Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
- Target dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe
- Size 717KB
- Sample240609-w8ylesde5z
- SHA256 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab
- MD5 d01c2da0c2067321bcb70257357693ea
- SHA1 0ba796e9e1a3777084886116e6398df08c96a0e5
- SHA512 632bd2d999d29f237d1ba93aa6dce26f19011d490737a5ae16e9b2edfdd0e60fc53f63da125fa111921127af453cfaefdc1c8878b05418d139b1694a39e19e2c
- SSDEEP 12288:e3WFjJfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:e3M9LOS2opPIXV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 1220 Logo1_.exe 2492 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Offline\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe File created C:\Windows\Logo1_.exe dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe 1220 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4760 wrote to memory of 2896 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 81 PID 4760 wrote to memory of 2896 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 81 PID 4760 wrote to memory of 2896 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 81 PID 2896 wrote to memory of 4408 2896 net.exe 83 PID 2896 wrote to memory of 4408 2896 net.exe 83 PID 2896 wrote to memory of 4408 2896 net.exe 83 PID 4760 wrote to memory of 264 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 84 PID 4760 wrote to memory of 264 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 84 PID 4760 wrote to memory of 264 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 84 PID 4760 wrote to memory of 1220 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 86 PID 4760 wrote to memory of 1220 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 86 PID 4760 wrote to memory of 1220 4760 dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe 86 PID 1220 wrote to memory of 2812 1220 Logo1_.exe 87 PID 1220 wrote to memory of 2812 1220 Logo1_.exe 87 PID 1220 wrote to memory of 2812 1220 Logo1_.exe 87 PID 2812 wrote to memory of 5056 2812 net.exe 89 PID 2812 wrote to memory of 5056 2812 net.exe 89 PID 2812 wrote to memory of 5056 2812 net.exe 89 PID 264 wrote to memory of 2492 264 cmd.exe 90 PID 264 wrote to memory of 2492 264 cmd.exe 90 PID 1220 wrote to memory of 3528 1220 Logo1_.exe 91 PID 1220 wrote to memory of 3528 1220 Logo1_.exe 91 PID 1220 wrote to memory of 3528 1220 Logo1_.exe 91 PID 3528 wrote to memory of 3592 3528 net.exe 93 PID 3528 wrote to memory of 3592 3528 net.exe 93 PID 3528 wrote to memory of 3592 3528 net.exe 93 PID 1220 wrote to memory of 3552 1220 Logo1_.exe 56 PID 1220 wrote to memory of 3552 1220 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe"C:\Users\Admin\AppData\Local\Temp\dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5573.bat3⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe"C:\Users\Admin\AppData\Local\Temp\dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe"4⤵
- Executes dropped EXE
PID:2492
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5056
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3592
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 258KB
- SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
- MD5 256b0680af798047a835349001fd7c41
- SHA1 4e43e0268f7f67c341189b7a1ce6c2baa063cb19
- SHA512 9564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
- SSDEEP 6144:o46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:o3WFj2itXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
- MD5 11ad98d96a68eab26bb4077d6fe66965
- SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
- SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
- SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 644KB
- SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
- MD5 0eec0543603f7a8ce8e8f5fee478e1d2
- SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
- SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
- SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a5573.bat
- Size 722B
- SHA256 fe4184827e99990005e4c9b6871410d66a8abe771feabd276ac80a31597b500a
- MD5 6dd8a95a10e0e78c5951603ac8b1f097
- SHA1 df4027575753d35596b8c6a70928f7eb6db18dce
- SHA512 dd7783d8dd593d75f06e0d70d35cbc38f54026067c9c400f0043f7b0a53443a18475f716cf5fec721ca22d69daa19ede0d8530e3020b47c004766cb3d369589e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dcb18052ff3f86e1929a724781334d85f628c3475d3d5da2c2d1d3ba1fcb84ab.exe.exe
- Size 684KB
- SHA256 b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
- MD5 50f289df0c19484e970849aac4e6f977
- SHA1 3dc77c8830836ab844975eb002149b66da2e10be
- SHA512 877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
- SSDEEP 12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3LOS2opPIXV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
- MD5 0fbf02d223445d573f072dd264ff499c
- SHA1 a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
- SHA512 4708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
- SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JUaYzMXqtGN/CstC9qVF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-3571316656-3665257725-2415531812-1000\_desktop.ini
- Size 8B
- SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
- MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
- SHA1 25918532222a7063195beeb76980b6ec9e59e19a
- SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
- MD5 SHA1 SHA512