baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
Size 1007KB
Sample240613-xche1asank
SHA256 baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9
MD5 b6b4b30b82e3cc4d31844b73d89ad496
SHA1 d295439b929266922024307c4503c3a824851ea2
SHA512 b56e6cd35f5f6c3271bc89b0f9649157cf704279b616e85ad85827175dc5936f669e5217dc4b4a41360c12fbe7940757e8a320e4b97ec65f529233e67a353943
SSDEEP 12288:K7+PZK9I7MNmnx6Fg7kbiKFtC+eHNXXuz8sxKp7hIxLBy8omtm0/jG8Dqc:K7SiL28btC+co3LBy8omo07G8Dqc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4788	Logo1_.exe
2000	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe
4788	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 2352	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	82
PID 972 wrote to memory of 2352	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	82
PID 972 wrote to memory of 2352	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	82
PID 972 wrote to memory of 4788	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	83
PID 972 wrote to memory of 4788	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	83
PID 972 wrote to memory of 4788	972	baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe	83
PID 4788 wrote to memory of 620	4788	Logo1_.exe	85
PID 4788 wrote to memory of 620	4788	Logo1_.exe	85
PID 4788 wrote to memory of 620	4788	Logo1_.exe	85
PID 620 wrote to memory of 2796	620	net.exe	87
PID 620 wrote to memory of 2796	620	net.exe	87
PID 620 wrote to memory of 2796	620	net.exe	87
PID 2352 wrote to memory of 2000	2352	cmd.exe	89
PID 2352 wrote to memory of 2000	2352	cmd.exe	89
PID 2352 wrote to memory of 2000	2352	cmd.exe	89
PID 4788 wrote to memory of 3404	4788	Logo1_.exe	56
PID 4788 wrote to memory of 3404	4788	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
  "C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4268.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
      "C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe"
      4⤵
      Executes dropped EXE
      PID:2000
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 1cfea775593e7ce2c698a171a33c7e21fb545e2c67ba6c47777d8e461ac8f1c4
MD5 412c84a84ee1f753aab61983dab81871
SHA1 3ff6d44a264e52f0bc0c644fe399ec99bf9ef013
SHA512 3c52c6534a62bf11eedc332810e04d8854392f546f33736cc88fdaaf9fba0744269bbfd4e75545c0b50f6d0556bb3b855df407bc54e6c5a54f4cbbe5f9b07dd9
SSDEEP 6144:oVfjmNugiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:S7+FitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 dc35631c1a06060be298409e2cf36395641714e2e7edf18de0fdf41794cbcf7e
MD5 ae4a0b79964b8785cfae2eb5fa11e34a
SHA1 5c14a9bc200fa19b4863aa8aed3e8356a3a5ae9d
SHA512 9e8e01d697d8c404894981ab54a602cb2d1d0c4ed75736382edff6b2c1260da9ffa692cc13790a63e775356976e39f699af226ce53e05bea94d285cb3d952fb5
SSDEEP 6144:gVfjmNHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:K7+k7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 7125735e4e8595f1c17ff3235bc65dacabc2ec874b29ac7ba8eddd80ad10b3c0
MD5 53ee62011469b286a2a1b5658c86b9bf
SHA1 9bdac0b23b0a965947c780c6a6b48fc7122f9ade
SHA512 c9c24e578da0a38048e71548fac66465bcb624e971f745bba559e8c49fd621752e718d4c983a90a97277407bb23348ca109436e1eeebef030c3b599c712ff236
SSDEEP 12288:vp7+k5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:x7B5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a4268.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4268.bat
Size 722B
SHA256 9c5277c6044ab4203d90b20dcf36220197bcf7828c245829b888f0cf47f31e04
MD5 645d6f0b64166a20914803773469f65d
SHA1 999a31422dff925f3d1277afc14d84fed4cea4f8
SHA512 4fa983bbe691a1f7be876b212e43af3e4457460931ee35cb4f1a897f7b60db8f42943a887667d7b0b7a7e554f184afd6574c116e9f18b244e36459aeb2b83f87
MD5 SHA1 SHA512

Submit Download

baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe.exe
Size 981KB
SHA256 e83b0a57520815815e5e2e1fb8014f5d340369a2252a1ff97ab67d099c9a4315
MD5 7f3528cd8c220c32eb5453c2e50c2435
SHA1 e7434bb57eec4bbfcb6375ee8c33d5d0a8a1d4e5
SHA512 b73aee0b78051f1b16535282bec757ce516d3a25d9af67cd358100663f352a9a571a6413846a46b96f3ac5b3137bfac418941c79e87ff7b58d41cdaa73051d6f
SSDEEP 12288:gZK9I7MNmnx6Fg7kbiKFtC+eHNXXuz8sxKp7hIxLBy8omtm0/jG8Dqc:ciL28btC+co3LBy8omo07G8Dqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 80da141e0ba00151479dedc491ae3a1d967e9e30f06b29a4eda22d6fd1ba03b6
MD5 f0eb54d6d17689ab4e229ce122317bbc
SHA1 93a5a82c43c6d4089ccccfc434985a9c3baa1dc4
SHA512 cd5c2bc37516daa390924b54f1108551437988303c4ce7aa33c2bb44418e78a7d68d129fa6769a3eae9fb7aa5281730e8282ab75c06a5cb63cc211f88a213f37
SSDEEP 768:J41ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:gfgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/972-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/972-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-1230-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-4796-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-5235-0x0000000000400000-0x0000000000434000-memory.dmp

Download