ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe
Size 226KB
Sample240613-1f571s1cmd
SHA256 ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41
MD5 e8d73bfe32acd0f0927ec9b73e58ab13
SHA1 dcf6dc27e7f6cc66c35c1233061e134a7b3d65ab
SHA512 bb24a2299d5466d085d96199860f3829dde449cc70ac5eaedbdc2a450dec57bbd2440da23b1c98e8578d72248f2677a89a4872b0e57abddd44b52251b46ba0d2
SSDEEP 6144:oVfjmN3wRNQ8idoAC7nNWrl8pZi2rrWXMn:S7+kidIjNol8Rzn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1552	Logo1_.exe
3956	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\reports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\125.0.2535.92\MicrosoftEdge_X64_125.0.2535.92.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\font\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe
File created	C:\Windows\Logo1_.exe	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe
1552	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1592	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	80
PID 1716 wrote to memory of 1592	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	80
PID 1716 wrote to memory of 1592	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	80
PID 1716 wrote to memory of 1552	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	81
PID 1716 wrote to memory of 1552	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	81
PID 1716 wrote to memory of 1552	1716	ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe	81
PID 1552 wrote to memory of 3376	1552	Logo1_.exe	82
PID 1552 wrote to memory of 3376	1552	Logo1_.exe	82
PID 1552 wrote to memory of 3376	1552	Logo1_.exe	82
PID 3376 wrote to memory of 3840	3376	net.exe	85
PID 3376 wrote to memory of 3840	3376	net.exe	85
PID 3376 wrote to memory of 3840	3376	net.exe	85
PID 1592 wrote to memory of 3956	1592	cmd.exe	87
PID 1592 wrote to memory of 3956	1592	cmd.exe	87
PID 1592 wrote to memory of 3956	1592	cmd.exe	87
PID 1552 wrote to memory of 3572	1552	Logo1_.exe	56
PID 1552 wrote to memory of 3572	1552	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3572
- C:\Users\Admin\AppData\Local\Temp\ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe
  "C:\Users\Admin\AppData\Local\Temp\ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B65.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe
      "C:\Users\Admin\AppData\Local\Temp\ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe"
      4⤵
      Executes dropped EXE
      PID:3956
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 df9930ae9e895cacacacbd59048935ac672fee1826cea9a597b0abe072ed3b63
MD5 0d6ad1b24ca7052f6c9f21d44f9a21de
SHA1 9bb3190b106c92cb1877b9fbea22e742ad0be58f
SHA512 35590215882a6cd5541c2d8cfa3e69d5bb7127ebc78db4ecddecbb814cb29575a7f98c9c45dd5b2091b509e4cec23c84fcd50f4d9888f9101aab4b20ecdd45f1
SSDEEP 6144:vVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:d7+AitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 b084041421f49aee5afd75923abf2d50c561ca7453b74e0ed9abec4116bfe15d
MD5 d5716a2fd6728c112ba39860fff281bb
SHA1 385dbe6aea6a7e9405fbefa8e90c0c41d71a1272
SHA512 7834882a6e5c5e35c3c21ee8d9fca5dd257e609813479a61a03eb32718b26c9ff25414cca01ce034d5b37f6ac77b482c851f4fa33dbe8576e316130657babd61
SSDEEP 6144:oVfjmNCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:S7+57a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
MD5 2500f702e2b9632127c14e4eaae5d424
SHA1 8726fef12958265214eeb58001c995629834b13a
SHA512 f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
SSDEEP 12288:Pp7+H5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:R7u5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a9B65.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9B65.bat
Size 722B
SHA256 7900aa20aef66f4da87fdbbf58e1f391b131cfa835fbd9ed101d975fdaafe56b
MD5 542782535d2f8b6ea0e1d7d18a97caf3
SHA1 84767e2bb65bbb2158db478c5ad2cbc5b665fd90
SHA512 94b36cc251d87719376f1ef9009e9f581d4ce3e0bf7a5260bc7a9d531e2476a28b95d6613e15fd6aadf058e716c37755681d750bbb3d06c408eae32971e0fa2a
MD5 SHA1 SHA512

Submit Download

ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ebe54a08cc975eeb9408b69b501dd253743cf732efad541ae5493514b30c6e41.exe.exe
Size 199KB
SHA256 a8ec686fbd61845209ce499023b22a1acea6647e9d6df79b8f38b629c536eee4
MD5 f0274b1f795e7f425a180fb210ab2b6f
SHA1 3e68f30c6442a917dfd03a64599b2d5f40eddfd9
SHA512 fe40b8e7ba3e3e8eb4dcdb490fc9a4bb12e9501b88b011bebc620d1a3d525cce9e0f33dae23c193435a2772aa59325e84dc8fe87c8e8c96a13a7e52df1c818a5
SSDEEP 3072:AuwRNQ8iG9HioN65g7nNWrhvZUQC2mC56iApZyCNibCrWM6+EizprywErtTxPxWn:TwRNQ8idoAC7nNWrl8pZi2rrWXMn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 84b31bdb07009d59793fc0b90ca7daa73de538af5cd6305e86e46a2ff12fa5c8
MD5 cca245d9028cc16de78674180260620d
SHA1 6f697e0c9a56e45cfc867959caaf0022c7d8998a
SHA512 e9f1add9837338613ab3e7decb2d9431bfa8e3ca62086abdfe49701f2877d02206996d72914bb004d0292b7091a5415bdc9d8c7c6cbea8d679e67760fe5a015b
SSDEEP 768:+1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:YfgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-200405930-3877336739-3533750831-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/1552-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-1238-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-4966-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1552-5405-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1716-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1716-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download