Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 13:28
Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 윈도우설치 루퍼스 4.15/rufus-4.15p.exe
- Size 1.9MB
- Sample261024-qqwffsh191
- SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
- MD5 9ec58202a786e33506e852dc9ddd03f7
- SHA1 f42ac0f91d72116e329d19cdb270187181e317db
- SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
- SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
- TLSH T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy rufus-4.15p.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rufus-4.15p.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rufus-4.15p.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rufus-4.15p.exe -
resource yara_rule behavioral7/memory/620-0-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-48-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-49-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-62-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-69-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-73-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-77-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-92-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-120-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-125-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-129-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-134-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-137-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-141-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-145-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx behavioral7/memory/620-150-0x00007FF7F6460000-0x00007FF7F6A11000-memory.dmp upx - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rufus-4.15p.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rufus-4.15p.exe - Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters rufus-4.15p.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rufus-4.15p.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000029678647ff41dd01959f7db30a42dd01cf9fc396bb63dd0114000000 rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 rufus-4.15p.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rufus-4.15p.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe Token: SeLoadDriverPrivilege 620 rufus-4.15p.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 620 rufus-4.15p.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe 620 rufus-4.15p.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus-4.15p.exe"C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus-4.15p.exe"1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:620
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:5272
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:2652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 aabf3c15b246704ed4d03134b640ad4fa45435eb8a22bfeada0081908dea0c8c
- MD5 38c77e6d92af55c2f07f744aaee801f9
- SHA1 8cd2482b7d1d7d0f89553f9c64d3cd96268c0864
- SHA512 82246eb1280318658ff5870094c91d6f90f7dc6acef957db7f48f1f4184604a5733d924e4e167224e838cca8ff353f7de1b7198a0323e303f40ce95d23abfb57
- SSDEEP 96:/mLbdki6XFs8PpN6n4sRwZyyFfc9GspH6+v+y:/mLbdkdF3CsyyF09GspLmy
- TLSH T1A0D2C4663D74D611C84A193CAC5BDBEE2DA8FEC6DE188427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 c489ee54f9270f01d46df0288a46ebce0971924b6225840dfc5f613eca04f0a3
- MD5 09309939ae3d7673080604669ca74094
- SHA1 60be4b6f44f2e988ef3e7f8faa9fc858841a491c
- SHA512 1181f67ec60de1c71cb4fd1b3813516c7186eddc6f5a92b726e77faf3cf0eeace1e766ff6561d943bc7037a0dd63e283aefa9b5c147d4ab6674ce73d4e121817
- SSDEEP 96:kmLbdki6XFs8PpN6n4sRwZyyFfc9GspH6+v+y:kmLbdkdF3CsyyF09GspLmy
- TLSH T141D2C46A3D74D611C84A193CAC5BDBDE2DA8FEC6DE188427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 7c0896676299582239774601a74f1d615cc95ac4c021ff2d8f1e1e30f2a90f4c
- MD5 db58c80424bbf4a3f3f647b67b652642
- SHA1 037917dd92f40f111644993831f848601ed6f789
- SHA512 0cacf0d79c4d2aefc220df3bb06d34d214fd04f26c9437d429075cdad1d2f3657b1774689fd1ba33ceed6d8ebf4a72e1a800fd508762a956be66cb993ce6fd64
- SSDEEP 96:4mLbdki6XFs8PpN6n4sRwZyyFfc9GVpH6+v+y:4mLbdkdF3CsyyF09GVpLmy
- TLSH T186D2B2263D74D611C84A193CAC5BDBDE2EA8FEC6DE198427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 6b88d415d397f5ca361dccb1d2a6d6713a70a129c9ba5bdd78e6887e8beb3ac8
- MD5 593ba43ac850d0ea40ace560f6c41f14
- SHA1 6132390816d8e0d3cad181995a65bdab37033211
- SHA512 73ba4b6dc21f136e365e488ea6f809464815844b51f7c5c9abef19ada833a85891f1cf2f5166ccd19a54b1035aace34de7b6ed89fdb92115e510e5903859156d
- SSDEEP 96:EmLbdki6XFs8PpN6n4sRwZyyFfc9GVpH6+v+y:EmLbdkdF3CsyyF09GVpLmy
- TLSH T115D2A2663D74D611C846193CAC5BDBDE2DA8FEC5DE198427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 25b75e2f92311be0557b50175a2a7edfd9557bfa302bbc238819e643db330fd2
- MD5 0db223fe6ae820dc1fea94e7338db2dc
- SHA1 ab25f3d14b50bb6a24e18ed566c89edfc0ddd1d1
- SHA512 4889c95447d87cbdbb964655da4a940aff506b60637198e130890f968f6639b7a64ecf2aceaab0f264e68f6182ebba267e3fcfc1e4a40fdefb9857e0b5755066
- SSDEEP 96:QmLbdki6XFs8PpN6n4sRwZyyFfc9GVpRr6+v+y:QmLbdkdF3CsyyF09GVpdmy
- TLSH T120D291663D74D611C846193CAC9BDBDE2EA8FEC5DE198427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 a3861367408931499e4927ceae68d62ebd0f585a2dc0911f12d192d8b1a2ec74
- MD5 cf15e210f3246b8454362e7b08637ed4
- SHA1 315e5d0410ca6e2a43b4e6c7914e2fbd0771766c
- SHA512 a91ae2071d04af4d40473249beb0af364f863363f742c2ace98e24b56858c088476bb9ff2105d5d522577a59987899e0b49a6b6c2663ab54d4b22ddbf1b9b03a
- SSDEEP 96:nmLbdki6XFs8PpN6n4sRwZyyFfc9GIpH6+v+y:nmLbdkdF3CsyyF09GIpLmy
- TLSH T1F2D2B3663D74D651C84A193CAC5BDBDE2EA8FEC5DE188427BBF1F7AF09B18078520408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 4a3731f802c158d1bfdd4ad19bae1a94e21901743c70da1d498cf1646a3767dc
- MD5 a605a1b11040753d3a382e04f7de22c1
- SHA1 53440d5e8e4513daf2809350e17d0095d2ddd217
- SHA512 b251601dca70bfc0c68956f0d8e757f06e6c03cb16acbebbb27e498ecdef4847aad12313629c69729f229587e73a6f9affc2ac3e7c47a8c3d587a68eafd3a50f
- SSDEEP 96:jmLbdki6XFs8PpN6n4sRwZyyFfc9GspH6+v+y:jmLbdkdF3CsyyF09GspLmy
- TLSH T119D2A3663D74D651C84A193CAC5BDBDE2EA8FEC6DE188427BBF1F7AF19B18078510408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
- Size 132B
- SHA256 45817ee94bd19aa152061d75c023a11fed4b4cf77bd81b6d50a213bda42a1a75
- MD5 2cc3dad5cf3706bce5eca88982e612d9
- SHA1 e63eabcd6005cbeac18d3a46fcbad64860317479
- SHA512 5d633171482231a5f95d037ceebfe4326c2e0165c835a2d59cf97de3e951263e3f5a96c1df8250cf453f90694c5aa040d17e8f0fdd56b493911640faa624cacc
- TLSH T15CC09B519F1665277F95542CD71144546595DF070795761308E2550001CF853D077119
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
- Size 41B
- SHA256 4b75c0df1b9391ee68f9f0d7faa63f0d667debb5d6cd03a9fce58c99d2855b40
- MD5 575bec62f104868455810249466c98d8
- SHA1 ba335e3456fd5f367d57f2e2e059655f0b21172b
- SHA512 fa678af519d9b9e9da637009c6b83502a26a61eb822db8c822fba58fcbe28e0959205900f56509aee3497886da3ac73015872dbc29415b8df1e3cdddc4b8753e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
- Size 101B
- SHA256 aa70d92573a4151068c97cd38481d4a027710366f5e5d92552c459bc2d13a5f1
- MD5 42212a39eebeb7d2b0f0d6287a242b60
- SHA1 91ffe6d1413d72b86b7ff023aae83e3844a0b9aa
- SHA512 9a5c070cd7a4e8f8f331602125f5513ca38ccfc8542a62b4ae31a68a33ed36a51ac5273fd92207b0e3b331ab2b8a2696aec2d700bd445585b026c406d2e47abe
- TLSH T17EB012115F1660223BD5942CA901488029959F0B0786622304E2640002CFC43C06B11A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini~
- Size 70B
- SHA256 78952af9436100c7c15414939fe9919d0b672260446ecc1057e75f95596ef644
- MD5 c794dace0b7105dbaa993bdb65fa2733
- SHA1 98c2582a6689eeb1c970713fdd76dd01079fe2f6
- SHA512 29b7782c7d81dafccba45ea1e4dc2f99f9a7c72690130623835917f9a2a0640cbf9526a707fa0df74ea13cfce3a8ed30f1d1d95eac8e0d1dfaca03de0755e18c
- TLSH T1BAA002265B07A53237E9A51C7C4489D53ED56C0F47CB553241E6B851038FC87C49F51F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 127B
- SHA256 14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579
- MD5 f9a49a3e2415016fa85ddff0b8b38419
- SHA1 f8c987119269e58d22a6b17ae2e8eca7744fb385
- SHA512 91ea129a51d2c3b342287c1250f5b0da6ba2a61eff11791d1cfae1f5c6dd2654c935be1452f4a681e794fd723a3c295e9bc9e59b9005aa4d8bd55ed36c9ad91c
- TLSH T128B02B1303400026C02B034040A8150491AC0008F17040F9F313D24F9782A205C7A851
- MD5 SHA1 SHA512 TLSH