bdaejec | 9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
Size 3.5MB
Sample260831-e6x4fadk6z
SHA256 9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1
MD5 0ee5110d18177113d349deaa1c89999a
SHA1 bde309083168d5b3247f5c46d7a75440652b49c6
SHA512 567c5ffd15465725f6f6b0209932390334bc0fba0fdc4d9e93b931d4ee3c23964a6d3cd555aeb55d1c1769922d958d274bee416e840dcaea6141ee1bb7308c45
SSDEEP 98304:E2157BjaVz+KmNizx7DzJXFRdrnXg/ldpjAFLOAkGkzdnEVomFHKnP:fQ5moNrnXgt3AFLOyomFHKnP
TLSH
T1A506D0627DDC807AD86317314EDEB778A66FFEB03A35121722917E2F6B712421A1C463
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/2684-33-0x0000000000E80000-0x0000000000E89000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c52a-25.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
1936	Logo1_.exe
5752	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
2684	sjuK.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	sjuK.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	sjuK.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	sjuK.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
File created	C:\Windows\Logo1_.exe	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3320	cmd.exe
1916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sjuK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe
1936	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5752	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
5752	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3320	2624	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe	88
PID 2624 wrote to memory of 1936	2624	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe	89
PID 1936 wrote to memory of 5468	1936	Logo1_.exe	91
PID 5468 wrote to memory of 1468	5468	net.exe	93
PID 3320 wrote to memory of 5752	3320	cmd.exe	95
PID 5752 wrote to memory of 2684	5752	9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe	96
PID 2684 wrote to memory of 1916	2684	sjuK.exe	98

C:\Users\Admin\AppData\Local\Temp\9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
"C:\Users\Admin\AppData\Local\Temp\9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe
    "C:\Users\Admin\AppData\Local\Temp\9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\sjuK.exe
      C:\Users\Admin\AppData\Local\Temp\sjuK.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\56ab321c.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1916
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 90b8713b9d5b30a6ebd2ff4629a0dee5d458461dde9ead027438e712fdc41196
MD5 db37e5b3582f1ac6e49d020cf991a32d
SHA1 ac63101811d2167f0a4e24508fe3bfff50317325
SHA512 cbbfd2e475fc680b9ceaf642a94e62438ac7833f101d4e95778c221898698955f13090f6ee8f34646689d056b512d6ea5a391457ef4d6a7db2b8bfa2c04a1c1d
SSDEEP 3072:pftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:BVfjmN2G7/fYfLvzB+QFyn
TLSH
T1EEC37C1372D08871E5B50C3449A1EA719E3FF9620B409EA737C467BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 57KB
SHA256 dfcfbc8b79e363cbac4a6d81d5657a2e0f1b8baa99c7e432ef30f52736c2e655
MD5 415ab3b8e3bda232a24d1b26db5f248d
SHA1 83a90568b1830eda186519435651a5c2331a5b92
SHA512 45ce83d4b9b6e24eb21ad0118f44e36ca63d09b58be75d74143908f5c7655c6b98b0fabb2fe259eaf888df245cbb4cb79ad8a51b3d3bb839bae9bbe585d00ed4
SSDEEP 1536:CfgLdQAQfcfymNGHqaN6qHjWGCq2iW7z:CftffjmNLaNVHaGCH
TLSH
T18843D0634BC014F5EAEE1935A5E73643877A9E3048D9AE6F43B07EBE1C30740E81A257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a6FB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6FB.bat
Size 721B
SHA256 498e719812ab0e9f15a16db50f2a73df10b00eea339772d624f97efb9e83f4e6
MD5 23dc909130dc6751c4888c8a4a6fad27
SHA1 f1dbfc73b45f9c2874394f626aca821dda021f7e
SHA512 6e93c59abe963ff86058353fb32634cc7afae2ade773fe3483d0c185cd7d54a4ff5254f15e8c95d705e110a6eeb00f9607a2241af12bb677aa1b7b8c722c93ec
TLSH
T1CE018F85405AD56F0E03883607D1B6CEC2B5346E77CA3A85C25890FC20A55AAFEEAB91
MD5 SHA1 SHA512 TLSH

Submit Download

56ab321c.bat

Path C:\Users\Admin\AppData\Local\Temp\56ab321c.bat
Size 183B
SHA256 cbe0bc2a96b561363a7bbe78e3cbca44706be9cb5a2b55b0597b900c1bc22bde
MD5 1995e05923e2a53f51cf3cb14bdc6ed6
SHA1 8a4614931125bf902c08b43f47106d5c97ebe97c
SHA512 e173744251ea17268e7220d1655a43758682783b56d09f87150bde5202c99f5c3f6189bf81a1a9bccf50a3d5ac410e7e6a8a1c87e79421b89db5424da65278b6
TLSH
T135C0124281C6C659149850770AE1618CD0A548583F5E2B354B20849DA59640EF9C7341
MD5 SHA1 SHA512 TLSH

Submit Download

9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9bf8a46cc8c1fb92690fe4de332cda872b88b19343fad526694439374c73dbf1.exe.exe
Size 3.5MB
SHA256 0c66d0fb1a3db426be93515ef0e7395a49a1fe8113c4363c3dc373edf25612b3
MD5 f469a6003287e9d370caf3713b61b3b3
SHA1 01733f11ce594ba9f1194998e295f402a60f1ed2
SHA512 90bcd4817fdb2fc8c8366d08a0b03f53e329cd682d00a1b47e7bba82513bfde80eeaf7ba59b42b908ce532a9d7ba78705aa0d0c81550564c7f5dad77c963b16f
SSDEEP 98304:k2157BjaVz+KmNizx7DzJXFRdrnXg/ldpjAFLOAkGkzdnEVomFHKnP:/Q5moNrnXgt3AFLOyomFHKnP
TLSH
T10406D0627DDC807AD86317314EDEB778A66FFEB03A35121722917E2F6B712421A1C463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sjuK.exe

Path C:\Users\Admin\AppData\Local\Temp\sjuK.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 aebcc8a896333f477f901162da56dad01bb0f770737b56182a08a7909c179110
MD5 be0ce7ef1852ef853894dfb0a54b54b2
SHA1 f4520734769077220d0ce22dff533288f6e4e74d
SHA512 27a55a073392f867cc0dcd8d615db763d549e2090e6135e5bf7f56628fe5890978409c4166c54c366f56aa6ec7a9423cd7fc1c1fa6e2ff8747182e6dff4e2ba7
SSDEEP 768:k1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ufgLdQAQfcfymN
TLSH
T10BC2CF2A23C82979DC1D4D7CCB835621833D4F79149B66B726A3AB7F2370664180E95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/1936-1265-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-5546-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-127-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1936-5073-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2624-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2624-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2684-26-0x0000000000E80000-0x0000000000E89000-memory.dmp

Download

memory/2684-33-0x0000000000E80000-0x0000000000E89000-memory.dmp

Download

memory/5752-21-0x0000000000980000-0x0000000000D0C000-memory.dmp

Download

memory/5752-32-0x0000000000980000-0x0000000000D0C000-memory.dmp

Download