ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe
Size 66KB
Sample240613-ybhj2ssfpl
SHA256 ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c
MD5 89c1cf759c1474b53a548c853da54d45
SHA1 76a4c7488c6b85a7c5b99946acc59a99d19f354e
SHA512 ae9e1d290b351311e1d7618bffb042ff475cc0cb9f0dfb2c0fb3f128e0ded98c66294c24609f0593c7e3ef2701be7e882947f8b34732df796ae99cda0b910819
SSDEEP 1536:p9rH3SHuJV9NBriw+d9bHrkT5gUHz7FxtJ:pRkuJVLBrBkfkT5xHzD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3260	Logo1_.exe
3516	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\gl-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\cs-CZ\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-us\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe
File created	C:\Windows\Logo1_.exe	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe
3260	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3420	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	82
PID 4816 wrote to memory of 3420	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	82
PID 4816 wrote to memory of 3420	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	82
PID 4816 wrote to memory of 3260	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	83
PID 4816 wrote to memory of 3260	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	83
PID 4816 wrote to memory of 3260	4816	ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe	83
PID 3260 wrote to memory of 3568	3260	Logo1_.exe	84
PID 3260 wrote to memory of 3568	3260	Logo1_.exe	84
PID 3260 wrote to memory of 3568	3260	Logo1_.exe	84
PID 3568 wrote to memory of 4808	3568	net.exe	86
PID 3568 wrote to memory of 4808	3568	net.exe	86
PID 3568 wrote to memory of 4808	3568	net.exe	86
PID 3420 wrote to memory of 3516	3420	cmd.exe	88
PID 3420 wrote to memory of 3516	3420	cmd.exe	88
PID 3260 wrote to memory of 3412	3260	Logo1_.exe	56
PID 3260 wrote to memory of 3412	3260	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe
  "C:\Users\Admin\AppData\Local\Temp\ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63CB.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe
      "C:\Users\Admin\AppData\Local\Temp\ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe"
      4⤵
      Executes dropped EXE
      PID:3516
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 254KB
SHA256 86cfebefaf5ede042543c8a48550b01fe7ef3b6b7812000c3888319ae9dc3d2f
MD5 432aa5b6bcd692caa88869c8bdc43681
SHA1 aeb7c43781d43851f7f127b4e5adc46f743d1b14
SHA512 4f160f737ac1f8a879bbcfffc37d499ed1e26cd21f7798cc8cc430b2d0c3fa83f6f30d1c5ddc6010523c32f9a81e8756a5c723b880e61f63135f4d42b79c9058
SSDEEP 6144:muJQgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:XitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 573KB
SHA256 ee272f52273d86c5612ac01738c5dbf9467aa805560258e77c1de59bc9bebfca
MD5 451d320c4693c75e5440cb4d9c47a77f
SHA1 eb33d16b45402ffab95c3735479cd3070892e03f
SHA512 93cbaba8c9793e66a210b0c4f1f788b15d011b8170feee09275ec5cfd22b972999186d1172ccbc0ddb448c1a563cd3d289f17fc8fb665932d3db5477234aa33f
SSDEEP 6144:guJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:07a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 639KB
SHA256 63d148b4110e4050b82cacdb7be0a004eba84c33c971f56873998ec59ac354fc
MD5 1010b22672d60223d3449e34e742de82
SHA1 d2b0717b5d13bce7540ef284eaaaaec0d43e54ff
SHA512 1fb0fffed9f5de2551f8fb7821588f7c7773bb89f34bf8708833888cdbcd3da7c8b0301599aad129774ab272b7fd8cfb39ea361c23491aaa8bdbf6ccb1333e1e
SSDEEP 12288:wW5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:15mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a63CB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a63CB.bat
Size 722B
SHA256 fca9692600969620558db75d501de8084706be453ad1ff64cf46616c55039efd
MD5 e09b284ad397f0bcc1cb53d52bf88e26
SHA1 c5f2ce9c10018372c51e469b1913a6ff529b3ae0
SHA512 26b15a117df15b22a9a4b7b5d067a45a7a503d54918ba8b1f60d0ffdcd513a645d1e2457a89d1bf4392ec76af1c1bb4e595ddf4391b45d120613d2ca1b73745a
MD5 SHA1 SHA512

Submit Download

ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ea49a38ebac7b3fb7a8d2e1858b2c5e69eaad3862cb406dfa42fc927976a2f6c.exe.exe
Size 36KB
SHA256 8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
MD5 9f498971cbe636662f3d210747d619e1
SHA1 44b8e2732fa1e2f204fc70eaa1cb406616250085
SHA512 b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
SSDEEP 768:CNic1iTEpgSG9TJVQBWZrvW5TNDWfKgUkKtzYiguHAMxkEZ2e:mriw+d9bHrkT5gUHz7FxtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 73bb214769970609319af0d08f3d0938a9cad1d1fc864b23527c9474cca5b2f2
MD5 dccda60757967a88ad8a9a89f813748b
SHA1 30342bac716279dc71135ca51c669c25940a8684
SHA512 b022e816473dd0c16723393e1381ef9e99298fc6e85724eb451271c62a1f1e77541543fe02cb5e9cc7d758a3793103930288c36e7becfb7ff2716893ee228816
SSDEEP 384:Nbba2o415e6R1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOj:p9oqR16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/3260-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-1231-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-4797-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3260-5236-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download