c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe
Size 70KB
Sample241110-bt2djsyreq
SHA256 c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f
MD5 f6e5ade7a167641225e8148e6343b6f1
SHA1 4bf5e056f4f4788410e30c10f75ee6dc662d8f7a
SHA512 9a072f7ca0392deb31a5f46bd32bdf2eb47c3483d1a48a21bee047f6a77f36f5ad43c9b54de96e633bf073acd7bd396c01d8203d5601213290791f7a8313f822
SSDEEP 1536:pa3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pakuJVLtlZQKbgZi1St7xQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1052	Logo1_.exe
2716	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe
File created	C:\Windows\Logo1_.exe	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe
1052	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1004	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	83
PID 4052 wrote to memory of 1004	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	83
PID 4052 wrote to memory of 1004	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	83
PID 4052 wrote to memory of 1052	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	84
PID 4052 wrote to memory of 1052	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	84
PID 4052 wrote to memory of 1052	4052	c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe	84
PID 1052 wrote to memory of 116	1052	Logo1_.exe	85
PID 1052 wrote to memory of 116	1052	Logo1_.exe	85
PID 1052 wrote to memory of 116	1052	Logo1_.exe	85
PID 116 wrote to memory of 2188	116	net.exe	88
PID 116 wrote to memory of 2188	116	net.exe	88
PID 116 wrote to memory of 2188	116	net.exe	88
PID 1004 wrote to memory of 2716	1004	cmd.exe	89
PID 1004 wrote to memory of 2716	1004	cmd.exe	89
PID 1052 wrote to memory of 3488	1052	Logo1_.exe	56
PID 1052 wrote to memory of 3488	1052	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe
  "C:\Users\Admin\AppData\Local\Temp\c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AFA.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe
      "C:\Users\Admin\AppData\Local\Temp\c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe"
      4⤵
      Executes dropped EXE
      PID:2716
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
Size 247KB
SHA256 e2813a7fb0a036eb9b0861b1687ba73d8380ecb2b9cbe0eededd4edfd8ad7f49
MD5 fdc95026717686b36d356c9053eb1019
SHA1 3d301424838bbc55d88ba9dbcb6a65612ff54b9b
SHA512 9890073e956436de9dd5c09c7b36a718f7a746655ed4fb7eceb7390b500888475f4b64c29d26eeda62240be5c8efc6a1735c4322d6d9cde9bb60315d64bf4fff
SSDEEP 6144:huJWqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:qml5a6EdkQgUmR7G9QK3wJx+qSfF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 573KB
SHA256 88feb2e0a2ad7d177db262c8f49044c863d002355af8242a412ac69cbee1dbf2
MD5 edaa33ebb9b8a64e18538a0c6e98e8d9
SHA1 4d264bee24780297cb2a5ee8938025a18b7ea628
SHA512 6d9e47186ee4f87ae3043e7247b61e94d0c1278cff38544d966696d49e5601f0af8452a31e1bf06c7f62887833f4230533fa036bdbfaa32533b4d58b8148cfd9
SSDEEP 6144:5uJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:/7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 639KB
SHA256 848e14757895f1da1da61c8bb06127caaeb36eb3361768b3baf1a7974ad16716
MD5 c6d6354b442f8417dc66b1723a800f2f
SHA1 94525ba06431ca98c5b8b58c60b24ac8811b1748
SHA512 49b347afad74e96aeedddaaf3bbf7cb261c5590b4991af35f3fcd5fe2a22954266e5dc84b100590731da608ba49aa04fd5f22c7997d20ca5999cc63103180a5f
SSDEEP 12288:wh5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:q5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a8AFA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8AFA.bat
Size 722B
SHA256 67df4cd5fa819a151cdf2bcc2d2d7dc65e62bc078b5fa397bbd137f37456e9d1
MD5 21665559951bf04311becb3b8254cae2
SHA1 ed7d484330ec2b3833fae0fc9fb3e6111c9bcdfe
SHA512 3e0c3fcef16f84eee550cd76e50944edaf0cb78d4e0e147f847629c33fdcda0f1045731b147f30cede68d5bd9c7ba0be8cb18e50e5aa97f8993ac06f20c529ff
MD5 SHA1 SHA512

Submit Download

c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c419b86ece27949cf04ddb47304d9e9bbc2958af1ef156b3d65802c79d0bf25f.exe.exe
Size 41KB
SHA256 cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
MD5 977e405c109268909fd24a94cc23d4f0
SHA1 af5d032c2b6caa2164cf298e95b09060665c4188
SHA512 12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
SSDEEP 768:w3V/q1Boa9cUlxLcbdVOm4KbwFIKZi1dstYiI09/yOPxWETQN:SEToa9D4ZQKbgZi1dst7x9PxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 29KB
SHA256 90eeb4757d0a09477070cec4c254a25533cefa01cf22c772e116f7b6e99ca56c
MD5 8d79bd6a4273fffe7138b06625504e00
SHA1 e9e9a9cf8e835cd533e51606f6d99ecb47d990fc
SHA512 9aa90c89fed48fbc97594fb788ef82dbb3d722a7f536e0cf063729acef01440d8e9531d35851622cdcd8b59e0a8798833eda6f8de2b018109997b1baec577c33
SSDEEP 384:NbbtS1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pBS16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\_desktop.ini
Size 10B
SHA256 a48a9bee0ea1d148d80a848e506f13606a80f84e7f4fa4a3ceeb0f47eab1bf40
MD5 2a3fd5c71388ca70bcd12900f65d5a77
SHA1 7619579d21480b9a4800bc830dbf20354e50b979
SHA512 0e803903a477f9761178c6892c45f3522f9af5b6ef550f446c0dea329dcbe2753760a17086397ff4f9c66ec93a3dbbd1e7b6aaaa71f77c70c9c8de81429c3aa0
MD5 SHA1 SHA512

Submit Download

memory/1052-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-774-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-1233-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-4784-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1052-5257-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4052-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4052-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download