84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Size 1.9MB
Sample261024-qqwffsh191
SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
MD5 9ec58202a786e33506e852dc9ddd03f7
SHA1 f42ac0f91d72116e329d19cdb270187181e317db
SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
TLSH
T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	rufus-4.15p.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	rufus-4.15p.exe
File opened for modification	C:\Windows\System32\GroupPolicy	rufus-4.15p.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	rufus-4.15p.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral8/memory/4384-0-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-55-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-54-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-63-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-64-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-74-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-75-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-104-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-105-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-107-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-108-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-110-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-111-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-113-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-115-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx
behavioral8/memory/4384-117-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rufus-4.15p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rufus-4.15p.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	rufus-4.15p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	rufus-4.15p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	rufus-4.15p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	rufus-4.15p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	rufus-4.15p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	rufus-4.15p.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	rufus-4.15p.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Colors	rufus-4.15p.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	rufus-4.15p.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f49471a0359723fa74489c55595fe6b30ee260001002600efbe1000000051b6f69a5242dd011b31c3b25942dd018eb08e9abb63dd0114000000	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	rufus-4.15p.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\NotificationData	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	rufus-4.15p.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	rufus-4.15p.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	rufus-4.15p.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	rufus-4.15p.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe
Token: SeLoadDriverPrivilege	4384	rufus-4.15p.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4384	rufus-4.15p.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe
4384	rufus-4.15p.exe

C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus-4.15p.exe
"C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus-4.15p.exe"
1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4384

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rufus.ini

Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
Size 164B
SHA256 aeb664d3cfb0d53a17db3b74680a6d17a8754a54b7f2fe6f75482da91ab6155d
MD5 b8d5cec1fb43e7be787e8d5b0ce25d8b
SHA1 5c6247fc15eb3cef9b292488ff40206d4dbc0200
SHA512 0252d607f7daa2b657040580725b7172ae5386a0183807db0a7c6bed2222c9c199046f09121f50f9ea3cc5137fd76627a5b276c5dbd9deb924c696e136ec9d12
TLSH
T130C04C40AF1964267F99D57C9E125880F866EF571755B61348F7790011CBD13D42F226
MD5 SHA1 SHA512 TLSH

Submit Download

rufus.ini

Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
Size 101B
SHA256 529616ae4a31c0d5aee013c7591d2539d0cec1a5ce7189a0fb057955736ca69e
MD5 6737400f29b03b64ec4e82790fe986c1
SHA1 c979b4bbd2172a1f417b1d335cddfe128bab05dc
SHA512 207be7e1857459c3b779649988ff5655add0bfcf43470cd1f13f9703cce4b158634e51766f9ddc9980ba5bc9d12d5264de81b07147698ac137373f6ef92e9819
TLSH
T1AFB012009F1660223BDDA43C590108C068A69F0B078A631344E2B40002CFC13C01F216
MD5 SHA1 SHA512 TLSH

Submit Download

rufus.ini

Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini
Size 133B
SHA256 1577e2fb9f3c4f16c0be992ed5746ccee435d6921835d9399959055b0ca20da2
MD5 ed3660490899aeba3d91bbf7f5a9e423
SHA1 ac74405b3aea8168be5e2e62a78340a17763520a
SHA512 ed0d23ff37c97f2c7ec2df11ca0324c3ebd4925529b3a4a5c7112dabad0a85868b5745fad4b7ca526fe9d42d02fdc1020425aa5400cedb9d80000a9eaa622d38
TLSH
T13FC09B409F1560167F99943C9B110480E466DF070755671348E2750011CB813D42B215
MD5 SHA1 SHA512 TLSH

Submit Download

rufus.ini~

Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini~
Size 70B
SHA256 5b095fe2628caef1e83179e5bb2b1f9f8649848928fe7dc18846b377541bb0e7
MD5 d1240df7f26f448ef5c5d1ae0b4b1151
SHA1 268fe0ed895991c0ee68841483a02462af9b3039
SHA512 e6fa1bcd0eaa92d3c637fccb8e1e645347b9f7dff5cbebdc50ab7680a2b2d70af1e279f2130aba78971f733ba91eadf6341036d519d743c97939e79e70044460
TLSH
T16BA001159B06A52236EDA529284448D169A6681B478A562281E6B845168EC57844E21A
MD5 SHA1 SHA512 TLSH

Submit Download

rufus.ini~

Path C:\Users\Admin\AppData\Local\Temp\윈도우설치 루퍼스 4.15\rufus.ini~
Size 41B
SHA256 6922c748e22fcb7c3324317a3bc19ad92166772b40b1203922243ee92eefe5fa
MD5 37ac09fe6d2d6d46bf03e3e1c9510268
SHA1 92cf8f067491822d7b0e3577b934c1286b06ccab
SHA512 d0a444f73578faf8ad55d7d7693e123da5cc92f7aa3deaaf7b44992c900904e6d10f2be3ae1db66d32e403f3185ced1d16ad115ae3999e15822e2abaec895a8b
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579
MD5 f9a49a3e2415016fa85ddff0b8b38419
SHA1 f8c987119269e58d22a6b17ae2e8eca7744fb385
SHA512 91ea129a51d2c3b342287c1250f5b0da6ba2a61eff11791d1cfae1f5c6dd2654c935be1452f4a681e794fd723a3c295e9bc9e59b9005aa4d8bd55ed36c9ad91c
TLSH
T128B02B1303400026C02B034040A8150491AC0008F17040F9F313D24F9782A205C7A851
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4384-54-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-104-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-74-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-75-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-63-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-0-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-55-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-64-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-105-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-107-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-108-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-110-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-111-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-113-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-115-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

memory/4384-117-0x00007FF6B3D30000-0x00007FF6B42E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads