0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe
Size 70KB
Sample240516-19acfabc99
SHA256 0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a
MD5 89c15cfade778755ddd0c6b356372247
SHA1 2a225641e1f18bc2239bc28b4eafd1ef2bcb5bf9
SHA512 67c7253e9fbb445898a7bab897740b3563dbb1cba79f30c362fa00fcc1fe02884d047ad43c8a188d26aa0ce3629d4f8719d26e23208590c0b24393f4714c1ba3
SSDEEP 1536:pET3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pETkuJVLtlZQKbgZi1St7xQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3040	Logo1_.exe
1672	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe
File created	C:\Windows\Logo1_.exe	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe
3040	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3380	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	84
PID 4580 wrote to memory of 3380	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	84
PID 4580 wrote to memory of 3380	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	84
PID 4580 wrote to memory of 3040	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	85
PID 4580 wrote to memory of 3040	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	85
PID 4580 wrote to memory of 3040	4580	0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe	85
PID 3040 wrote to memory of 3840	3040	Logo1_.exe	87
PID 3040 wrote to memory of 3840	3040	Logo1_.exe	87
PID 3040 wrote to memory of 3840	3040	Logo1_.exe	87
PID 3380 wrote to memory of 1672	3380	cmd.exe	89
PID 3380 wrote to memory of 1672	3380	cmd.exe	89
PID 3840 wrote to memory of 2088	3840	net.exe	90
PID 3840 wrote to memory of 2088	3840	net.exe	90
PID 3840 wrote to memory of 2088	3840	net.exe	90
PID 3040 wrote to memory of 3420	3040	Logo1_.exe	56
PID 3040 wrote to memory of 3420	3040	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe
  "C:\Users\Admin\AppData\Local\Temp\0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CC8.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe
      "C:\Users\Admin\AppData\Local\Temp\0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe"
      4⤵
      Executes dropped EXE
      PID:1672
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3840
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 254KB
SHA256 1a9800ef19a0e719342a70465145b0a12816db2b8b32116429619a9019067bd9
MD5 ab2bc3245b8ded2cbcf29ca0ce282ab3
SHA1 9724318e155b1a2a0a1dadd0742839bc224184a3
SHA512 8e678a9b8e548ce1782a67609352f8c1c45914e229f4d556b111491552e6fcae5231d73fec1067d28f2ebf24dce92b122b2f25e8cc3723e7d8a9bd0fa5406332
SSDEEP 6144:2IuJQgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:8itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 573KB
SHA256 85114418346f8ba7f530dc43b02d4e74637f3071174df9c7404013051d501d54
MD5 5166f0ec8a7caada8f473c25af33b415
SHA1 e8b86daca4202aeefddfeb67fd74e5b6bbaf7d3b
SHA512 37e1b97f68cc4c6ca67c768a7d30475609f1d07098e1939a9a85c48f12df51c9929549cb1b4e5f84b5702e68af44a9958962707f8a5b267110bee62c10774e4c
SSDEEP 6144:yIuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:57a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 639KB
SHA256 a3752dc6d1984857f3fa949c4ce20b2847d009f865216f4c7e31d3f01183938c
MD5 9fdceacc59188df6bcccdf4c6987820a
SHA1 f492a0cb2db22317746eb136e56621e5801c97ab
SHA512 3c81e2d7915868a2e88a97fbdf67d5fae8924f52ae497598333607367e642630c3b4c6085a3b8110814d997a9a13c341b2c5c5d336951484b3cbaa68479ad5c9
SSDEEP 12288:wV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:65mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a4CC8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4CC8.bat
Size 722B
SHA256 c5737b475c561ebf2c88da3f901a3a4d95e174a20baaa2222c10aa4bb3a8f336
MD5 4f7222a09a3747527eeddbd80937d0df
SHA1 b05726ff1b783260ab62c4889b9c27b6f4c4e632
SHA512 840fa5b568ff9ee89814425ec13529d75003a0b4994abb6fbf6644bbb9296a007f34be7ec3d03a46119691ad3830b5e1541e9c7fb6f32a1285661cafb451f244
MD5 SHA1 SHA512

Submit Download

0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\0535de336a56f1c650d95e840da551a9b4e08c4a844e36eacd5faa30b51f5d3a.exe.exe
Size 41KB
SHA256 cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
MD5 977e405c109268909fd24a94cc23d4f0
SHA1 af5d032c2b6caa2164cf298e95b09060665c4188
SHA512 12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
SSDEEP 768:w3V/q1Boa9cUlxLcbdVOm4KbwFIKZi1dstYiI09/yOPxWETQN:SEToa9D4ZQKbgZi1dst7x9PxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 af33160256ea22b90581f34e1b5a55a81a8d54cab79d723baa332f501c2af352
MD5 20f1537d98accc7c5de5541927f4f69c
SHA1 e4bfd9f7aef043c6cac1acddbf73da619ce273d8
SHA512 8cfb7637f629d7fee135c2e5ff9d07701fe6b65fadbc1d4c64d911b69995fcb8232b57b806779d026e61f9dea9cae15b5e6b097998ce6c00ba08dfaed4f58f7a
SSDEEP 384:NbbptbjIC4wCH1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pzIV16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini
Size 9B
SHA256 45605309f8a26f9e34e70105dc559ece3beb6a94191dac7a283006ee1b28cdd4
MD5 2ad1cb1515f262f45587e55b31b58122
SHA1 246e88d90613a860d6ea2e28fcf09ea5e5a76b1c
SHA512 7e3b6c7ea75bc7a9e827de72d51cd6632e5ffefd5d549b97e923155889c6c4dc3754e60bd81d7df74e5f7dfbeaf5d1e7dff34cb84383cdab77c3980a446945a4
MD5 SHA1 SHA512

Submit Download

memory/3040-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-1143-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-1232-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-4797-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3040-5236-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4580-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download