4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce

Analysis

max time kernel
37s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
Size 577KB
Sample240609-xdf9bsdf4z
SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
MD5 11ad98d96a68eab26bb4077d6fe66965
SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2016	Logo1_.exe
4580	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\swidtag\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe
2016	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2672	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	81
PID 1680 wrote to memory of 2672	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	81
PID 1680 wrote to memory of 2672	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	81
PID 2672 wrote to memory of 4500	2672	net.exe	83
PID 2672 wrote to memory of 4500	2672	net.exe	83
PID 2672 wrote to memory of 4500	2672	net.exe	83
PID 1680 wrote to memory of 3480	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	84
PID 1680 wrote to memory of 3480	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	84
PID 1680 wrote to memory of 3480	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	84
PID 1680 wrote to memory of 2016	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	86
PID 1680 wrote to memory of 2016	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	86
PID 1680 wrote to memory of 2016	1680	4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe	86
PID 2016 wrote to memory of 4516	2016	Logo1_.exe	87
PID 2016 wrote to memory of 4516	2016	Logo1_.exe	87
PID 2016 wrote to memory of 4516	2016	Logo1_.exe	87
PID 3480 wrote to memory of 4580	3480	cmd.exe	89
PID 3480 wrote to memory of 4580	3480	cmd.exe	89
PID 4516 wrote to memory of 2832	4516	net.exe	90
PID 4516 wrote to memory of 2832	4516	net.exe	90
PID 4516 wrote to memory of 2832	4516	net.exe	90
PID 2016 wrote to memory of 3476	2016	Logo1_.exe	91
PID 2016 wrote to memory of 3476	2016	Logo1_.exe	91
PID 2016 wrote to memory of 3476	2016	Logo1_.exe	91
PID 3476 wrote to memory of 3288	3476	net.exe	93
PID 3476 wrote to memory of 3288	3476	net.exe	93
PID 3476 wrote to memory of 3288	3476	net.exe	93
PID 2016 wrote to memory of 3556	2016	Logo1_.exe	56
PID 2016 wrote to memory of 3556	2016	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3556
- C:\Users\Admin\AppData\Local\Temp\4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
  "C:\Users\Admin\AppData\Local\Temp\4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F3B.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe
      "C:\Users\Admin\AppData\Local\Temp\4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe"
      4⤵
      Executes dropped EXE
      PID:4580
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2832
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
MD5 256b0680af798047a835349001fd7c41
SHA1 4e43e0268f7f67c341189b7a1ce6c2baa063cb19
SHA512 9564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
SSDEEP 6144:o46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:o3WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
MD5 11ad98d96a68eab26bb4077d6fe66965
SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a3F3B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3F3B.bat
Size 722B
SHA256 50d3da95986d9ce042ef6b5dce6c96e5f69b921135153e820a8e48ca1a347f5f
MD5 4e29dca27744b5315712801e822d2d49
SHA1 9bffb5a687a00c32482b116dcf09ea270296851e
SHA512 0d5d944f50dd8b79cb4e03606cfb854617780058cab39f309cbf17fab7f02846ea40fa6c14f69a49264d1a98c2f9a974c115777201a44cb0dabef922ed5ffd83
MD5 SHA1 SHA512

Submit Download

4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce.exe.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
MD5 0fbf02d223445d573f072dd264ff499c
SHA1 a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
SHA512 4708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JUaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini
Size 8B
SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
SHA1 25918532222a7063195beeb76980b6ec9e59e19a
SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
MD5 SHA1 SHA512

Submit Download

memory/1680-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1680-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-19-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-4105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-8659-0x0000000000400000-0x000000000043E000-memory.dmp

Download