8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe
Size 573KB
Sample260419-lld86act5z
SHA256 8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8
MD5 cb5717bab80199994cf3895b2ea4f7dc
SHA1 8301e7922f9cf4f2b8aa1318bd6c85c16c28cc77
SHA512 e1b44eedc24bfb1d2fbf04f6fb77b0461df48be071431be5215831d6dd2582b7a215724b831961646e9948b8e64482a250c7b2a910f5d3ac8dd0f3cad1f5f1c2
SSDEEP 6144:hluJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:97a3iwbihym2g7XO3LWUQfh4Co
TLSH
T152C40926F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
804	Logo1_.exe
3840	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_4.7.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleAppAssets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.OneDriveSync_21220.1024.5.0_neutral__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\sk-SK\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe
File created	C:\Windows\Logo1_.exe	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe
804	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4824	3932	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe	79
PID 3932 wrote to memory of 804	3932	8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe	80
PID 804 wrote to memory of 4320	804	Logo1_.exe	82
PID 4320 wrote to memory of 2656	4320	net.exe	84
PID 4824 wrote to memory of 3840	4824	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe
"C:\Users\Admin\AppData\Local\Temp\8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB09.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe
    "C:\Users\Admin\AppData\Local\Temp\8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe"
    3⤵
    - Executes dropped EXE
    PID:3840
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 c411b64af8b79406d503bf21582b2c6de8d43fc8499ff2c0b2e87c4f4c42227b
MD5 2dbdc96749fdf98ffac81ef642d77c45
SHA1 46c023275c08c6af08d6da46a170288e167b6c32
SHA512 334221845793cda4dba2805770b58faf475fbd906c0199c37fe22495659970aa60650563b7420f72d3c93222b649a79c064afc8d48e09af3be78ce4a000d4f91
SSDEEP 3072:phokuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:XluJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T107D38C13F6D08472E5B2593108A1EE71893EFD62CD50DA6B37D42A3D0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearInstall.exe

Path C:\Program Files\ClearInstall.exe
Size 289KB
SHA256 f0c97d4b30cbe70c725d63ceeead4bbb75e4d5dc9cac0d595ebc5620bbdda672
MD5 b0b5cb12f4337ce26069a94b8cf07515
SHA1 fdf41f2f1280a38658123b2004a25138ff4a075d
SHA512 e089b2750e209f5d0f954b730bc4b186229088a590efef3d2974be16869d230f74cbc5d563ae5f533e4d0e42fd01b98f140587dd5888baffcb35502e52e38f26
SSDEEP 6144:hluJVozZ1SSiIKpjqJLmWABlj1WwzZ/gbrcdEptGK0s:YoF1STDjhNZ1WwV/MrU0Iq
TLSH
T1A0542396F79D6F26D6AFA8F401D24FED44283EA0CC709369AB84724E3479EC1395190D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 86a8075fd0611b8c18eb5cae71e121c7e18a4f132975a3685b8ea2695d173524
MD5 da361918b6019ccee9c8b5b2f0e92f9b
SHA1 134c2103cf316262ef4fd5a0f51fc11391eb4ecf
SHA512 3363651c2819ba512a3c8aac8843899e530e64d7da625e38765d6a923c5c555ae3829de7ffb182b3db8fd3c8ee7d6014df98a800233b9ad0ab1a67d9113cfd8d
SSDEEP 6144:wOuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wYqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1E9B46D31E6A44037D6F106B3F915D6307E7DA218BB1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFB09.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFB09.bat
Size 722B
SHA256 6069b9d072fcf868a258b0b79dcc97269b7859fe8a77798838f35a23bffa7b7e
MD5 dfbbd1512e242db63e694371f4bacbce
SHA1 2a97541549ac591e6c8a67504c3818ec75d30d86
SHA512 0429efcb0fe7709a320568682898487ea5d30d57343ab49b5da072cf7d96720ba2561d6a2b22424c20c9f99b5c4ae12817319f9f3398bf54116752d11e74b84a
TLSH
T142019213924F569B28F5105705A1DDCDB266590CBEC27FE00924D80949837ADF9DB3A3
MD5 SHA1 SHA512 TLSH

Submit Download

8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\8440f629990e38a6a823ae74af3b7960528e0a03e62ed9b6284bad9050c377d8.exe.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
TLSH
T13AC4F826F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 965b3c17e89a156e05f1f0156bba7c08019bd8f17a10ed8a1929637d398cb114
MD5 309068ac8ee2974f0f3ab0b4d889d733
SHA1 3455bdb806f07fe5960c906bb510304e3af4a706
SHA512 d5f1b18ce12b1107c06e0015d3b87870e51af0e649da3d572faf8688803fe7f39cee268c64d01f09e25b35e15ac05330c8624646797d432e4b2b97a32a175914
SSDEEP 384:Nbb7bwGFtU31Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnj:p/rtM16GVRu1yK9fMnJG2V9dHS8
TLSH
T169D2E134F3FC3527E1611FF064E39FAA8827FC30DD06921F5E64B64A2DB18006AA2507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
Size 9B
SHA256 d69b4dd6bcf240546c9346e3a5b155ba851969e32a14653797847dca95c2d058
MD5 847b8baad0088e557fd3ed40314c37e0
SHA1 bd181b4f4c5d10a1e097ca9cdd97caf84a2dd8b3
SHA512 7a30c42adef24bf25b10743e25b038584d76e5118bf58fc9bea54ab63f00e08432ec54556e5c13916bea5c917d2ffb41e974bbefea1ac673125feaaa9af198ac
MD5 SHA1 SHA512

Submit Download

memory/804-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-677-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/804-5508-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3932-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3932-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download