2900cf477dcfe19cef54059c99a63097875ffce8c587f8ef5cb5e14e716a3c81

Analysis

user interaction
yes
max time kernel
8s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.exe
Size 8.3MB
Sample260815-3pr3vsac42
SHA256 2900cf477dcfe19cef54059c99a63097875ffce8c587f8ef5cb5e14e716a3c81
MD5 728224b43bd7771e47a9481b0ea3a0b2
SHA1 5d2466e3312902916bab9195c6e40ba7cab442de
SHA512 d6d92e49f147c1334f05ac132c5aed041125d54f0d76d098bc55fa34e5c219023c1d3557981d0ba23c0b666e9b020488c78c22b0c10250e35078cb82505d6621
SSDEEP 196608:co3d5tbW897GXPHMe81SF2RPUewytKZ2/HsMRq+bRgFtDU:cyd51wPsZg2Ke3K4/HsMRq+bYtw
TLSH
T1529633DB72A009BAD86A553B29715F52F361BCF10760C88BDB93631E2E772E528F5310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 7 IoCs

pid	Process
3652	run.exe
3652	run.exe
3652	run.exe
3652	run.exe
3652	run.exe
3652	run.exe
3652	run.exe

Modifies system executable filetype association 2 TTPs 34 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe
968	cmd.exe
1932	cmd.exe
1972	cmd.exe
4604	cmd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0306-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Dependents	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A64-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\Conversion	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0267-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivatableClassId\App	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14701cc0-b2ac-5a27-9b2e-c89b4413f743}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2775015d-836f-4da7-bdf5-dc8ce20bd87f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000498C4-0000-0000-C000-000000000046}\TreatAs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0156-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020975-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65235197-874B-4A07-BDC5-E65EA825B718}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0103-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4C18D40-1CD5-101C-B325-00AA001F3168}\DataFormats\GetSet\4	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\shell\Open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208B1-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rwl\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0304-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063048-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0109-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0186-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024450-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244C4-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{796AE40B-6CDA-4F05-A663-D282A93AC7D4}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ContentDirectory.item.videoItem\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244C1-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0216-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0356-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|AddInViews\|Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020933-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19FED08E-EFD1-45da-B524-7BE4774A6AEE}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IMContact.IMContactRecognizer\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020898-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020914-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03E6-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.api\AcroExch.Plugin	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4C18D40-1CD5-101C-B325-00AA001F3168}\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\Protocol\StdFileEditing\SetDataFormats	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002086B-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0445D478-5EE9-48D7-8030-8752A217D1DB}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlh	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5512D114-5CC6-11CF-8D67-00AA00BDCE1D}\Implemented Categories	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{305104BC-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.oqy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BD21D60-EC42-11CE-9E0D-00AA006002F3}\Version	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0372-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0173-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{787A2D6B-EF66-488D-A303-513C9C75C344}\ToolboxBitmap32	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3212	reg.exe
4272	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3652	3512	run.exe	90
PID 3652 wrote to memory of 248	3652	run.exe	91
PID 248 wrote to memory of 4620	248	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\run.exe
"C:\Users\Admin\AppData\Local\Temp\run.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\run.exe
  "C:\Users\Admin\AppData\Local\Temp\run.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCR /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:4620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCU /f"
    3⤵
    - Executes a command shell one-liner
    PID:968
  - - C:\Windows\system32\reg.exe
      reg delete HKCU /f
      4⤵
      Modifies registry key
      PID:3212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKLM /f"
    3⤵
    - Executes a command shell one-liner
    PID:1932
  - - C:\Windows\system32\reg.exe
      reg delete HKLM /f
      4⤵
      Modifies registry key
      PID:4272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKU /f"
    3⤵
    - Executes a command shell one-liner
    PID:1972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCC /f"
    3⤵
    - Executes a command shell one-liner
    PID:4604

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4136
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5756

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2520
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2928

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1952
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4524

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4324
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4348

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5688
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3036

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2948
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1036

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:760
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1928

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:788
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4788

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:4280

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3244
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5236

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3316
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5728

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4112
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3756

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1736
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:824

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4164
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4260

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1764
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4768

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3012
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3124

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3840
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:204

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2072
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2752

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5596
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2288

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6088
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5652

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6092
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4828

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:620
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5336

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3844
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4620

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1208
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5084

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4640
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5320

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\_ctypes.pyd
Size 139KB
SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
MD5 208e7dd066f23080da03b4ebd20fbc43
SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
TLSH
T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\base_library.zip
Size 1.3MB
SHA256 b387fde669653cb4c0afd1173cab1ea65aacceb0c7735f51387ef7d0d60eb0e2
MD5 c5ba518dab3c743165583852e59cc5eb
SHA1 4652c93b02e34c92dca732476c2d3b4c999eb909
SHA512 fcd258ccb624d982ae328958ed2d03dfcb0c637bb6f5d21a12336c92057d35beeb264f3d1858e52138e2f69ca829cc3dcaae7efdb8026bafd5b3ee2b715689ff
SSDEEP 24576:MIAddRpaQL0OuUF9ui9QeOdP2m2df4elbl:OddRvuUF9uY/Qg
TLSH
T140552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\python314.dll
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Contacts\desktop.ini
Size 412B
SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
MD5 449f2e76e519890a212814d96ce67d64
SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
TLSH
T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Documents\desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
MD5 3b960da228cc489b622697659c885d64
SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
TLSH
T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Music\desktop.ini
Size 504B
SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
MD5 06e8f7e6ddd666dbd323f7d9210f91ae
SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
TLSH
T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Pictures\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Saved Games\desktop.ini
Size 282B
SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
MD5 b441cf59b5a64f74ac3bed45be9fadfc
SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
TLSH
T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Searches\desktop.ini
Size 524B
SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
MD5 089d48a11bff0df720f1079f5dc58a83
SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
TLSH
T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\desktop.ini
Size 504B
SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
MD5 50a956778107a4272aae83c86ece77cb
SHA1 10bce7ea45077c0baab055e0602eef787dba735e
SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
TLSH
T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\AccountPictures\desktop.ini
Size 196B
SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
MD5 2971c89bfb3b06e591694b9a78e467b9
SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
TLSH
T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
Size 174B
SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
MD5 8f91870452433a5555c9d453f714698c
SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
TLSH
T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_48.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
MD5 1d41d647faf0c99af43c89459acc8e9f
SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
TLSH
T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
MD5 bbe70a516ccc8b65668330f36fc864a1
SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
TLSH
T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_48.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
Size 24B
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
MD5 SHA1 SHA512

Submit Download

thumbcache_idx.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 7KB
SHA256 8a6884eb9ee9f425d73e83acab47a3c2ec0cb65727d1c5ebff441556b531774f
MD5 9d119a900c9be616a1c38eb4cfd7f938
SHA1 ee1dc5fb35c0175847bcfd71c7ab9acc62f91368
SHA512 4a5e54cb153dd063717e69570ac503a4685b9d69ce7697983a3f897843bc9c183a8477b6a3dee006350add364d1ff98583f4340c598d76ea7d9cab1d6de2e497
SSDEEP 3:tn4lQlF:aw
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
Size 196B
SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
MD5 08e1b7b2fd872cdcc42af67707dc2a98
SHA1 512644da4aa90a3919bc29f65e878e9870874f67
SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
TLSH
T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Size 302B
SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
MD5 99d72adf4e683fa1e6f1a435ff5be9b3
SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
TLSH
T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
Size 432B
SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
MD5 f107d0270e21a2fe91099fdc15918d44
SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
TLSH
T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 174B
SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
MD5 548b310fbc7a26d0b9da3a9f2d604a0c
SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
TLSH
T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
Size 418B
SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
MD5 93c8b5c191bdcf8aca86d7463d77e6c8
SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
TLSH
T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
Size 298B
SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
MD5 819c27ae07898f1a5efda4e146dbb174
SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
TLSH
T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
TLSH
T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
Size 520B
SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
MD5 af5909700768a888173cbd32998cf3da
SHA1 194ed60ed8923749078816fc2c69614d975ba325
SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
TLSH
T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
Size 520B
SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
MD5 7a985a80859ee46e35031543cf0d142f
SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
TLSH
T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
Size 520B
SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
MD5 a882cf89da04eb72950e65080a5cf857
SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
TLSH
T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

TranscodedWallpaper

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
Size 176KB
SHA256 6ea25d299adb39df40212749727988f5f4bd1daba2b02fafb970fa2d1dbec7a7
MD5 90e4cfb342009eaaae50e1e7ccfd6729
SHA1 a92ec924cc7e55f7ced198b3c3406935f7c90e62
SHA512 3bc4c4aa96b72c6a5ecafed98f7c679866ba09f99a71683d13f1205e809700199b3150197477bcefc8f6a65c663073b61b7a27c59748b1721b82f58b210f7e6c
SSDEEP 3072:bxsJvlkwIJFCaup/yNOas8WY1hKKbfef8zob71T57kLq+Crt3CaEBqwbDpxp:1sJvGwIJ8N/yjs8WY1hKKbmf8e6LVCr8
TLSH
T151041263157FEE51B31B6E199B4B12FFA081B546362B391E74C7E9B32D23108A2C41B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5756-352-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads