Analysis
- max time kernel
92s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HappyDesk1.0.0.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
HappyDesk1.0.0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target HappyDesk1.0.0.exe
- Size 2.0MB
- Sample240205-pfwg2afdf3
- SHA256 a3fd14753f2d26dbb17fec41e7cd0e8a72317c114559a3ae5ced89e22e8d85bc
- MD5 619d114123f790e1ac4fd12d2891060c
- SHA1 f987a53fad5dc6a978da195dac2a3829b808b87e
- SHA512 7557828742eca997ca44253422601f1b6a714118c1f379e5f6b63dd4d7e397be24f1ee17b0d5ae5e30652f2b47acbec3c44760daf47bf3b8d5229b2899d39013
- SSDEEP 49152:PIRB3fUfQZAc8fHerbNtemxYO0D6WWiin3KwpTn4x541mro/6Nb+:WBv9AorbbehO0WWan3K1colb+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation HappyDesk1.0.0.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation setup.exe - Executes dropped EXE 4 IoCs
pid Process 2000 setup.exe 3212 GLJ4EDC.tmp 1800 GLJ4EDC.tmp 3456 Dockbar.exe - Loads dropped DLL 41 IoCs
pid Process 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 3212 GLJ4EDC.tmp 3212 GLJ4EDC.tmp 1800 GLJ4EDC.tmp 1800 GLJ4EDC.tmp 2000 setup.exe 2000 setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA699D} GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\ GLJ4EDC.tmp - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GLBSINST.%$D setup.exe File created C:\Windows\SysWOW64\~GLH0009.TMP setup.exe File opened for modification C:\Windows\SysWOW64\safeDesk.dll setup.exe - Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\DeskHappy\~GLH0003.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\~GLH000f.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_baidu.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_book.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_computer.png setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\dockbar.dll setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0010.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\myie.png setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001f.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0013.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0014.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0018.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_web.png setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001a.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_webgame.png setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001e.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\UNWISE.INI setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH0002.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH000a.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_design.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_qq.png setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001b.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\addtask.bat setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\UNWISE.EXE setup.exe File created C:\PROGRA~2\DESKHA~1\temp.000 setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001d.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\panel_middle.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.lnk setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH000e.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0012.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_game.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_meili.png setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH000b.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH000c.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH000d.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0019.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0020.TMP setup.exe File created C:\PROGRA~2\DESKHA~1\INSTALL.LOG setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH0007.TMP setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\INSTALL.LOG setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\panel_left.png setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.lnk setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH0005.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0011.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_iphone.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_pictures.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_taobao.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\dockbar.ini setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\balloon.png setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\dockbar.ini setup.exe File created C:\Program Files (x86)\DeskHappy\~GLH0001.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\panel_right.png setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_BMW.png setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0016.TMP setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH001c.TMP setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\Dockbar.exe setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\ÌÔ±¦ÌØÂô.url setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\СÓÎÏ·.lnk setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0017.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\ÌÔ±¦»Ê¹ÚµêÆÌ.url setup.exe File created C:\Program Files (x86)\DeskHappy\images\skin1\~GLH0015.TMP setup.exe File opened for modification C:\Program Files (x86)\DeskHappy\images\skin1\icon_exit.png setup.exe File opened for modification C:\PROGRA~2\DESKHA~1\addtask.bat setup.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\~GLH0008.TMP setup.exe File opened for modification C:\Windows\task32.bat setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1580 schtasks.exe - Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\safeDesk.myBHO\ = "360×ÀÃæÖúÊÖ" GLJ4EDC.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safeDesk.myBHO\Clsid GLJ4EDC.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\ProgID GLJ4EDC.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D} GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\InprocServer32\ThreadingModel = "Apartment" GLJ4EDC.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safeDesk.myBHO GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\safeDesk.myBHO\Clsid\ = "{B69F34DD-F0F9-42DC-9EDD-957187DA699D}" GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\ProgID\ = "safeDesk.myBHO" GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\ = "360×ÀÃæÖúÊÖ" GLJ4EDC.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\InprocServer32 GLJ4EDC.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA699D}\InprocServer32\ = "C:\\Windows\\SysWow64\\safeDesk.dll" GLJ4EDC.tmp - Runs net.exe
- Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe - Suspicious use of SendNotifyMessage 53 IoCs
pid Process 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe 2000 setup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3456 Dockbar.exe 3456 Dockbar.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2000 2348 HappyDesk1.0.0.exe 84 PID 2348 wrote to memory of 2000 2348 HappyDesk1.0.0.exe 84 PID 2348 wrote to memory of 2000 2348 HappyDesk1.0.0.exe 84 PID 2000 wrote to memory of 3212 2000 setup.exe 85 PID 2000 wrote to memory of 3212 2000 setup.exe 85 PID 2000 wrote to memory of 3212 2000 setup.exe 85 PID 2000 wrote to memory of 1800 2000 setup.exe 98 PID 2000 wrote to memory of 1800 2000 setup.exe 98 PID 2000 wrote to memory of 1800 2000 setup.exe 98 PID 2000 wrote to memory of 4912 2000 setup.exe 87 PID 2000 wrote to memory of 4912 2000 setup.exe 87 PID 2000 wrote to memory of 4912 2000 setup.exe 87 PID 4912 wrote to memory of 4448 4912 cmd.exe 93 PID 4912 wrote to memory of 4448 4912 cmd.exe 93 PID 4912 wrote to memory of 4448 4912 cmd.exe 93 PID 4448 wrote to memory of 2300 4448 net.exe 92 PID 4448 wrote to memory of 2300 4448 net.exe 92 PID 4448 wrote to memory of 2300 4448 net.exe 92 PID 4912 wrote to memory of 1580 4912 cmd.exe 89 PID 4912 wrote to memory of 1580 4912 cmd.exe 89 PID 4912 wrote to memory of 1580 4912 cmd.exe 89 PID 2000 wrote to memory of 3456 2000 setup.exe 91 PID 2000 wrote to memory of 3456 2000 setup.exe 91 PID 2000 wrote to memory of 3456 2000 setup.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\HappyDesk1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\HappyDesk1.0.0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe" /s2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\GLJ4EDC.tmp"C:\Users\Admin\AppData\Local\Temp\GLJ4EDC.tmp" C:\Program Files (x86)\DeskHappy\dockbar.dll3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\PROGRA~2\DESKHA~1\addtask.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /ru system /rp /SC DAILY /TN DeskTimer /TR C:\Windows\task32.bat /ST 20:30:004⤵
- Creates scheduled task(s)
PID:1580
-
-
C:\Windows\SysWOW64\net.exenet start schedule4⤵
- Suspicious use of WriteProcessMemory
PID:4448
-
-
-
C:\PROGRA~2\DESKHA~1\Dockbar.exe"C:\PROGRA~2\DESKHA~1\Dockbar.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3456
-
-
C:\Users\Admin\AppData\Local\Temp\GLJ4EDC.tmp"C:\Users\Admin\AppData\Local\Temp\GLJ4EDC.tmp" C:\Windows\System32\safeDesk.dll3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1800
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule1⤵PID:2300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\DESKHA~1\76A1~1.LNK
- Size 684B
- SHA256 00088fdc97d7e40b1711f3342f898af6164324859f09792fd505c8d69a7f084c
- MD5 49e4eaa1b8027b3799b65c8d71811b0b
- SHA1 670796ad7f5f7afa4af9b5b8ceac583ca7c7ae75
- SHA512 c393fd45df2233431bd7408adf1e79a9cd12180c46e197525ac6ee5082ed85ab6dfe99b5a959cc1f9edaec173e31ccede14fca4dac2229008ac882c4746db493
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\7D4B~1.URL
- Size 190B
- SHA256 1e0a040712bc8c1e8d164a162fcd94f859c6410b09089aa534cabf906a594bd3
- MD5 06a01c73f3ec33a4b71d6d7650e82e92
- SHA1 90c85d9094ba7d50e4e604506212caaa293ca26a
- SHA512 d9aca71e79af5369f717d898a7e1ee14d44a493eb93746525fe50d3c055ec775c9f70c559f5a28faa70195aa13d0dfc2d76d1fc441d847142e238882b3df5b2b
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\C325~1.URL
- Size 188B
- SHA256 c47e0ed1cfe93438a26b2e84fa9b21385d708c33fa5d633cc5226f597f79b574
- MD5 408a4b7a3303ca1142f12e2f4f07a85a
- SHA1 2d08b70e450fdc43788c46603eafa842341c2b33
- SHA512 935dad5a2c1efbc32d58915e991d0a7e8b2bd968303de1a1c122578f302efbffbbf629f76f34bd1b6d0d17935da943ac334369432d83788fb36cb0133bda10e0
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\Dockbar.exe
- Size 144KB
- SHA256 24433c7e4ba8d04e70d7c0a7a24e68fe3017040884bc9c3aa624e8ed7a7cb3c9
- MD5 3c9fee245da0a365cc22bb223cd3ab46
- SHA1 a0ee44af8f3807ce00c59421bd7c9b0a1cde0e50
- SHA512 9cfefe12045027afd28c69b4150ae12c8fe9c633f66ed7b40d975cb334e0f04e8131012e5556088b0c81c663a34f4186d8b590d8a9355ef4e415a940af757425
- SSDEEP 3072:Kz1LaQCvkOFel7JtBVf4EFTFeANqRWyVvK8:CUO7JrVfTFYU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\INTERN~1.LNK
- Size 686B
- SHA256 5c3052421e3dbf7b67fd6466dfd29131c64cfb5f6f14c2090c063932d8c40bd7
- MD5 ea88e428a02ae971adbab4b07071002b
- SHA1 2dc42f4331a3eff4a78b68c660de6a4a1438b91e
- SHA512 7779b9c0e965dba7bb3da3a65b38f7364bea3565c88d6f273f47c3c121c873138636d5dc56fdcd5e6fe2aab5d15b27a1737c87ce4e5a115aec1360463da5227c
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\UNWISE.EXE
- Size 149KB
- SHA256 77360f4c519e4bba897701eb0eea820b80daf7ac7c577e5f7d9e71e1d6bb8157
- MD5 0b4c220be3b2bfd235fb9ea624488e1b
- SHA1 99fc456bc1e5b49f4eaa80f9af9bb6a56eff7f1f
- SHA512 8b9e6380d81f6ceeabc6e7eb0973294bcca065e807da572918caee09c57814668e062b5de0a9abbbcec2a7f37ea32594fef6609a43d979ae91a03a5298850f33
- SSDEEP 1536:StI31IvXRwWxaN2mSKcFoaNLZIlpYBAgu7+YoPgWcSXLJE9MzHAUs:SOFIJ3o7dYUiK7+YoPgWVJYoHAU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\addtask.bat
- Size 555B
- SHA256 62563c52cc52f6edb0982fed86d4f75fcc08fe09575e73b9dda4cd386c9c0500
- MD5 141d795a22a2e333815071c6f642cc71
- SHA1 2ecd8951ea58b9a3f095894caa45f7cffc94885a
- SHA512 6571c3ee42d67279892d99a5e54901f60055d0d636604000e391adadab156c8f1bda264ed9c6701d32d4b65dafb796a6ca7bd73ac24645f3032e02801d73b5ad
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\dockbar.ini
- Size 1KB
- SHA256 239d93da28d0e4a51eae725cc7ff13a95c59f79b8a39786b56b879b10809acf1
- MD5 79fbe70cf8f6f97f87d534bc34a04278
- SHA1 970f946300cb27acde0ecf04e3bd08c9bea3c94f
- SHA512 7054797c9e031d8d5c2c9cfa276a6e6aee2d45ccaed478b742bd7eb67bd37838e5cee88271da88f176e137608ecf40fc0d77e46997972cb8f6f8896f0326dcc9
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\images\balloon.png
- Size 9KB
- SHA256 fe56f245a91c0cce41ed8c0d48072cea59abbd3e0ece89903b23b6735bb32a27
- MD5 12832b3c4cd2de7b2dc6400da8a19062
- SHA1 a1b813140a9deaa8df589302c424f52ecc2e4974
- SHA512 c757f91abb06965bbcbb37dc36c7b350c12eab70879b5670256faedb0b3ba247a19d690ccef025d3f15ba8d53a74d137637a4056b2099e546c806a8490f846db
- SSDEEP 192:KSGwsV+qvkSKZXVUq+SJJNKjiMMi6pgbhUZBAjdnHWdpiGkm:F+k5XVURSJJYec4y4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_B~1.PNG
- Size 30KB
- SHA256 03db5ced41e235b40c8e7f6248da11fcb13a17e29c292d68a1ddb16152d8c65a
- MD5 1451f4e958f1e2e6e1914cd66e1c5874
- SHA1 152c89b202dbbbb604381508060a16d3021a3607
- SHA512 3cde0dc48cda36974fed993eea7b282fb2dc32380e34177ac5273bf27cad2648afbc1ad410246fa08e3dd68dee9664a040342e5f32b76556e319a94c3d412be0
- SSDEEP 768:LwCucMSOxG3j/m0S7sUP7I5h0S7sUP7IW:LucwUz47sS8/7sSR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_B~2.PNG
- Size 14KB
- SHA256 2e0744e4507a0666b74fd73f3416ba24e3ebf5ef3a771d5a425c98fb65040653
- MD5 57bb3fa7b6cbbab50b20e600bdec1d10
- SHA1 118a0befd853aefaa65bca7646213357d78754f3
- SHA512 f4fab06b46d891e95b04457103dfb7c76325363d41001d6d1e1080be87f5500f3eb425581076928d9ab0e0f2b61607f49bf9b54f1335372598afab6c75a54f9c
- SSDEEP 384:UGDwvyV5ImuKhTOVUGxXOZVHTgMudsbzRsGxCo:UGDwa7CVUGxlMuOWGxr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_C~1.PNG
- Size 13KB
- SHA256 474599d618b321e4fda986a2a58b93e16817b8b57c09a49d696f4b264791eef3
- MD5 1ce90c4479e4c45a216c69c9e462c0b3
- SHA1 0507de0e12114a809d5a8a7ea259bb42f776d764
- SHA512 55341b483e63b7556418b8ac65fa23f4bcb63a4e1b44bdff667394e5e4f28cad8c836454f7c7bb0069d695de5986c95ccb4f12ec725f22680bdd69e33e368364
- SSDEEP 384:5oFHg//sAXy6Ig1sBf14jlmcYRuW1ocMdu/ovWT:GFHgcYyTCMcDfdu4Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_D~1.PNG
- Size 30KB
- SHA256 3bbc3298ce13bcb488fb7d0a67489c1a1d06d0c3dbd3a26de5706a434188098b
- MD5 3b5dfbf45b6c59365354fbd44dccbf49
- SHA1 f5e4521e6188c2241423b60f11c0de963b6c38cf
- SHA512 93000bc24d1f55a9c20d3237958b021f3cb58521a5ac5e77e787553a8cd6a746856d8fa3f42f81e282fc6eb7f4267ffb49e476ca0c6e0a7651523ddc494d44cb
- SSDEEP 768:i/O9RuQmc+ZDtNwdWFikrQJIycsIQ7birtuS9VO:iUycAkd6rQJI1sIJrwL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_E~1.PNG
- Size 23KB
- SHA256 252a2375284d46c67440dcb3aaca2c0b44704c398a2cdb4d8884f0814a356f3a
- MD5 a90ab4e84870ffdde504ed673171dace
- SHA1 5bc1f56ee3a7f35bc247cef412c9ee85dd1c9543
- SHA512 c5f3da6415632bf5bfddd0aaab360d4cf35d95e9ddb93069942e839e82f0fd869686756020e3191dbf6f6df040c0ac5d364dfcafe2452c112272298f050d67b4
- SSDEEP 384:rOWOLv5qB06VheYGeMvVvWdSmeIQ2ymLYXq0n81eD4+r2b0+Xsabudj6SxGvRhh:r/O9f6VkeU1W8mFQ9Xq08d+rb+c/63Jj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_G~1.PNG
- Size 378KB
- SHA256 7044ed1d2bd4d69353520fec9c99d79cdf2e05c608ca8adae8d2d12fa93e6ad0
- MD5 bfef18492c3d8a3f1daa0cf83225ca16
- SHA1 9efe8b8b7dc956bb5b17b20d42fc4eb8a786152d
- SHA512 53de59f787c8a359cebfe5cb0667d7c958081c1a33e6c63fac8c22a009332c8da21a4da74146f8dd767692ae52ed08fde0e2bc94dd69ec510ebee6c7dd254ebe
- SSDEEP 6144:H3dddKKzCflHp+UwdmXF6yS8ak+mmLx6H7bYvb7XFMQ1d3s7AeK4Stt2woO2rXxR:H3b2fl4U2Bnacx6bbGbzxw7nKNNoNp64
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_I~1.PNG
- Size 38KB
- SHA256 68c728d2c96c34cec32ceb5ecd82e7ce8b2b7accd98b7f36f0130f54bb9285d3
- MD5 30215717fecabc3b08502341f69014e0
- SHA1 66086cbb268ef5039e6c4e18298f36fa2990c31d
- SHA512 0dca1181592eda95a4730dadc95e41704cf7a06cb968fd20e9d2d1b9e910198f6237d84a8fc46ff7eed3c735e4647cefbae7e6fc149707f02b6ffd114eb7eb45
- SSDEEP 768:ykmIF7Wtm0cVQJp879P28trrgOQ7dXQ5ecDpCsmp5R4adujzQnee5MhhHp5y:t7WtBq75O8y7d0ipD4agQr5qhy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_M~1.PNG
- Size 31KB
- SHA256 db9bc8a4d9528a66e09042f903ea1f99e8881062e148eedf1fc278659b4b9408
- MD5 87bd24fd14d10973feb2f6845ef39851
- SHA1 638d12d68265946ae83829c6f5668f0ac6bfb040
- SHA512 033874a3b803cd04086f7449b9a2d2b74dec8cc4a73246fa987bc7eacf2807fdcac0b7c8104e504258763db836f5f58f0ddb72ce0fc330155c936c21364c8265
- SSDEEP 768:xisqTBA7rl6Ge2azll2Rk9w6oghLCZm+pKk:xish/lFenpogh+4Fk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_P~1.PNG
- Size 34KB
- SHA256 209a65b56cf323308f94fffa7c2a048d8df6405c6f0263550515b66f0d2dac1a
- MD5 da7231c44287fef851fa00f0b7048ac4
- SHA1 9539865d3d0d2853d64dfe9b98c6cbd2746aeca1
- SHA512 91765de0beeaadf6a1812122ffa8d86f998610d3dc933dd13b5e42b3cb40c3700ac4d2b4717c7be4060b16b222a77d522b7bc53046825a7fde7cfd77862b49d8
- SSDEEP 768:335xtuhBixpYc16d1ALu9CYDzNX38GCn9hXLusr:/E6x16d1ZfNn8PLuk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_T~1.PNG
- Size 25KB
- SHA256 c2373d9474e3512b7f1a89390521a633116371044e52f621e8db8ddb26f21361
- MD5 3b91c31afbef7442b1bce06f3a0d67b3
- SHA1 784de555af6e05b030d840caedc70e1965bef51c
- SHA512 d67e59bc87239c7826caa0663f25780fe0897890a1a47a20fad0f6be01c9ede2d3e69fc4c5e32fa32c89f247eac2b38dcf2e008cea12feb8fd30ac54123a0f92
- SSDEEP 768:L2vjbXznacm09+f6PZB3DbCRavnRGbs5SD+ae:6vfH+6fDJvnRGbsK+ae
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\ICON_W~1.PNG
- Size 20KB
- SHA256 e1808b36b36a33fb10f0f07faba09d297e547750518c8720aea8485cfe4275e7
- MD5 d30ed7305b2a3aa7875385a296c4dc02
- SHA1 84635040b879249698d856e23fdfe7cee604951d
- SHA512 60ae03082e004f613ba202bce39de8cc518e0f9df451b33d2aff2ed4f3658c4cd16335c5c96eb977f8b711647c5a386d95dff96038255152b8d10f07324d3fe3
- SSDEEP 384:NbHPntI5yFy+MIReoGcJ42bEQWygxxHDMS6CEezrHWUmGW6G8/67a+VMl:ZHPnta4y+RVlOS8xDnE61QE67aVl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\PANEL_~1.PNG
- Size 1KB
- SHA256 466d9445dd01c767f5f9961d77d08bd8e8606a0fe51ee89e9f7a69b7380ffbb0
- MD5 f88242cea3780ffe68fafaa0ba901a40
- SHA1 c0a3ce608482a9a1550e0bec21b3398dce83be7c
- SHA512 7a16d831bd75d6c9343095d79e7f850de1ab30a0c562637442cdc88dcebee8e10f87633dfce2e8c3240f8fac66ae747eae5c8e372bf4dc7ea82ba891f12e80f8
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\images\skin1\PANEL_~2.PNG
- Size 1KB
- SHA256 5fadb82dfed95bc99e4401c5fb0e5e908d663c11392c706d958498aa512b8c27
- MD5 990976225ce30bb4e4cd63954596ae32
- SHA1 49c6b20404a23830552c3b0a79fde119f517d14a
- SHA512 80ce5b8b76aae5b01173852bfcc628092664d9086b16c071078297e3b0c6b592dc03a2a72540ac8b8e2ab8d7548b823f9facfd83f2d2e41db6072e0ca94e9913
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\images\skin1\PANEL_~3.PNG
- Size 2KB
- SHA256 92aac8fccf68f9a39e13508e71119be775476549fab7d35b5ddc7a53eb9fa805
- MD5 60c52b7c6a4d7500bdd0ef0925a3018e
- SHA1 df93d6911dd94ca1624a976d8e392f2e92c25da0
- SHA512 a72d0c7fb8601eaaaeac8d4e3519fed9ceeba78b6d9ecdd328dedd12f3756a4800d61406aa374f7c20fd2193d69bc45a0826340b1bb45f921159c7f51771e7f3
- MD5 SHA1 SHA512
- Path C:\PROGRA~2\DESKHA~1\images\skin1\icon_BMW.png
- Size 20KB
- SHA256 141eb72543773fea1aef80843af58c3ce0b5f0cde8c60d258221fc563de5b737
- MD5 f92b853784e5c025997d712839a5868f
- SHA1 cb0d8a41e82d3be185c449d770b73c304b2850bd
- SHA512 d24123f409ec527c828056ac65c058cc2aec9e7f279470facd4f2c1315250fc07e77ce7279c77eecede281a3cf09343ec0bb6016081ce2e6849a6d97e91bbe9f
- SSDEEP 384:oKyZ1v2gSj92vjfL9x9Uz9q3xGkuv9pxuUX9mgJXrzjCpYisS4ffC+B:oK61egS52Lhx97xnWvxukIUC2fnff7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\icon_qq.png
- Size 21KB
- SHA256 f2185bd21757f9e27a717de282be83ef539c6af711d37008bfe45b87fdf2da68
- MD5 63f4eb18ed0c35dc8966e2ad20735b35
- SHA1 20d6894106348acb493c64e6d82cf4e820455552
- SHA512 67154dd3b9c496072b72a97b715409e11ef0a50e02960777daa3046ff50708f5f105f19b214b53e2d67b455ad8bd5c1d8ed4720e27057ef882111f2fa153bc3a
- SSDEEP 384:c0wJSNe8MS0bTfgN/FulNjB+E2DcCU436xsZBI+iqJmBpUD6l2kPxEGppo96i0Tm:cvSfgbT4Hulx+d36mbkBpLQ6pDE6imI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\icon_web.png
- Size 29KB
- SHA256 200658fa921e954a5e94d694525489e2cc32531e62da7039e956ec1d040f88de
- MD5 31d0c8a43105187fca0905858a582e91
- SHA1 f7de43c74ad0ee9bbdf15d44927e58f608566e43
- SHA512 a1fa1420d78ae16da6460e3c3162bd8ec93a0e2ad4aa5c0b742e63cfc4e18a6aa6151a724ad4dab6be9907ec6671ca7aa7813969b8db96345cae274721be5e2b
- SSDEEP 768:i/O9wB7yXbznm2XHFpufneXXfLabrdhG+KCPgxGlQQ:iwbTmmineHfWbrdMLCPgg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\images\skin1\myie.png
- Size 23KB
- SHA256 9f975c26c66d63e556efa9ada757fe8b47897397ba4b86a5e1fe34d881a24089
- MD5 7a651d31e9954c547e31076755dd0605
- SHA1 d0fa5a27a51fc1c2b68cb9e4e3005c89710b5ab8
- SHA512 8acafea395a1aec8542b90f916a10aa28e1799d096651f49a2b5b000b2a26f31ffe04a6c77d667114544f7146e728bbb13f91bb767727c595c18a76fb2e558a3
- SSDEEP 384:550wOX8Ui5Xx+73TZWTFwEt3apIaBNCD8WWTvkITEbi/mTLuGPep9aICWi/cseJw:LYMU53ZWTFwjiamD8WEvkRQmTDPep9aZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\DESKHA~1\~GLH0004.TMP
- Size 427KB
- SHA256 92d0f9327368b22b6edcdaf0d15a54ca1920c8de027ec02421680dc0da03a951
- MD5 ca6e358297e8a5d8a8797b8a04434809
- SHA1 18216d0a39868f738a32bb9ee8fabbb4523423a5
- SHA512 ecf90036b162bea48d88c32dcc0eb1d9c2d1fd989d7d8bfc3acfdf90fd0673bb55fac2ebbe52c49fb4f0eb1761b0ec30b7c0866e4064cd22e0a465ed589b32ce
- SSDEEP 12288:POdPMfa9W3MTNDaPk0OKb0R9Np2dxCFLU3uJWr:GwNcNDIkVKwR9NeCFLU3uYr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\DeskHappy\dockbar.dll
- Size 344KB
- SHA256 ee1fc66c1742005d195fa2e5e3638cfbf11a68b9a32637c40e834ea5358bf37f
- MD5 ea1844874b1d74b6814e9f793f9c4232
- SHA1 fbb16b267a4aedb52896f8d04cc3149ff23e8322
- SHA512 2f5520606954faf370277d213865cf4ae87ce09e0b9cc51e46ef02aae8e93f8a6fbcc120530eb14df0dc2a2224b4a25dc1d3f27b1453689a544a53933138acb7
- SSDEEP 6144:PUMsbdPMfa9W3MG81NRha9FzkIQCgkGtJtSbyKb0RlaiDu1oRnN602rRxUjFO5s:POdPMfa9W3MTNDaPk0OKb0R9Np2dxCFl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLC4ECC.tmp
- Size 100KB
- SHA256 b8c69a48ef35b2c031772b85603a681a7bb2d83dd2342ecfd4b72b9342440d1e
- MD5 12d105727b656e8a98863178f7d1a054
- SHA1 d3af45b318d7ec472deb425d3a678422ef46290f
- SHA512 8a48ccfbe5c40bd69e8d1db2ce77ba7ba4194f2a1dbccc40955e335420c182d4f6a3d7a01bf07f82a808bae83c10a6bb44df0cef16c3d15a13f0bcd14bf1856c
- SSDEEP 1536:NrkEUFWvQUWE8eAr0/oCM42gho3p3SupBzB1Ao3I5akmSCboOb2QDye2RgPWw8j:5kgzCh4age/BKZ5akmUbe2Rm9y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLF54EB.tmp
- Size 10KB
- SHA256 166d7156142f3ee09fa69eb617dd22e4fd248aa80a1ac08767db6ad99a2705c1
- MD5 3b2e23d259394c701050486e642d14fa
- SHA1 4e9661c4ba84400146b80b905f46a0f7ef4d62eb
- SHA512 2b792296dffa4e43bc85295dc7691bd29762ce5d9d5eafaa74e199e6a8e5b24aa85d0a1b27776d4719a49b0d29abcf6f240746a209528e608b596b560e5a3b88
- SSDEEP 192:GHil+IWcS5ju90M1hfOENXfzZ7kX65caiPEJd3lBD:J+Dcz9fhtflYqcaiPEJB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLJ4EDC.tmp
- Size 2KB
- SHA256 49833d2820afb1d7409dfbd916480f2cdf5787d2e2d94166725beb9064922d5d
- MD5 6f608d264503796bebd7cd66b687be92
- SHA1 bb82145e86516859dae6d4b3bffb08c727b13c65
- SHA512 c14b7ec747357c232f9d958b44760e3a018df628291e87de52b8174ccc4ada546eba90a0e70172d1db54feca01b40cd3aeaa61b8a2b6f22d414baad1f62e8e54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\GLK50D1.tmp
- Size 33KB
- SHA256 d73170ea2688da5f6f37d4ca70b72dbc061abd47615269968563b5fcbd74dd9c
- MD5 07631941f67818659e0e97932224886f
- SHA1 a5fa37d427480b569fa858ec66cca2a85d35a40d
- SHA512 fbd217add3e1897281de80e2bd935b1251812744264fc5c9a77e88615c18d97a3c01d4f75165d80f3a067369b9e679500e836ec39fafc11d5a40b0054e83d510
- SSDEEP 384:8lB+vEr4Ry91G5GkrCiKY4WyWMmqnXIIKXMoCu+7/U:Hhy91G5GCCiK1mqXI1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.EXE
- Size 323KB
- SHA256 fa81588825a3665cf96233d9ea31674867af370abe02e06a275a734798b1b04e
- MD5 c791bc0d400254f12e7990026a2e63b8
- SHA1 bc4fba3dc7504664fbcf314a8e8c42d1cd05c4d9
- SHA512 f1ceb5d3aba0feb8b96f60afa7d55fe78cde1dd37da1ef874b26b0695901a20e75bc8c7b86f83ff52eb0a06ecad5b7d150699c6d46ddc68ba82b2de7d070fac4
- SSDEEP 6144:b4IlmIMLPkuWCgXmyaun7dLJwFnMKu70mBMm+k2oOPuq0riFz3RlUoj:ZlmhLR67AFMHBxPiPHuiFL3UY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.EXE
- Size 627KB
- SHA256 c1dc74de577903a73e0d432db64a2ee5e86bb2ae4cc8e55949b7753465fab7bf
- MD5 4739c9551aeb8d0f3f1b14ecfef1eb53
- SHA1 acd41a0105c83f98480bb619479d269ded0d2e30
- SHA512 8928ca83f13e641a51a298766b8b8a7d57adf740800ad3bcfbbfc9d7b0d3f7cfb1ae1e2d63bee8546a7f7a00f345cd07d5d17bd0b08178806b21e917bf518b0f
- SSDEEP 12288:ZlmhLR67AFMHBxPiPHuiFL3UU7QSrKw2S7XPwKoPlmlqlyK:ZkNcxP9i9kUJbrPCPElqlf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
- Size 160KB
- SHA256 dc73c623fe0fe0450d33d1375957f3b1e52788d8fb1f356de83b9acdc13795ba
- MD5 2000f02ae4c68647fcbf58ed6c5894ff
- SHA1 e61eba8f706f0058eb2b2f091830fd159a43caa9
- SHA512 6a1ab9a7e18197ff9e704be589e80074a4073776186d1f29df993cedc506bab5b0f9beb53a90e1269347b940792a896c17f90f53ae09cbb6dba27ed9458f66ca
- SSDEEP 3072:bsJ6EkjAxjemIMzvPkuWCgXIBplyYlun7dLJuMkFnCFkM5jEa:b4IlmIMLPkuWCgXmyaun7dLJwFnMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\safeDesk.dll
- Size 625KB
- SHA256 ac89888fce1b5479869663df253f8b1964a0a2f0e14c3cb6b7ef6868ce4941e9
- MD5 a36872004b6013084ccfb5f635a51555
- SHA1 3afd60eab12b148e2986fcbe538175fab5b15b2b
- SHA512 4fb3d9512c850b583f6c7e89866e6152cb89e8cebbf146b70633bea940068fba4b34f3a666845172ba3fb0e61c685ac1f9388bf0a16e2e9534831717290682d2
- SSDEEP 12288:YzV9jnY4JtcxvkIT3nBxKBqajUFG+ZBW+Zs2WmQXLz3RatxE6Z3e:s82cxvhT3nBxBajUUMBW+a2WmQ7zCO6Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\task32.bat
- Size 94B
- SHA256 8627bdd71fd98ae3a02bb367a2938041bdcdd22e520f835b6dfaab3fb9fa3c3b
- MD5 0f7af21cca1bbf2e856a81344dc39fcb
- SHA1 c048ea9c3eb84bbbdd7eb2ee994fc7b221c1e9f6
- SHA512 b0142652ad02026a9955912883442d0384c878ec6bea58e4ff6e17eadd53b2b486147b63c55ee35b7fe781c417a7756ba0422549916c866e4933f6e1aa032810
- MD5 SHA1 SHA512