cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
Size 391KB
Sample241110-ah2phavgre
SHA256 cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a
MD5 689a3a95ed042032ade2d8af303bcd62
SHA1 d7ace51ef130fba7839b90516cfb5507385c724f
SHA512 c124f08dc61c9e6a5b01ff643f2666c189accaf73fed86a19a7f2aa320c8e13f0f346199e5512901e0a4f6f141ebacde562b13320a6ec8b7901a2282f6f8a757
SSDEEP 6144:9Fp8nDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:Pp8DXYJmSTZwYp32bY4qtDF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1852	Logo1_.exe
1216	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\jsaddins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
File created	C:\Windows\Logo1_.exe	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe
1852	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4324	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	84
PID 3600 wrote to memory of 4324	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	84
PID 3600 wrote to memory of 4324	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	84
PID 3600 wrote to memory of 1852	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	85
PID 3600 wrote to memory of 1852	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	85
PID 3600 wrote to memory of 1852	3600	cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe	85
PID 1852 wrote to memory of 4736	1852	Logo1_.exe	87
PID 1852 wrote to memory of 4736	1852	Logo1_.exe	87
PID 1852 wrote to memory of 4736	1852	Logo1_.exe	87
PID 4736 wrote to memory of 428	4736	net.exe	89
PID 4736 wrote to memory of 428	4736	net.exe	89
PID 4736 wrote to memory of 428	4736	net.exe	89
PID 4324 wrote to memory of 1216	4324	cmd.exe	90
PID 4324 wrote to memory of 1216	4324	cmd.exe	90
PID 1852 wrote to memory of 3396	1852	Logo1_.exe	56
PID 1852 wrote to memory of 3396	1852	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3396
- C:\Users\Admin\AppData\Local\Temp\cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
  "C:\Users\Admin\AppData\Local\Temp\cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5F2.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe
      "C:\Users\Admin\AppData\Local\Temp\cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe"
      4⤵
      Executes dropped EXE
      PID:1216
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
Size 244KB
SHA256 d1547eaf22d27e0e561cd86cad084cf6e61210a6daf132909a040459b0706d1d
MD5 d866716c94bb47f7d35e1aff13fc3b7e
SHA1 32479060c9eff4c2fdcfb0da0a5a143d8300adb9
SHA512 d92147a25fdf558838a326b22a80fcf77ada2be3e24717b8532a1d89a6dd96b42e4de1fa13288c33123c80ec87142e4ebfaef6fdb563be5ced9360af09cc68c0
SSDEEP 6144:TFpkqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:pppml5a6EdkQgUmR7G9QK3wJx+qSfF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 571KB
SHA256 afc130384798a7a29dd0ad694689b6c4427dec430500704ae82fa0481098ce0c
MD5 6675c703a285b9be63536b7fd52663b1
SHA1 c48b9031061d292f2b2f9ac0380fdf526129b3f5
SHA512 f80a41a000d110ee030416d74f7cb2da28a65d0f8f708ab48c51dba99edf53d0e58ec0cb725393ceca10b846d1fd4a0483769999947ac77850d9737181c72ebe
SSDEEP 6144:9FpnE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:PpE7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 637KB
SHA256 a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19
MD5 9cba1e86016b20490fff38fb45ff4963
SHA1 378720d36869d50d06e9ffeef87488fbc2a8c8f7
SHA512 2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765
SSDEEP 12288:LxpE5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:FpE5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$aB5F2.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aB5F2.bat
Size 722B
SHA256 cca0f3c14709dd10f80d225cb4b04c00662582911158f2d07345355f11009f56
MD5 ff9e9539dd4cd25517595da5a81059e8
SHA1 1f8841916353d321a36289bb641fd7a4fb96887e
SHA512 1fb39f6354c1c8fd4f28ad6f14fb1c8663124dd1880dbb27dfc55b6d9697c31d3e4b5ec905b1cfa0d278c9097beae00420d2aae56a2cf88d7278254bef9e4cd7
MD5 SHA1 SHA512

Submit Download

cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\cc317b504db6dc3e749a9c3731214d4360d5591d88a31b341ed51cc87835b32a.exe.exe
Size 364KB
SHA256 b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50
MD5 213eeb5e8f54231f68e5b26a0fc81bd1
SHA1 1bc31a42536eacbb57d1cd92ec4b5524a82264d2
SHA512 ce35c5f453126c98329df141f821c55692f9252549c76921c231d8170df356cda1689e636758519c0b6898f11b5c836cdb4967d296b99f915e4d1980470a083b
SSDEEP 6144:BnDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:BDXYJmSTZwYp32bY4qtDF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 4abe07c71af5e75e14494c1afa6b19dabf8d5a9616d89ea6e9db749b56139c7b
MD5 d737252686ae5d150afb30c4fc42b394
SHA1 958658607d0715d2f338a21d4a49ec471de4b792
SHA512 796511623459fc86c005a641bb43641ec9051963c61a038c34a40a763d7f1985352c7d6e86b0faf7e2f9bf6c87b87bce8ad7113345f92587da20e349314f5ae2
SSDEEP 384:Mdd1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:sd16GVRu1yK9fMFLKaTxsujCT7pZpY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\_desktop.ini
Size 10B
SHA256 a48a9bee0ea1d148d80a848e506f13606a80f84e7f4fa4a3ceeb0f47eab1bf40
MD5 2a3fd5c71388ca70bcd12900f65d5a77
SHA1 7619579d21480b9a4800bc830dbf20354e50b979
SHA512 0e803903a477f9761178c6892c45f3522f9af5b6ef550f446c0dea329dcbe2753760a17086397ff4f9c66ec93a3dbbd1e7b6aaaa71f77c70c9c8de81429c3aa0
MD5 SHA1 SHA512

Submit Download

memory/1852-28-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-34-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-38-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-21-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-854-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-1235-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-4786-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1852-5255-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3600-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3600-10-0x0000000000400000-0x0000000000435000-memory.dmp

Download