04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca

Analysis

max time kernel
149s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
Size 64KB
Sample240525-ax2m2sgf93
SHA256 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca
MD5 648d6dc6ebff924db713bc75e30249de
SHA1 875be1687f0280f9284c3fcd60c2a7be5d2692ef
SHA512 3af59397a2e556ca08afd453a632e2cfea71210caa3c1cf65e2a6a8f898353de87afb9e4248b956cca6cc6b62bd94cba72d5c5e0a93bdc621ebf6524981c3eff
SSDEEP 1536:Kz3SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:akF3pxrBkfkT5xHzD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2596	Logo1_.exe
4356	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\css\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
File created	C:\Windows\Logo1_.exe	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1160	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	82
PID 2360 wrote to memory of 1160	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	82
PID 2360 wrote to memory of 1160	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	82
PID 2360 wrote to memory of 2596	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	83
PID 2360 wrote to memory of 2596	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	83
PID 2360 wrote to memory of 2596	2360	04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe	83
PID 2596 wrote to memory of 2076	2596	Logo1_.exe	84
PID 2596 wrote to memory of 2076	2596	Logo1_.exe	84
PID 2596 wrote to memory of 2076	2596	Logo1_.exe	84
PID 2076 wrote to memory of 3276	2076	net.exe	87
PID 2076 wrote to memory of 3276	2076	net.exe	87
PID 2076 wrote to memory of 3276	2076	net.exe	87
PID 1160 wrote to memory of 4356	1160	cmd.exe	88
PID 1160 wrote to memory of 4356	1160	cmd.exe	88
PID 2596 wrote to memory of 3536	2596	Logo1_.exe	56
PID 2596 wrote to memory of 3536	2596	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3536
- C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
  "C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a325A.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
      "C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"
      4⤵
      Executes dropped EXE
      PID:4356
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 252KB
SHA256 3a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c
MD5 6735a16d04dfac1f92f7ab89c64b071f
SHA1 502eaa755229fc80b186faf533cf827c322bab66
SHA512 bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8
SSDEEP 6144:OFpOgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:oplitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 571KB
SHA256 03078980fff7ce8873b7e46fd8b79c2a86bb0354fc65268eac2aeff6d981e73e
MD5 bab747a805ee67f925718f2624d54a11
SHA1 3f6fa0fe958f3a43e38c66014443e0c261f46bcc
SHA512 65edbfebdfdf27c496f596bac45f63cd4834dbfb171bd2683a15a3d207b489ee65a045a0b78729005b457f551f128f444fba45baa63c8fe8748f422f48431c14
SSDEEP 6144:PFpnE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:tpE7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 637KB
SHA256 a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19
MD5 9cba1e86016b20490fff38fb45ff4963
SHA1 378720d36869d50d06e9ffeef87488fbc2a8c8f7
SHA512 2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765
SSDEEP 12288:LxpE5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:FpE5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a325A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a325A.bat
Size 722B
SHA256 47b4796252f70fb4153bb74cb83e537a56f61d473c3e7aca4c2e9d7fc0500e4b
MD5 413cdb88a1f093f464bbe09af1fa4743
SHA1 3bd7d598b6dc44768363e0d13ce48c3a971b3365
SHA512 27053984f2d254d5b6a35fbb58916e30451c86c0446714f3c7044ef68ff8ead3c46d7f14f6f7d9bd443805643a72be4894feddadf22d4880af8ee924d2fb7fc7
MD5 SHA1 SHA512

Submit Download

04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe.exe
Size 36KB
SHA256 8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
MD5 9f498971cbe636662f3d210747d619e1
SHA1 44b8e2732fa1e2f204fc70eaa1cb406616250085
SHA512 b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
SSDEEP 768:CNic1iTEpgSG9TJVQBWZrvW5TNDWfKgUkKtzYiguHAMxkEZ2e:mriw+d9bHrkT5gUHz7FxtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 27KB
SHA256 623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf
MD5 2b90d375fad4e39663e1c00356e9206b
SHA1 5c84c40605f4af4185647e0a68aafed0ebbdc393
SHA512 7c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f
SSDEEP 384:MVNaq11Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:K116GVRu1yK9fMFLKaTxsujCT7pZpY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3906287020-2915474608-1755617787-1000\_desktop.ini
Size 9B
SHA256 da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45
MD5 7619ead719f9163af9f64f79eeff7c36
SHA1 7b956c82fba1f4a0ea8b09ca2e39d89159e21b75
SHA512 29dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df
MD5 SHA1 SHA512

Submit Download

memory/2360-12-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2360-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-1231-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-20-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-4797-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2596-5236-0x0000000000400000-0x0000000000435000-memory.dmp

Download