
- SHA512 877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
- SSDEEP 12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3LOS2opPIXV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 39KB
- SHA256 28612d2c64ed84d1ec223c74aac02dffb75840364574930c5bbc4eea629be22b
- MD5 e6c7bf55188d71231750f9b606026ff0
- SHA1 ec05472357b89ab9905ba7f079c275d4a6b86edf
- SHA512 d812d93c3fe8417bf98a1685b31e6c146471e0c4a37b9340ba0a57763852221be002375e109efff0bb01192c3f8180e6bda68d6f6ed927b45cb02f2b1998baa6
- SSDEEP 768:HoO5RroZJ76739AzUJQ+OYkLl2b3+DTQb9OGImt0o:Hoe+Zk7qzUJBeLkbiT29dX
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512