8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe
Size 4.1MB
Sample240613-b3bjgszbpg
SHA256 8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b
MD5 253bdbbcd81ae64bc61753b538e26d14
SHA1 bebf7dace7ae572aa16c10612c53ec2487d84808
SHA512 d3f9980ebd1ca665a671ae7cc926deb91c1f98769a0933aa70001c025f17f7f52f8ee248b1ff685ecb4e6c9b055c43baa9b7976bebdced2437cb43323d28d410
SSDEEP 49152:p7HNxhDlqnWbXnwLqGZLlLHH5c5QLTfBnuglmolVd:BNFDTGZ3XHl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2416	Logo1_.exe
4232	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe
File created	C:\Windows\Logo1_.exe	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe
2416	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1456	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	89
PID 932 wrote to memory of 1456	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	89
PID 932 wrote to memory of 1456	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	89
PID 932 wrote to memory of 2416	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	90
PID 932 wrote to memory of 2416	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	90
PID 932 wrote to memory of 2416	932	8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe	90
PID 2416 wrote to memory of 228	2416	Logo1_.exe	91
PID 2416 wrote to memory of 228	2416	Logo1_.exe	91
PID 2416 wrote to memory of 228	2416	Logo1_.exe	91
PID 228 wrote to memory of 552	228	net.exe	93
PID 228 wrote to memory of 552	228	net.exe	93
PID 228 wrote to memory of 552	228	net.exe	93
PID 1456 wrote to memory of 4232	1456	cmd.exe	95
PID 1456 wrote to memory of 4232	1456	cmd.exe	95
PID 2416 wrote to memory of 3448	2416	Logo1_.exe	56
PID 2416 wrote to memory of 3448	2416	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe
  "C:\Users\Admin\AppData\Local\Temp\8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2BF.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe
      "C:\Users\Admin\AppData\Local\Temp\8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe"
      4⤵
      Executes dropped EXE
      PID:4232
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=280 /prefetch:8
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 f7d095c63ade32f4ba12501fb85ffb9f959d83c1e47076f2a05892339735715d
MD5 ea3e7a80029fb4b8eaf381d61f94eb7e
SHA1 542cffe191c68dba2679f9e167d3f1e2c96a06f3
SHA512 0ee9e7288ea1fb905f14cf4983f1f591409ec671bef6f45b134aea0bdd8b0ba62251c77aa401a049b172b269cb442aa21fd4ae66730d137609e95e580d6a52bd
SSDEEP 6144:aVfjmNwgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:U7+LitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 092a833945f414a5d27612b0c5e7ee7ba4e5f2f990d77fd6c02fc1a2800438e9
MD5 fe9a9d039e0e14684811f12824003b14
SHA1 bbf335b2c7cd937c0e9904345ab06f1dee36f256
SHA512 0349d2c63837ab07474981bb3348aa8c927c322cf70182c3719ebab663a3604a8293de385bb419f8af0783c2ce4b54028de93b833b6df8a551fbf9d35312ccc4
SSDEEP 6144:TVfjmNJE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:p7+q7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 200d8896a4cf3d442567696ff425b2aeca8b87428173337c4f5b9022ae0d6ab0
MD5 7c0581e2c34a99e0e6b7b63deb7540d8
SHA1 2ad688b178321284f2eab56ad02ef1d32e7ea46f
SHA512 4e65033131dd98ef1eb39d5da1c3a92b8d4c3ca083edb3db7bf9f555e57285f9f5c63bdc4d24cc5aa63312edd216ebc74c0a7f74ed38783e27998a2c013a496e
SSDEEP 12288:Bp7+S5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:H7P5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$aE2BF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE2BF.bat
Size 722B
SHA256 7cdccf97ab5770280975f31b4345631abd67fe6dfcac1918ad24359292870c82
MD5 9add594aa395da6bdbc5ac70af55e6e9
SHA1 8982c78df02c30e745361a0c2226a6fd137b4cfa
SHA512 d8460d11c2a6b532a29ba2e187edb859eccd68323e7b47a269086c03bfa599ce1f1ce0de8afac194420072e5b703f4c7fb9924f05992b739d99fecdb9ed5f2da
MD5 SHA1 SHA512

Submit Download

8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\8da8d4749b7fc94828d81289ee8bd6277d3b892e530d2e4021dfc2f72e63605b.exe.exe
Size 4.1MB
SHA256 11842ca2705691a8bf75c33f355164a35a0a40ce1a16739123d3107f802a75a5
MD5 526ef8cb11436e1bae29d57829016511
SHA1 aa5164d75b303f13502de85b00b89354824e6771
SHA512 6c113f1b165f97c08f5e51e010a57185b4eb04aa294ef3000207ef3474f8f49e35dfa4a06438b199b6412b6bdbc364e6bb608a3cdc4dc73ecd93f9247187aa42
SSDEEP 49152:rNxhDlqnWbXnwLqGZLlLHH5c5QLTfBnuglmolVd:rNFDTGZ3XHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 23ffb3cc8727b16073e7944e36eabbf7b087f6923c78e88ed92c08b13af48671
MD5 feb8473549216daa0adec2e3945a3db8
SHA1 a0366043f5537172b5cc605afe339c28dce37d16
SHA512 090cbae5bd60f40cc983cd6abd52af8ac083705e80fd08e676c72feff826844785f4d2e76c2a40bd85df0097eac64d4bf9fe008108051c2218cccfb6abd50848
SSDEEP 768:l1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:DfgLdQAQfcfymNG+Kx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/932-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/932-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-1237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-4875-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2416-5320-0x0000000000400000-0x0000000000434000-memory.dmp

Download