Malware Analysis Report

2025-01-22 08:17

Sample ID 241026-etscesxkfk
Target 02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3
SHA256 02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3
Tags
discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3

Threat Level: Shows suspicious behavior

The file 02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Drops startup file

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Loads dropped DLL

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-26 04:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-26 04:14

Reported

2024-10-26 04:16

Platform

win7-20240903-en

Max time kernel

149s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Logo1_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 1880 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 1880 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 1880 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 3028 wrote to memory of 2508 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3028 wrote to memory of 2508 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3028 wrote to memory of 2508 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3028 wrote to memory of 2508 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1880 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 1880 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 1880 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 1880 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2752 wrote to memory of 2892 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2752 wrote to memory of 2892 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2752 wrote to memory of 2892 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2752 wrote to memory of 2892 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2140 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 2140 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 2140 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 2140 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 2152 wrote to memory of 2764 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2764 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2764 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2152 wrote to memory of 2764 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2764 wrote to memory of 2812 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2812 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2812 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2812 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2152 wrote to memory of 1192 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2152 wrote to memory of 1192 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe

"C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA5D1.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe

"C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/1880-0-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aA5D1.bat

MD5 70baaccef6f3017eb3019e4c0d1fc875
SHA1 1c62ea4c06a4bda2ba413f35f160274b763f3bf0
SHA256 e31c6eddd21120e672fa60e519d4c020c67ea39dd73aa16d96619294ef05b1e3
SHA512 c85856f0446bd1642b4bb6fe1657c7d740880a7de3f0511515ba5afd4e23ce5a65bc2ca3dcdcc860a4bb766deaf3eb2455a576f807b7c69df19ef6ab40707261

C:\Windows\Logo1_.exe

MD5 4b59d42c30960693269448e00b2ffca6
SHA1 cd5f11fe1cfa26eef8d7b9e90ae2346b0d8cf562
SHA256 6a1d9701474cb7644e120689be4c71fe45f978be0c2934ff91481124c1f14363
SHA512 07fb18f632389983cc70432e59a247d94325da55f793c04db33d078c1d199628da9ccf45488610b3db25ca8c54f161630c7bb478e0a286babf42e168217a8ca1

memory/2152-19-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1880-18-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1880-17-0x00000000002A0000-0x00000000002DD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe.exe

MD5 f24affc10132405930282aaeb206b7b7
SHA1 462d7a447a7d6f06bf3083c2af2f00b615c6a1a0
SHA256 abcca6f158b94303d92197bf8e6db545fe4929161e3767619176c4574ccb70fc
SHA512 c7729e3a050797b7d2c6ee07cc432c6dca56ffdb6b7e2662b1a70c90e287bbb2480a3752f262a896110f60f9ce18f884452f3cae3a06c80bef5eec476fba8cfe

memory/2836-26-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

memory/2836-27-0x0000000000970000-0x0000000000FE4000-memory.dmp

memory/2836-30-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

memory/2836-136-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

memory/1192-138-0x0000000002580000-0x0000000002581000-memory.dmp

memory/2152-141-0x0000000000400000-0x000000000043D000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\_desktop.ini

MD5 28a582403dbb209b6c5cb7bada9c918d
SHA1 db58560be63032a4cbd738d2d639e5bf764d6277
SHA256 b5a9fa3acde4d9499ea08a6d9ff193fc9cda57f04141f82d2422a4008f451200
SHA512 511b4d3886d671d01c66d2509b784a199e68a00f2597d311d8d0770f0b1030680136ee450343a8d6c4b51d9de8448bafdde44dc1a1c6e62bccde47d5af03fbae

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 2e8f00ea41089a9130bc63da1cfbfd18
SHA1 01cf1c7db88e0a1814a11122257033ce41bd5aef
SHA256 a2da98325e8e526fe19fefa23d1e520f628953ca9f5da53018f3ea0e0c9e40c2
SHA512 0ecf7444fcad6a655771f8ef5b7ad2b08b655ba272d63e5154eb9a8b593fcf7cbd2b9cbf841a8d9688f35632677792308be690b7265ecaec7c19c1425ffce642

memory/2152-3072-0x0000000000400000-0x000000000043D000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 28959031896021bc7ca9f579de2cc456
SHA1 3577f294e56af20384c17c2e6b30043d3fb467ce
SHA256 f033bbb306ff9feebc9f881d7bf293d303af233130e795d86a20b16aad085eec
SHA512 8ccc791701cbf875cff76feb50e78391fdc4375e0bd78c59111a657059e2f4c8c91b8603755bd5cfc1feb1abcc98b3eda6e3f810de8e8d60eb35090eecb21020

C:\Users\Admin\AppData\Local\Temp\redirects\choco.exe

MD5 d90e7a1e7632f8e5cc8cf6edf61a02e5
SHA1 72004beb61176285bff65f9ea36170f8347a706e
SHA256 535689598ec06875df0d5e3a60b37d4a7f25d97904c13c6c22156e5e79f1f395
SHA512 b6b51b01aa204ff7cd6b51b98bad4dcecb78f8b32ba871616039297787764b8f852c16d17da9b0aae28e7c686332c7d818fdf6762d80e915fb80001558cd468a

C:\Users\Admin\AppData\Local\Temp\redirects\chocolatey.exe

MD5 5af52e83386c82a63536f4015eea27fb
SHA1 b160b7d8654282f7231641b2b511ae1dccc15698
SHA256 21ef9ee0595e8ddcd7d69bf79002b1ca04be60277a2e91c8dfb8272dffb327cf
SHA512 52d98979982edaaadcf078632d0cec6da585dc1e6cf9d9e75594e0c98cb99d0d638b496ddc5c4c8abf3d47000758da0a6fe74e51c2ce6634ead820b8971d6e0f

C:\Users\Admin\AppData\Local\Temp\redirects\cver.exe

MD5 d242c8f1f34adc4e2a18d7664b980044
SHA1 e4580cff26ed508f5abdb3f1a67470ba647554ae
SHA256 a61ab0eb1680fead55a37630d822c6d4e25a53437fcf2d4521f52852f5db7ecd
SHA512 bb257601f49c81f9cf3a29776fdbed0bb6b468c12e568a1abeb462e7d467fc5194b56425fa48c7ef242979190ae5bb58bae25971ed7b82df479d6f9378b7012f

C:\Users\Admin\AppData\Local\Temp\redirects\cup.exe

MD5 0ec3809dea6547547acb9104a692921a
SHA1 5edb48b5c045df9ddd8acbdbd5194e5b0b3f62f4
SHA256 0350a99b7c85cd21e22cbc990b4a2db8d27dd24bb100ddfe096000e6a5bc3954
SHA512 2f514dedc832b59a36d7cbab8c65015a426d9ba9fbd4de10a5071fad145241b22d5a81d4fa65c36030fc701e989a97abf310b70fc86eacd47494a9b638035539

C:\Users\Admin\AppData\Local\Temp\redirects\cuninst.exe

MD5 44f5c164b976a1b8dc37b9afceca627b
SHA1 1f94dceb0b05cd9069d929cbecf5054c5775b80e
SHA256 8fd9902a1e1bad8d1a4e9ced5386768dd2f04257d99b73f3e5cc575783ad644a
SHA512 bcf335b85f1216b0f5c22c7f8a65b78ca284312787377360d42f946833e6cc79a23447acfbef06060c88dfcf742b6c52cf5ab5f97f0d509fd0b8cfc979dcf8ed

C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe

MD5 93efaad020ebe4f5994afb9a6e454adb
SHA1 8b85c1d8e32771f12f09ba9e930f5894bed593c4
SHA256 71d7948a42d68eaa2c0f2db15bcfb3ee86f41ee794969c45ea4b63f1e87a9a35
SHA512 cb951054d63a330de2f2fefd0b27cec9a786b224cc18e2d3be0ca0a1d48bc77431043da032e5b61931c3111db5b46e583881f938855d332a73e32645b4c22d48

C:\Users\Admin\AppData\Local\Temp\redirects\cpack.exe

MD5 b39ce207bda2c90673b117760317b3e7
SHA1 182bd9b614d9e5003d219ddbd46727cb57a4e990
SHA256 58c70053203dc94f045fdd8b53fceb60da9bfc32ff56b1c6ed61833994bb1e90
SHA512 25bad2614e71ed99116f554f6ef667dcc95a9d83ed7810132e3b2672bee7f51ee27d50fe0a67c52d26197a85bbe8dad699dbe608e09f032533d303be4feeb405

C:\Users\Admin\AppData\Local\Temp\redirects\clist.exe

MD5 ecc99433f78693bc1f3d00eb9e3ad5a1
SHA1 6ee702765220d805b844b49fea99059a368c4935
SHA256 29b21c4872dd9dacde93a39441959889c6a367a5c84bca598851162e8f998c48
SHA512 c3436592e897d842a0fe5274bcb327483a9b2801d71fb1fe07b8d68a02e684c16db3dffa7d8fcd458087520418888aad74413643cb6cc1ae198a7f7ce15df70d

C:\Users\Admin\AppData\Local\Temp\redirects\cinst.exe

MD5 9c57de2b95339834ff959dbafe8acbfd
SHA1 2bae31eedbfb862eda3e0c051f14bef41efa8974
SHA256 0cc6cd8d875e4955a4c7e5a14a75ed29620910bc90a7ccc68920bd71d32859db
SHA512 5deb6ba906efd1db417db1f165f93b0bd4e968900d084b069fed173d855c51177bce1f83fa6c4e8b2c7205517d6ef508fe3063e22bc200de5ddadf482082d643

C:\Users\Admin\AppData\Local\Temp\tools\shimgen.exe

MD5 16996e59468c0b980e9e71e1dfde5edf
SHA1 a9217ebff1cc074753499184f9b9a5abc97f89f7
SHA256 56833a73e78aac21aa3b88724564a6fc0e4b348014b162865e1f4f82aac1833d
SHA512 f876552307b7c167b6104c3cefe6fe07522e0fd91caacb8014fc4efc2be06399363bdd21a3660c633dc93849d1e453b8c22b45613ec9d7670d7b8aee058b1bd9

C:\Users\Admin\AppData\Local\Temp\tools\checksum.exe

MD5 3f7b9b16fe7c0c3130ddd546c3f82c75
SHA1 d6ac383d6dcabaed425096bdcb94b4e59641f9ec
SHA256 1f865c638c4da788a5d517a0a11727338f58cbe5d57d6b822f5bd06415cb8b9f
SHA512 d2842c34b74a56345c90ab6797d25d793d72b3987022a6e405b62bba15f11653735d521270f1512fd63257281594874e028d3a6adc03ed0632a495b217b0782e

C:\Users\Admin\AppData\Local\Temp\tools\7z.exe

MD5 e21f5dd05257ece5fb64430b77cfa5c9
SHA1 3bac7f4dbc6e5bd4531d0f48aa6fc878311c5608
SHA256 d293bdd8180921bfb31cb8afe91d7339acb3cee4c406df6c56c87f9460932b44
SHA512 82588d57617eff7f8419b8830dd332afe0aaf9b284e6dee1aed05c8c3a79dc73fa031670fb14a0b81ec27cdb59b97d2aa41e3edd05b7f00f8eab0c4a11cbebef

memory/2152-4300-0x0000000000400000-0x000000000043D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-26 04:14

Reported

2024-10-26 04:16

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Defender\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Logo1_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3968 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 3968 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 3968 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\net.exe
PID 4048 wrote to memory of 3048 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4048 wrote to memory of 3048 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4048 wrote to memory of 3048 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3968 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 3968 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 3968 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\SysWOW64\cmd.exe
PID 3968 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 3968 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 3968 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe C:\Windows\Logo1_.exe
PID 1336 wrote to memory of 2312 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1336 wrote to memory of 2312 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1336 wrote to memory of 2312 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1180 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 1180 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe
PID 2312 wrote to memory of 320 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2312 wrote to memory of 320 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2312 wrote to memory of 320 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1336 wrote to memory of 2928 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1336 wrote to memory of 2928 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1336 wrote to memory of 2928 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2928 wrote to memory of 2660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2928 wrote to memory of 2660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2928 wrote to memory of 2660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1336 wrote to memory of 3360 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 1336 wrote to memory of 3360 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe

"C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABFF.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe

"C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

memory/3968-0-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Windows\Logo1_.exe

MD5 4b59d42c30960693269448e00b2ffca6
SHA1 cd5f11fe1cfa26eef8d7b9e90ae2346b0d8cf562
SHA256 6a1d9701474cb7644e120689be4c71fe45f978be0c2934ff91481124c1f14363
SHA512 07fb18f632389983cc70432e59a247d94325da55f793c04db33d078c1d199628da9ccf45488610b3db25ca8c54f161630c7bb478e0a286babf42e168217a8ca1

memory/1336-9-0x0000000000400000-0x000000000043D000-memory.dmp

memory/3968-10-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aABFF.bat

MD5 56b953210101fe2830c8e75b114b344b
SHA1 8e38aee6d71585684c06cdd95acf881b0acc4a9b
SHA256 5ca3d3273f1ceb79f62e64f5d1aa29438556c309de627c1130b4d4ce1007d281
SHA512 38b2170e246e591382495d37683951e78b1df0b0d395dbb0ba0a2a2710e3b997d172c3c130864a0cb921eafd7f31eb05327436c7e0a3630812f446438f2e7be3

C:\Users\Admin\AppData\Local\Temp\02d27dc43e5599144329fecc9ed1220f4d3b675302dcd9998d2fef859f5303e3.exe.exe

MD5 f24affc10132405930282aaeb206b7b7
SHA1 462d7a447a7d6f06bf3083c2af2f00b615c6a1a0
SHA256 abcca6f158b94303d92197bf8e6db545fe4929161e3767619176c4574ccb70fc
SHA512 c7729e3a050797b7d2c6ee07cc432c6dca56ffdb6b7e2662b1a70c90e287bbb2480a3752f262a896110f60f9ce18f884452f3cae3a06c80bef5eec476fba8cfe

memory/2528-15-0x00007FF94B4D3000-0x00007FF94B4D5000-memory.dmp

memory/2528-16-0x0000000000AC0000-0x0000000001134000-memory.dmp

memory/2528-17-0x00007FF94B4D0000-0x00007FF94BF91000-memory.dmp

memory/2528-23-0x000000001BDC0000-0x000000001BE10000-memory.dmp

memory/2528-24-0x000000001BE90000-0x000000001BF06000-memory.dmp

memory/2528-25-0x000000001BBE0000-0x000000001BBFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.2528.update

MD5 78e591860832608ebc49dddd9fc0e1db
SHA1 d927f135f15190f95805dd8bfe6df0de20dfff53
SHA256 ccb5f71ce184e151412a8f04144011ba4da50371c20ef12778d276577f691f9a
SHA512 57f334f57f0aaba4238e7ce834784dece8e81cceae248999f1a45aa8fed0b86fe20f3d6ac6fb3649cf653e9f65f3b35695e203f1d6ed1e54e073df10fe008fc0

memory/2528-130-0x00007FF94B4D0000-0x00007FF94BF91000-memory.dmp

memory/1336-132-0x0000000000400000-0x000000000043D000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\_desktop.ini

MD5 28a582403dbb209b6c5cb7bada9c918d
SHA1 db58560be63032a4cbd738d2d639e5bf764d6277
SHA256 b5a9fa3acde4d9499ea08a6d9ff193fc9cda57f04141f82d2422a4008f451200
SHA512 511b4d3886d671d01c66d2509b784a199e68a00f2597d311d8d0770f0b1030680136ee450343a8d6c4b51d9de8448bafdde44dc1a1c6e62bccde47d5af03fbae

C:\Program Files\FormatRead.exe

MD5 088cfecffaa7ad64f6b0317f3dd70054
SHA1 720fbc36a55c2fbe0ef2610d89093f8ed0bbaf98
SHA256 006ab9587bb2d6a0ef067df8840f9b303d361032f50cec8e8dbb94954bf20025
SHA512 6936f8ca350b1d09c63e422801599fef0da289bb0eb81d0e4d3b5b0397e46f9ec661454e45bd1b641a2a7d00215ff9a290b0f0e6c83b9cd8e5078b07926dee50

memory/1336-2594-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

MD5 25289b652ba570bb7865014294dbafdc
SHA1 3b9853b795419c9d08b3fe88705d7a1b38fd6399
SHA256 211cd6cf08591be8bcf0ea63c6c6cdbcd2439b61062bc9f8dcd4e91250891b9b
SHA512 7465aea7eacf5674305e2e4d8722723e06e1761f48a2fc5ad26a04561589bf6465abfc6696f931407a49e80288a681bc07ca078361b0f5be30e6903168d36082

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 efcce7232eb78a3095a2cedcfcff1d26
SHA1 fcecbd07f20e3500faa209e80cf1c78af3fd10a7
SHA256 c091a8efdac1e393ae2cc2b45686cf63b9ed2ad73d7b334031a13fa340f65429
SHA512 d787335cb0f515a626e16f6d99ce151eccbca0f7888db2405bdc2445e96afff22afe292a06d57b6f8ae6c24ea3c8d114649b23b2cfe7352f921e55e47503fef4

C:\Users\Admin\AppData\Local\Temp\redirects\choco.exe

MD5 10aaf2cebba115d53566b56f9fae1326
SHA1 a52d2e0102ece5cfd4a95fb4bec0f0bb47af1545
SHA256 64f47b2c959d0bfa493e104796ff25b2e9159cae1b4bb8dd12e2a9bddac4c384
SHA512 bb6b913fa1364fb4b6963ba47b251fa9e5f2089a5c215e5d1778562998ff05969ca421512ecda0aed0c6b425d150b9f895808c7561763f04aa30a573b6ec7010

C:\Users\Admin\AppData\Local\Temp\redirects\cinst.exe

MD5 9c57de2b95339834ff959dbafe8acbfd
SHA1 2bae31eedbfb862eda3e0c051f14bef41efa8974
SHA256 0cc6cd8d875e4955a4c7e5a14a75ed29620910bc90a7ccc68920bd71d32859db
SHA512 5deb6ba906efd1db417db1f165f93b0bd4e968900d084b069fed173d855c51177bce1f83fa6c4e8b2c7205517d6ef508fe3063e22bc200de5ddadf482082d643

C:\Users\Admin\AppData\Local\Temp\redirects\cver.exe

MD5 d242c8f1f34adc4e2a18d7664b980044
SHA1 e4580cff26ed508f5abdb3f1a67470ba647554ae
SHA256 a61ab0eb1680fead55a37630d822c6d4e25a53437fcf2d4521f52852f5db7ecd
SHA512 bb257601f49c81f9cf3a29776fdbed0bb6b468c12e568a1abeb462e7d467fc5194b56425fa48c7ef242979190ae5bb58bae25971ed7b82df479d6f9378b7012f

C:\Users\Admin\AppData\Local\Temp\redirects\cup.exe

MD5 0ec3809dea6547547acb9104a692921a
SHA1 5edb48b5c045df9ddd8acbdbd5194e5b0b3f62f4
SHA256 0350a99b7c85cd21e22cbc990b4a2db8d27dd24bb100ddfe096000e6a5bc3954
SHA512 2f514dedc832b59a36d7cbab8c65015a426d9ba9fbd4de10a5071fad145241b22d5a81d4fa65c36030fc701e989a97abf310b70fc86eacd47494a9b638035539

C:\Users\Admin\AppData\Local\Temp\redirects\cuninst.exe

MD5 44f5c164b976a1b8dc37b9afceca627b
SHA1 1f94dceb0b05cd9069d929cbecf5054c5775b80e
SHA256 8fd9902a1e1bad8d1a4e9ced5386768dd2f04257d99b73f3e5cc575783ad644a
SHA512 bcf335b85f1216b0f5c22c7f8a65b78ca284312787377360d42f946833e6cc79a23447acfbef06060c88dfcf742b6c52cf5ab5f97f0d509fd0b8cfc979dcf8ed

C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe

MD5 93efaad020ebe4f5994afb9a6e454adb
SHA1 8b85c1d8e32771f12f09ba9e930f5894bed593c4
SHA256 71d7948a42d68eaa2c0f2db15bcfb3ee86f41ee794969c45ea4b63f1e87a9a35
SHA512 cb951054d63a330de2f2fefd0b27cec9a786b224cc18e2d3be0ca0a1d48bc77431043da032e5b61931c3111db5b46e583881f938855d332a73e32645b4c22d48

C:\Users\Admin\AppData\Local\Temp\redirects\cpack.exe

MD5 b39ce207bda2c90673b117760317b3e7
SHA1 182bd9b614d9e5003d219ddbd46727cb57a4e990
SHA256 58c70053203dc94f045fdd8b53fceb60da9bfc32ff56b1c6ed61833994bb1e90
SHA512 25bad2614e71ed99116f554f6ef667dcc95a9d83ed7810132e3b2672bee7f51ee27d50fe0a67c52d26197a85bbe8dad699dbe608e09f032533d303be4feeb405

C:\Users\Admin\AppData\Local\Temp\redirects\clist.exe

MD5 ecc99433f78693bc1f3d00eb9e3ad5a1
SHA1 6ee702765220d805b844b49fea99059a368c4935
SHA256 29b21c4872dd9dacde93a39441959889c6a367a5c84bca598851162e8f998c48
SHA512 c3436592e897d842a0fe5274bcb327483a9b2801d71fb1fe07b8d68a02e684c16db3dffa7d8fcd458087520418888aad74413643cb6cc1ae198a7f7ce15df70d

C:\Users\Admin\AppData\Local\Temp\tools\shimgen.exe

MD5 16996e59468c0b980e9e71e1dfde5edf
SHA1 a9217ebff1cc074753499184f9b9a5abc97f89f7
SHA256 56833a73e78aac21aa3b88724564a6fc0e4b348014b162865e1f4f82aac1833d
SHA512 f876552307b7c167b6104c3cefe6fe07522e0fd91caacb8014fc4efc2be06399363bdd21a3660c633dc93849d1e453b8c22b45613ec9d7670d7b8aee058b1bd9

C:\Users\Admin\AppData\Local\Temp\tools\checksum.exe

MD5 3f7b9b16fe7c0c3130ddd546c3f82c75
SHA1 d6ac383d6dcabaed425096bdcb94b4e59641f9ec
SHA256 1f865c638c4da788a5d517a0a11727338f58cbe5d57d6b822f5bd06415cb8b9f
SHA512 d2842c34b74a56345c90ab6797d25d793d72b3987022a6e405b62bba15f11653735d521270f1512fd63257281594874e028d3a6adc03ed0632a495b217b0782e

C:\Users\Admin\AppData\Local\Temp\tools\7z.exe

MD5 e21f5dd05257ece5fb64430b77cfa5c9
SHA1 3bac7f4dbc6e5bd4531d0f48aa6fc878311c5608
SHA256 d293bdd8180921bfb31cb8afe91d7339acb3cee4c406df6c56c87f9460932b44
SHA512 82588d57617eff7f8419b8830dd332afe0aaf9b284e6dee1aed05c8c3a79dc73fa031670fb14a0b81ec27cdb59b97d2aa41e3edd05b7f00f8eab0c4a11cbebef

C:\Users\Admin\AppData\Local\Temp\redirects\chocolatey.exe

MD5 5af52e83386c82a63536f4015eea27fb
SHA1 b160b7d8654282f7231641b2b511ae1dccc15698
SHA256 21ef9ee0595e8ddcd7d69bf79002b1ca04be60277a2e91c8dfb8272dffb327cf
SHA512 52d98979982edaaadcf078632d0cec6da585dc1e6cf9d9e75594e0c98cb99d0d638b496ddc5c4c8abf3d47000758da0a6fe74e51c2ce6634ead820b8971d6e0f

memory/1336-9009-0x0000000000400000-0x000000000043D000-memory.dmp