a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
Size 362KB
Sample260420-jbsbxsgs21
SHA256 a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018
MD5 aa3edf47a68a1047a939a2f64234bc3a
SHA1 63bf08000a11c47238eeda2a016cafe7df9e7fda
SHA512 0e77c622daaf3f8b9b7bc552db258f57d863b9ab6e2e8388b3750f636b95df3d224e57cbd95fb5bff8cf445a2d5c0ec2ae0686d59a16bd07d04eb6f4b218a606
SSDEEP 6144:CFp9zU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:kpRU66b5zhVymA/XSRh
TLSH
T19D844C46E2A404D4D13AE13FA5969347F2F2BC144761ABCB1364E26D6F336C2A93F361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1748	Logo1_.exe
3004	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\utilities\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
File created	C:\Windows\Logo1_.exe	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe
1748	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3412	3008	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe	80
PID 3008 wrote to memory of 1748	3008	a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe	81
PID 1748 wrote to memory of 4680	1748	Logo1_.exe	82
PID 4680 wrote to memory of 4312	4680	net.exe	85
PID 3412 wrote to memory of 3004	3412	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
"C:\Users\Admin\AppData\Local\Temp\a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a197E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe
    "C:\Users\Admin\AppData\Local\Temp\a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe"
    3⤵
    - Executes dropped EXE
    PID:3004
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 126KB
SHA256 41aa32a4816c63cc158ebc841de43de7d32f9c0ccb259010bbdd36f95f2aad02
MD5 fbb354b3235b21d13286f150fea1a5c7
SHA1 4b97db762048cb2059b2f17d47d94e8c1022de25
SHA512 a660455b545b5eb667c683f9d8c7f71374cf162cc2c718fde81dd9b40ca115144aabe0eb44999b94add19abf4f08eee23b6d6cc2645ab97c20de456ed99d5a5c
SSDEEP 3072:5kF3pPYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:uFpPYCk3ET+Tu3fCUzB+JHI
TLSH
T14EC39D1376D184B2E4B1593108A5DD71897EFD620E50DE6B33D81A3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 576KB
SHA256 c9f69e754dfa3c3dd613ecd9b5ee5a5030f93e3dd0305fb1423502b752deb832
MD5 0ea1ee22e731e2ed2a1c6674dedc6cac
SHA1 0aa575c08a50cc59c5c5c06092d3a677a4e6557a
SHA512 925bef5ef70f4f7dc0162a8f36c6d9f6741718ff347e5516ab306ca5099cc67b32b88baf69608787df5f3e2400b4a30d3ec504f7870ecbad6a93ce1f3e0c40af
SSDEEP 12288:kpiXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:kpm0Le5ji0hmxNrM
TLSH
T10BC40916F6748331D073C0B9C5D2A69EE97130825B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a197E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a197E.bat
Size 722B
SHA256 6d55cdc28dbff0ef6ed6140c583c9b57b94cee92a85b953e649162c0e2393640
MD5 7562c65ee1accd7f370479334a88eaf4
SHA1 f1280b05741d023116f09f60932ba40b18fb8ace
SHA512 f14f1f30f1fc217f6e4f162a04b26bb7a2678b4213c45b45d1aff8b67dc090ceeda5350f160682089d82799eb6e166b63c62b7510d8aecc589922a9dd266648e
TLSH
T1D4019E35CA8B55A6F457502B0A221A9ED0567E0C7DD1ABE14157CB4A028260BF7C7B0B
MD5 SHA1 SHA512 TLSH

Submit Download

a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\a9e3f3d8f8360ac48ce6598b7e9b090fd65974a3cb554d8b5bd9a3ab0d8d5018.exe.exe
Size 335KB
SHA256 482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
MD5 40ac62c087648ccc2c58dae066d34c98
SHA1 0e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA512 0c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
SSDEEP 6144:EzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:MU66b5zhVymA/XSRh
TLSH
T134742C46E2B404D4D13AE13FA5969347F2B2BC144361ABCB1364E26D6F336C6A93F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 9420072d9a2ee76c32188a3bc19b6ae0e01d6420f2b43c3b1d6f434bf8675507
MD5 276604156bae40c1b3a512bbd387a582
SHA1 e4ff254ca903ab89b880fb1e815d9edc6e4e6d59
SHA512 fb5a9aa6497fce7f764da6107a5b10c575c7993ee407de5b69648abfd54596937500ac0d95d72cc2d61602b99bccef8f5ee20d238b691b9e79329fa5a5c4dfef
SSDEEP 384:MbK1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:OK16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T161C2D0F01BCA62D1C44C17F60CDB4B6749F26E61EFCD3A9F2A78385A0DB0A05846E50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\_desktop.ini
Size 9B
SHA256 18ffab5607908c56eca3c5492fc17a04e83b4b0d5c18de29aae4ffea20cfd84c
MD5 83e735742cfe165dc8c6f24ae03fd819
SHA1 0c085c7321f25a33110a8e01365e7929454f8d5c
SHA512 76b7bf2716d1da77f58df1340f10afff1334d282902c18ab30ff1b6f173832e6278ab14c22816b7b231949c770c1a5f5d45b89099fb949737c1ef8951b22c321
MD5 SHA1 SHA512

Submit Download

memory/1748-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-20-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-757-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-1224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-5005-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-9-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1748-5502-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3008-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3008-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download