d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe
Size 2.2MB
Sample240613-xcs7hasanp
SHA256 d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242
MD5 c0ee066bc5a216173aa05376775358a5
SHA1 bc9eaed2ae330447895996b2c345fd92622c17e9
SHA512 6027046adf3ad949e18dc65f0faf22eee748e9b71028788d133fa89f2a97613e158ab0469bf201dc96d3dbec9d9093e6bcbb39a2ccf9fe6a0a2d28cd716731e7
SSDEEP 24576:37/44q6wihymF4+nZqyDst/ydLOyDaAO+JtPhYbcNeHtXvGJWiF7f9/QiCzUj:37/4V6+mF4+/DKrh+rfWtXvJ+/Qwj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5060	Logo1_.exe
2768	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MutableBackup\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe
File created	C:\Windows\Logo1_.exe	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2768	WerFault.exe	95

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4952	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	89
PID 5008 wrote to memory of 4952	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	89
PID 5008 wrote to memory of 4952	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	89
PID 5008 wrote to memory of 5060	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	90
PID 5008 wrote to memory of 5060	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	90
PID 5008 wrote to memory of 5060	5008	d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe	90
PID 5060 wrote to memory of 3032	5060	Logo1_.exe	92
PID 5060 wrote to memory of 3032	5060	Logo1_.exe	92
PID 5060 wrote to memory of 3032	5060	Logo1_.exe	92
PID 3032 wrote to memory of 4004	3032	net.exe	94
PID 3032 wrote to memory of 4004	3032	net.exe	94
PID 3032 wrote to memory of 4004	3032	net.exe	94
PID 4952 wrote to memory of 2768	4952	cmd.exe	95
PID 4952 wrote to memory of 2768	4952	cmd.exe	95
PID 4952 wrote to memory of 2768	4952	cmd.exe	95
PID 5060 wrote to memory of 3508	5060	Logo1_.exe	56
PID 5060 wrote to memory of 3508	5060	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe
  "C:\Users\Admin\AppData\Local\Temp\d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC46.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe
      "C:\Users\Admin\AppData\Local\Temp\d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe"
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 184
        5⤵
        Program crash
        
        PID:2752
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2768 -ip 2768
1⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 5dc4b2d6b1d33e6abdf260204f1c9ed517799e850eaaf3ed4871be38e1203a42
MD5 9e2f82a085e3726de31190aa4dbe28b5
SHA1 5fc4712e1f9b969fb204063b0f0a0417bb14dea8
SHA512 66d05f0b653f37ce019a08206bd42791f64da99f45df18172fc0aea99722fe8da82b3f8368c18d1eaef59e8a04a8777a0a38493f821fb755f9330b1693c51b45
SSDEEP 6144:wVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:a7+AitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 c68ea08ef78032f630e1387af5f6dbc5c0b205d922785fd39c02ccfc79a80c30
MD5 98098d7a9ba700ded603c9658b5e4fcc
SHA1 6cecc93cc98bc7a2cb940f371c850665bf75b883
SHA512 809c51e47b4743c69ce674056705dbbcdb320682b124a9db7aa83aee1443ec76902d55a912eea7ff1c57a36acab903115f124da8145bb896419e9399052b4570
SSDEEP 6144:BVfjmNCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:37+57a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
MD5 2500f702e2b9632127c14e4eaae5d424
SHA1 8726fef12958265214eeb58001c995629834b13a
SHA512 f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
SSDEEP 12288:Pp7+H5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:R7u5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$aDC46.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aDC46.bat
Size 722B
SHA256 a501454201f2592e07a7090227c99d397168317a838c1840d40f243d37e4ce18
MD5 a8b88ad8f67e34e7eddf6e6f666cda5d
SHA1 799772be658a873202a7942b74e23905ae647e2a
SHA512 f22927bf8fb2d10a48d09fac91f8a903429b770deb9ccedc72e67150e22ea3d5db56902f776a104effacdcc905c876f61000cac8706cb3d1432bb5185cb9d311
MD5 SHA1 SHA512

Submit Download

d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d455a1011bc6c9649c5b19c0844d0527d2a9114e3c13d9f549dff582dcce9242.exe.exe
Size 2.1MB
SHA256 4a6abfc44d987f6eaf67d67fce93f87c56dc80ec8a6486c775e8e91925b7ca5d
MD5 7c525f67655a15d0cc3b9efc5b6aa36a
SHA1 6da8db550dc66ea8b3af3b5481bbf371e299d9db
SHA512 91ed3dcf3387e0188c39e434fa6c4649a48a853b594b7ef4ffc3ec00dff7094403b8caaf9570f8037c35bee2f168f0fb0365f5fbf79ce192fcf2d156bdaef448
SSDEEP 24576:W44q6wihymF4+nZqyDst/ydLOyDaAO+JtPhYbcNeHtXvGJWiF7f9/QiCzUj:W4V6+mF4+/DKrh+rfWtXvJ+/Qwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 63b2baf83767d6b0742089b97e28685666ee0d056dc6d0a50561fca8400fc9ee
MD5 f6f9088a009b9ec60ae2ff543d3c3672
SHA1 b39efa01bfcd494db3ecd5248d1969718614fa1d
SHA512 13fe37e946f4939e93dd83f5713b49523917c91f6562f6038493f6a16c85b20ae3d288e916c4df9131871d2e62cadeb0d16c8b5341770c1f06a1d47a618bdee7
SSDEEP 768:wu1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:pfgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/5008-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5008-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-1237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-4972-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-5417-0x0000000000400000-0x0000000000434000-memory.dmp

Download