e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
Size 227KB
Sample240801-2xte8avhkc
SHA256 e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58
MD5 ee11b7873eca54bda5f41305047f9d1a
SHA1 494df906cf9a181e65ac10a345cdbbdbd03fe9c1
SHA512 4e9aed93d9391f7ec68160be09e4a12f77f16ed90adede32c6d44649b26d010861b0f4c949afcf8637d0a61fff07e26f5f1a00a683beb993cfeb6e3dea79dc05
SSDEEP 3072:pQkuJVLUdeKzC/lzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5n:DuJWdeKzC/leySe8AIqpoHbnDns1ND9m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3148	Logo1_.exe
1120	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
File created	C:\Windows\Logo1_.exe	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe
3148	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1544	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	85
PID 3480 wrote to memory of 1544	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	85
PID 3480 wrote to memory of 1544	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	85
PID 3480 wrote to memory of 3148	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	86
PID 3480 wrote to memory of 3148	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	86
PID 3480 wrote to memory of 3148	3480	e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe	86
PID 3148 wrote to memory of 2672	3148	Logo1_.exe	88
PID 3148 wrote to memory of 2672	3148	Logo1_.exe	88
PID 3148 wrote to memory of 2672	3148	Logo1_.exe	88
PID 2672 wrote to memory of 1136	2672	net.exe	91
PID 2672 wrote to memory of 1136	2672	net.exe	91
PID 2672 wrote to memory of 1136	2672	net.exe	91
PID 1544 wrote to memory of 1120	1544	cmd.exe	92
PID 1544 wrote to memory of 1120	1544	cmd.exe	92
PID 1544 wrote to memory of 1120	1544	cmd.exe	92
PID 3148 wrote to memory of 3524	3148	Logo1_.exe	55
PID 3148 wrote to memory of 3524	3148	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
  "C:\Users\Admin\AppData\Local\Temp\e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC99.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe
      "C:\Users\Admin\AppData\Local\Temp\e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe"
      4⤵
      Executes dropped EXE
      PID:1120
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 573KB
SHA256 91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc
MD5 e85a10cf1c849dcccee64a8c51ed7d67
SHA1 38a2dc2635d8362ccf5b28d2f1204011bf226d84
SHA512 50104c7ae5e0fae75aaa755e1edf51fa306ac290ab3ad9e9829d160d8ac6123a0d81408b60143d363dedbaba8f97861513b3a0f82743ea375be0b94529eeed03
SSDEEP 6144:DuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:l7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 639KB
SHA256 eed9c9a08f13ef7be401e0ce827001aa9849769b16dce74012e3bc6925c4fa5b
MD5 4baecb97e22493a7726fa776cd11e9b6
SHA1 af2dad28d17ec1220505a475f669bf2663893e0d
SHA512 75b604ac8a896dcd06f87b35acd06eb0350b5f624cf325bb7ec1e388491f00c7e79c735a4b37468b1c46f20f34c257406f156ba5490196107b8b5a67364cdb84
SSDEEP 12288:wk5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:/5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$aBC99.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aBC99.bat
Size 722B
SHA256 b4ac6c17daab499bc47652c951eae9c741ad053d305b9e67cc926ded21813696
MD5 3c5f8a137b415710307f648a908fbf90
SHA1 73b248ea66646daa3610aa0a5e8c194cae588139
SHA512 2b24fba3bfce901f1762c28278ceb975895d4b072f07fe121281e2000f0f1e5f8751cd8d66ba5598e0c1b3ef34edd5c0b710e1a06966df69ee84ddb56b74af2c
MD5 SHA1 SHA512

Submit Download

e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\e01dbab2f2e77d8c768c93347a00f3e979502db7f9942fee628e07d6beac4e58.exe.exe
Size 198KB
SHA256 6c5e7d9c81a409e67c143cd3aed33bddc3967fa4c9ab3b98560b7d3bf57d093d
MD5 e133c2d85cff4edd7fe8e8f0f8be6cdb
SHA1 b8269209ebb6fe44bc50dab35f97b0ae244701b4
SHA512 701b7d1c7e154519d77043f7de09d60c1ff76c95f820fc1c9afca19724efb0847d646686053354156fd4e8a9dab1f29a79d3223f939a3ff1b3613770dc8603b1
SSDEEP 3072:pdeKzC/lzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5yGgA9Sa:pdeKzC/leySe8AIqpoHbnDns1ND9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 d3a2638f1ce0bfb967235ed43cb85a5d429a462d5231af8abee7219f7b8b3ae3
MD5 7df4cd4ea9e18ac4eac10b27f9b1befc
SHA1 cf3502a223bd7ad9f15dc01f765bdc55304b228d
SHA512 e7f8467655f3eab4aedbc933740a502ad95525007c27cd0ab923c8a65ce7419fdf895070e593dc5851641bc256b6881dbb728520be892f1b96a6ccd525c8bf33
SSDEEP 384:NbbHMl3v1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pol/16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-195445723-368091294-1661186673-1000\_desktop.ini
Size 8B
SHA256 47f454cb045cab0f9ee28683942faddf984b88986cb761e4caa639f91ac4cdd7
MD5 34f94fcbc939d25f54e986fe97a87522
SHA1 dcde2a11c5631b5dbd93ce97e503d0ff42a6f341
SHA512 aad5abbdc495f19e0997d67d3daad417eb18f3e3061de2515d3870cc6c2c417aef366de938c8c98d3b62b81ec44f5a16e1227118e28b4624c99b2c1546e1c678
MD5 SHA1 SHA512

Submit Download

memory/3148-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-1232-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-4793-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3148-5238-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3480-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3480-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download