ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe
Size 1.1MB
Sample240530-bnemlaaa94
SHA256 ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec
MD5 07e2fd2f7bf9aadf8849f7e3b9ce4490
SHA1 d9ef2870046d337b4b3c139b0d75b14dd4c0cca9
SHA512 083db549b5adc15e66157ff1f7820afb7486b8f4a84fe015f288a2350ad9891365940f17dd3187b2b6eca9a3c030a6415b90f031fecf0a9610f5992c0b63d6cb
SSDEEP 24576:a71uJmqiy9WWgdJKAJjCtG1j6/Ql55yinxSj:a71qiyXgdZJjWG1m4l55NK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1468	Logo1_.exe
2156	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe
File created	C:\Windows\Logo1_.exe	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe
1468	Logo1_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3060	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	84
PID 824 wrote to memory of 3060	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	84
PID 824 wrote to memory of 3060	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	84
PID 824 wrote to memory of 1468	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	85
PID 824 wrote to memory of 1468	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	85
PID 824 wrote to memory of 1468	824	ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe	85
PID 1468 wrote to memory of 1260	1468	Logo1_.exe	86
PID 1468 wrote to memory of 1260	1468	Logo1_.exe	86
PID 1468 wrote to memory of 1260	1468	Logo1_.exe	86
PID 1260 wrote to memory of 3116	1260	net.exe	89
PID 1260 wrote to memory of 3116	1260	net.exe	89
PID 1260 wrote to memory of 3116	1260	net.exe	89
PID 1468 wrote to memory of 3500	1468	Logo1_.exe	56
PID 1468 wrote to memory of 3500	1468	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe
  "C:\Users\Admin\AppData\Local\Temp\ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418D.bat
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe
      "C:\Users\Admin\AppData\Local\Temp\ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe"
      4⤵
      Executes dropped EXE
      PID:2156
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 052524488f71bf143183bbf817657f609e226b2830071e8dea7fcede4c0ec052
MD5 548ddcade423bdb543717d8073ac88d5
SHA1 0210f769b1b16ae5e569e65e20fafbd12f2d0e04
SHA512 8576336e7eb0b1132dc5c4eef772ba5f9b57844173f17d9c5cf1fbb09afa443313a1675fcd03e028c592ecc59d0f52ea44529c58f721ccfc2bc958ae292bb0b0
SSDEEP 6144:wVfjmNugiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:a7+FitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 514daca39828d42cfdbb9bd266895407710979b10cc7eb8d792a7721d2b6cab8
MD5 a25ee3592c8e217cde1b3017a57c80c9
SHA1 635e8cedf6e233206d6f261cd70723f2fd06b0c5
SHA512 457b88f8d4390db5c6212733dcb9aacf0d98862652be4e8e8cc92706eaefe8c0ccbb7b1eaaa7d2b56274978f151f92a14ae6c0de8d2289d1070644d9aa819510
SSDEEP 6144:wVfjmNHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:a7+k7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 7125735e4e8595f1c17ff3235bc65dacabc2ec874b29ac7ba8eddd80ad10b3c0
MD5 53ee62011469b286a2a1b5658c86b9bf
SHA1 9bdac0b23b0a965947c780c6a6b48fc7122f9ade
SHA512 c9c24e578da0a38048e71548fac66465bcb624e971f745bba559e8c49fd621752e718d4c983a90a97277407bb23348ca109436e1eeebef030c3b599c712ff236
SSDEEP 12288:vp7+k5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:x7B5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a418D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a418D.bat
Size 722B
SHA256 c760a213157e2e09e02870cce5a9d262b1f431b316e7db379ec4f3e992b03627
MD5 06b29c62f0b1cdeba901eff3561f664c
SHA1 f3f3835d9d6527937d32bb8cf1a76fe719b7ef1a
SHA512 71b8352ea53ff9f0f579e156ac25397a784a5f377ba23982c5beed772b33d2d12acdf9c28c95fb7bc7540e252ca5c489bf3a8fdf46192676ce2835c615562140
MD5 SHA1 SHA512

Submit Download

ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ee4eb6cdae38dd6c0d3d1c9641aeeddde81a6379c62bff163f31c8bba46777ec.exe.exe
Size 1.0MB
SHA256 41efdd1d6119a45e327e66a7be188d6957ce1c5c0cd55023e1edb16c8975b190
MD5 cececf542dbb4d973ef7db4a67766443
SHA1 51dad032de6fa604c4591d7e25f1db5dc6705782
SHA512 32ecc50e291332805c775183795b7f0af9c8c7126c7b0cf358cc1853e11957e9417b502f94f13e539dd7ee46c3918ce2ac4b19c36ab16bfc17e6c04e471b08db
SSDEEP 24576:juJmqiy9WWgdJKAJjCtG1j6/Ql55yinxSj:jqiyXgdZJjWG1m4l55NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5d2e80c8e42ad3cf43ca754fb4597753ec8d80fc7d027e11f43536dd2f88d39e
MD5 bf432bacde0b936f7fd20c466ec0bfc9
SHA1 aff70b2cb9c409e3b63e7fc33f132441edad86db
SHA512 c134428f8da55038acf63eaae12357060574e2f062befc57c6a69c6833ab10a4eb08c6f36cd6433de1538f2b5b09ef8bb74acb8235856a5aac024914165c1a1a
SSDEEP 768:21ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:wfgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4018855536-2201274732-320770143-1000\_desktop.ini
Size 9B
SHA256 f9ab49edf14c6bda17287f7caa63d3b3bb20a65215f1462cf05577a5c1c472e6
MD5 588b2065b2adfd8dfd688104d02aad5a
SHA1 263f0ca294d728a13f51220aea8123aa257cc6e2
SHA512 99106035ac4547c81fd737f5f79ddd32ea10fde9e3ea97102472c871aa9f94ee3f68823bcc4bb308e92265a9c3cacd4b1f5c9f52f8d3e630cdf6bdcd3c737e2d
MD5 SHA1 SHA512

Submit Download

memory/824-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/824-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-72-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-1232-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-4797-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-5236-0x0000000000400000-0x0000000000434000-memory.dmp

Download