4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
Size 2.7MB
Sample240613-2pp3tsxdrl
SHA256 4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832
MD5 8c32c636f6be4899b92bb7f7df0154b1
SHA1 b16c9b9a306ba26fc3d59612217848527636d282
SHA512 ffd2fd0832b0e8df4a3cdb5cdf3801e4f8b56a2469b2ef87e82227b31ae2523b01d0174a7d5d2aecb292e0a8c6897b1135b0ddfedbaa1bd85e2ff6a390093e32
SSDEEP 49152:k77wwwwscKD0uDMPlGPgZrhsop5klgYe+l7slAZi1hjNXzZemXsxkXZ:ob4MP8PErdDYe+96AZinzZemZXZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Au_.exe

Executes dropped EXE 4 IoCs

pid	Process
444	Logo1_.exe
4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
4540	Au_.exe
2180	Au_.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Au_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ca-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
File created	C:\Windows\Logo1_.exe	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
4540	Au_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe
444	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4540	Au_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	Au_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	Au_.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3132	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	91
PID 1692 wrote to memory of 3132	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	91
PID 1692 wrote to memory of 3132	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	91
PID 1692 wrote to memory of 444	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	92
PID 1692 wrote to memory of 444	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	92
PID 1692 wrote to memory of 444	1692	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	92
PID 444 wrote to memory of 1060	444	Logo1_.exe	93
PID 444 wrote to memory of 1060	444	Logo1_.exe	93
PID 444 wrote to memory of 1060	444	Logo1_.exe	93
PID 1060 wrote to memory of 3216	1060	net.exe	96
PID 1060 wrote to memory of 3216	1060	net.exe	96
PID 1060 wrote to memory of 3216	1060	net.exe	96
PID 3132 wrote to memory of 4592	3132	cmd.exe	97
PID 3132 wrote to memory of 4592	3132	cmd.exe	97
PID 3132 wrote to memory of 4592	3132	cmd.exe	97
PID 4592 wrote to memory of 4540	4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	100
PID 4592 wrote to memory of 4540	4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	100
PID 4592 wrote to memory of 4540	4592	4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe	100
PID 4540 wrote to memory of 2180	4540	Au_.exe	101
PID 4540 wrote to memory of 2180	4540	Au_.exe	101
PID 4540 wrote to memory of 2180	4540	Au_.exe	101
PID 444 wrote to memory of 3436	444	Logo1_.exe	56
PID 444 wrote to memory of 3436	444	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
  "C:\Users\Admin\AppData\Local\Temp\4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0EC.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe
      "C:\Users\Admin\AppData\Local\Temp\4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\wps\~e57d2f0\Au_.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wps\~e57d2f0\Au_.exe" /from="cmd.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\wps\~e57d2f0\Au_.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wps\~e57d2f0\Au_.exe" -downpower /from=cmd.exe -msgwndname=uninstallsend_message_E57D419
        6⤵
        Executes dropped EXE
        
        PID:2180
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 242f6ebe3bbac27367298cd98621bfc326be49b68fee9ae21cd339689b7368ce
MD5 36041519366ab508f645352d7c4095ad
SHA1 a33cbfd3a554a2b216a820e55cad52177c6bbd34
SHA512 054d1c1835ab5f54ce1054cdd98d37aecf215e0f3086b3912a988c399b0c874b316f768cc90c6cd95799b9566f657bdce292c90633dc849598a18230411db0fb
SSDEEP 6144:xVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:n7+AitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 b734e9f81415f84813857b8762c2bbfda2b3b6302dabfa88ba4ddb15170ba56f
MD5 1549a4bdc2c50ebbbb0eedaa6327ea86
SHA1 6c8292ad1c29485e176caa26612cadb01b818412
SHA512 18dd4178e70380192a07caf3579814b11f7e57d886186c6f4813bb98f90076ac3b17a766975a62aa3ece78966d38c9f66eb2e8c7c97a3ee67a9bfb4515d6ff6d
SSDEEP 6144:LWVfjmNCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BE:k7+57a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
MD5 2500f702e2b9632127c14e4eaae5d424
SHA1 8726fef12958265214eeb58001c995629834b13a
SHA512 f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
SSDEEP 12288:Pp7+H5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:R7u5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$aD0EC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aD0EC.bat
Size 722B
SHA256 60a1f22381d70b2e5395f8882a2e9622bee5b0ee56345fae759ff25e2eb91ad4
MD5 1f4e81bd647b694b8cac7e13000c7e88
SHA1 bea7af19bb5fde22dcb6bda7b5523dedc827879d
SHA512 e80538f9232064e91702f22b9eb9d6c43bcdc38e43d6ade5baf64d36d5ad90a34c2d12e3dcccfa3a77a7aa151d3017d6b34e4d4b08e00a40c25f705da64c242c
MD5 SHA1 SHA512

Submit Download

4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4d6b9c17d52ea3f41f35feaea2d38598331f18b90df57b322dcb4bf936f9a832.exe.exe
Size 2.7MB
SHA256 6fa0932639ef8309b4ede207a07e0fe210d95aeae3811af9dbbe74438ac3a69d
MD5 769d813bd1264fc935208c435d01dab8
SHA1 39b248ceb68f99da75f732b28fbc301b30da1f2a
SHA512 1d6c756e76b14fdecc75bff3100c34e3753269e70538739d935ab906506be7a5dfe800f682bad6f33137e52ce0357aecd4c0d3f5e4c5afdf675988a878868687
SSDEEP 49152:CwwwwscKD0uDMPlGPgZrhsop5klgYe+l7slAZi1hjNXzZemXsxkXZ:0b4MP8PErdDYe+96AZinzZemZXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cgpb_bg.png

Path C:\Users\Admin\AppData\Local\Temp\wps\~e57d4e4\uninstall_res\cgpb_bg.png
Size 1016B
SHA256 f76ec3175357ab52752a09a344278f167ac672da8aa0dad179ef4a8ee9038db9
MD5 315125d6cb7705306ace3dd71ce50e8e
SHA1 67f4e13ee507ccfa2df855bcf5ebbcdb0aff5d7f
SHA512 b37eb1d4274eddd8a11854f5cf02f72dad45fa71bc7ca8091ed4f44e423bbb2d023e2f68cc0d6cba1dcacc4e9e34fb280b0147218ec019fff31ebf447e91a259
MD5 SHA1 SHA512

Submit Download

cgpb_fg.png

Path C:\Users\Admin\AppData\Local\Temp\wps\~e57d4e4\uninstall_res\cgpb_fg.png
Size 984B
SHA256 28e85a601be919c96086c0ca2e056acd8184ec6f3cb1e35b2b15179b20e9d501
MD5 364888aa1329fb55f8377c34bc5b29d3
SHA1 6550c415a349c4df242aa219045cc184ba8d65ab
SHA512 8375b365f4e84c6b765213611dcc18eaca2f2a9e75a7d4e187fae3d0d2152d0323bf2922fb9a1ad4f8fcaad2a6d57e8345ce0828762b553fb6473468d08bb445
MD5 SHA1 SHA512

Submit Download

tempuninstall.ini

Path C:\Users\Admin\AppData\Local\tempuninstall.ini
Size 317B
SHA256 859f1c7a7143c049084f7033a6da8bc94d519ec439d668520654f0a4073ed910
MD5 db40ec764b2e435da14c92b72308ed6e
SHA1 7e95a22b15d20f736d7298bf545e0a73b08e6633
SHA512 4ec66c8febce5574dadeaddadec76256a3dd26f9e9dfca40fb57f8fada1e53e05ad2aa8ed743ff6704a5ec2b5cc4238636ee8241f3e04cdbf99a092b09a0ef91
MD5 SHA1 SHA512

Submit Download

wpsuninstall.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpsuninstall.log
Size 17KB
SHA256 edd0b5c5cc5eb72a0fba6f3c2f31ba12bae90c0d2c78c8faccbb51b3c717f216
MD5 f74e73e9d1374cb6c2fe703a7bcabe74
SHA1 fce5b1b2ce101d384e4c5e4c28c5e3f3398caab1
SHA512 cf9c94f3247f3c46bd8ccd6ab69be21df769bc3b48d3cc763706445c5bec5ba3cb67460a72db242bb3930daebc3472850d019e1826547149c58a5a271e8da38e
SSDEEP 384:dksfEmJJ8KTRIubmUwuk8Qx1ASF8Al5Lwx8T/IFAd0uKBpvbECk8L72kreftI64v:ymJJ8KTRIubmUwuk8Qx1ASF8Al5L88TQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpsuninstall.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpsuninstall.log
Size 1KB
SHA256 21532b3f5c70192dd220ba047291884670ee0b18dc1c7e35dfd31f6e64d87272
MD5 093545202edd750f3c1a5340a2918aba
SHA1 f7f2b740f00e4b9c61d5840555ab5d474a0a2e83
SHA512 80d34eddffcb5056b20090fa905cc4406b74ff4691d7ff970f4c281e9f5396cf203038186ae1717040d5a485e9fbcba9bc8ede2c9b03fbaeef0dac42848529e1
MD5 SHA1 SHA512

Submit Download

wpsuninstall.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpsuninstall.log
Size 1KB
SHA256 c3313f3fab210248e23c1365bec79a72200b05f2bcf93f80b3764377c18ed7e4
MD5 bad2a5346e9a14998aa494725bbb7ba3
SHA1 636a1e32d44b5af2f7febfa432d416b686544784
SHA512 0e4e0aaaa674b9ea4abd3514d8a0621ac83df2c9933d8c11da7fdccd9a9d294f0ca8b5d43287dbd1e2fb713f2882faa3bd0f08b9b62b8b0d6a82ef4f0378177e
MD5 SHA1 SHA512

Submit Download

wpsuninstall.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpsuninstall.log
Size 1KB
SHA256 13bc5756da9122ca48a3864bfd644f892f1f503d913fd3ebfaa6bb57aadb2922
MD5 056ae890411f4fb52a8ec6e07729138d
SHA1 6448c47ecdbbf4bfa0173c5fe64665f926f22e74
SHA512 fbb08e4a57b209201a51bb4f37f1cdbb62d87ef40789fbe293b4f7fb2224cf7ac2dda9efcfa8f2b8f3cffc76581d3ce41524e9874235b40319cbce6f980bab29
MD5 SHA1 SHA512

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 8aadbbf032420ba38402e5c280b0b2aaeadd1a38d6d4539c9ac6222de98a6553
MD5 111cf05043f7e2167709e32cf4cbb9f6
SHA1 08e30a56078bb7f9b09709212848397e325458a4
SHA512 7fca5fefb9a074177057dd4704fa28057ccc68e517795e2acc099cb7ea7cf96c4ae89cc306cae3ea0cc00bd0258c1e0952e550468a608014b225576c038a9c84
SSDEEP 768:Lk1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:LufgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/444-186-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-193-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-200-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-203-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-1403-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-5041-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/444-5486-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download