7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8

Analysis

max time kernel
149s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
Size 1005KB
Sample240613-xa15bssall
SHA256 7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8
MD5 a1dc90505c9d869087132b336c0b3075
SHA1 c72a157aefeed2ea80f677feeef2282bf1f250c0
SHA512 3f62f311ab4de610a1cabc1ab79f4e036aff0d4a0572714bd99502f74087821f59c8b7a0835132030b3315f96bbb87d6cb08b2f47899a8762679f1b331284ab3
SSDEEP 12288:I7+NaSzdoftq+1SwT4wo10kXMF7i9nvu+jVrSJZoOJKzZ2e8LJaRji3:I7NSufY+1SwT/oWDFmO+6I2RLcji3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6116	Logo1_.exe
1948	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
File created	C:\Windows\Logo1_.exe	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
1948	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
1948	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe
6116	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4828	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	81
PID 432 wrote to memory of 4828	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	81
PID 432 wrote to memory of 4828	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	81
PID 432 wrote to memory of 6116	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	82
PID 432 wrote to memory of 6116	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	82
PID 432 wrote to memory of 6116	432	7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe	82
PID 6116 wrote to memory of 3588	6116	Logo1_.exe	84
PID 6116 wrote to memory of 3588	6116	Logo1_.exe	84
PID 6116 wrote to memory of 3588	6116	Logo1_.exe	84
PID 3588 wrote to memory of 2424	3588	net.exe	86
PID 3588 wrote to memory of 2424	3588	net.exe	86
PID 3588 wrote to memory of 2424	3588	net.exe	86
PID 4828 wrote to memory of 1948	4828	cmd.exe	87
PID 4828 wrote to memory of 1948	4828	cmd.exe	87
PID 4828 wrote to memory of 1948	4828	cmd.exe	87
PID 6116 wrote to memory of 3384	6116	Logo1_.exe	56
PID 6116 wrote to memory of 3384	6116	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
  "C:\Users\Admin\AppData\Local\Temp\7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42B6.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe
      "C:\Users\Admin\AppData\Local\Temp\7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1948
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 0dd2c7e46111886d4a4bd8a15bff1e4732b178368948cd49a3e1e7680199134a
MD5 c1d291b5366737574f473ba46e56660f
SHA1 09d223aa0532a4292c18beb4a8a03a76fad57163
SHA512 cbb8f6a5abf4542b422978e0d304d7115758b2c558901c17abf9e7c5c10862404ced8231d15f682010e9e94e86961725d8427a8643abf36eeced9e2869e0ca98
SSDEEP 6144:qVfjmNwgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:k7+LitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 f27d8f466b189d2afa6cff29545bb619af43d2fb76b0bd4452b33863e2319dd3
MD5 bf01cf76fa4f0c08784a05b290a79189
SHA1 16c398f685f65b3dcac8753b3e69190554014226
SHA512 82bd270de0f84e3654691c9d75450e835b2515164f801923d2eec95f96be7190f504cf73138a1923e52606a5ddeaeb6c3dbb8c99fc9246cf893d71a8ac0e3f6b
SSDEEP 6144:mVfjmNJE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:I7+q7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 200d8896a4cf3d442567696ff425b2aeca8b87428173337c4f5b9022ae0d6ab0
MD5 7c0581e2c34a99e0e6b7b63deb7540d8
SHA1 2ad688b178321284f2eab56ad02ef1d32e7ea46f
SHA512 4e65033131dd98ef1eb39d5da1c3a92b8d4c3ca083edb3db7bf9f555e57285f9f5c63bdc4d24cc5aa63312edd216ebc74c0a7f74ed38783e27998a2c013a496e
SSDEEP 12288:Bp7+S5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:H7P5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a42B6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a42B6.bat
Size 722B
SHA256 bc84e291045c8228b41196bcdad98d9c01054b4f2a996473435c0cc3529236a4
MD5 cb90982b87426f960faa35d74f6f0169
SHA1 d9280423e40acc97f4aee3bedf453a8e876cd962
SHA512 58a403a0be4d0c80798dfbdfaa55273b51c2409c6cd4c69e770ec926e0886677823455e623429dd52795229e4f7428bf21e50f48c9faa403d426118cf91f1b37
MD5 SHA1 SHA512

Submit Download

7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\7d7097bd956c27cba8ba548fd77fa3779c38094126c3b7227efc68fe136069e8.exe.exe
Size 979KB
SHA256 b24968c89c03caf8e152fdb17e8862a908acdda18d405baff997abbd625604c2
MD5 04b8010132ec0d9c9cf11ae6e0121cb3
SHA1 961e1cbeeda62ae9d4b2d0d25beef5a1057a123e
SHA512 548de1af065bc85bba1e126959df0e8527f4f4bc6f17ca4cc513abf05e726cb77d7c886d18c73792b725de7d6d3e4ef4da73d005ee5f8aca3c8aa44210bd43c9
SSDEEP 12288:WaSzdoftq+1SwT4wo10kXMF7i9nvu+jVrSJZoOJKzZ2e8LJaRji3:pSufY+1SwT/oWDFmO+6I2RLcji3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 3220d8589518b9e1c902a8e428c6797aeb13c9be4beb5171c1581d94e03a49c4
MD5 4ec1da0db5186cd6441fbebdbe7b4bcc
SHA1 90d1cf8d9fffe111f1ee8f7c7867416885a8b23a
SHA512 d4ecf6d63b4daedda8a09f4aca23101927aac422bc76180df1378a6763cd2348f763c1e0847fca3d3c68d2f93c9aba7d628317369a7e3b590ff6d66d443674b8
SSDEEP 768:8x1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:8nfgLdQAQfcfymNG+Kx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/432-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/432-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-1231-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-4797-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6116-5236-0x0000000000400000-0x0000000000434000-memory.dmp

Download