4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
Size 4.2MB
Sample260424-eanvwsd13s
SHA256 4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6
MD5 b3e937abf518852defbc589066121ccc
SHA1 34b575bc8a442ef92e15d1120fbf2749d6009a34
SHA512 9667e28f90269dc7d55bdf7f21575dc1cc53fef7c0e91707348adbe8bd5ed6501d7aec41e46e038993d774116d2977d330ebd516188f50ef7f5653cec55baeb2
SSDEEP 98304:tm0GCrKHtWrAJHcULXkkNlenwgFn7uu+sfCKaGzMFLOAkGkzdnEVomFHKnP:o0YWrAdjTyn7uuSKpzMFLOyomFHKnP
TLSH
T171164AA16D61401BD813A3786ED97638A769FF1C3E3C7BC71C353D8EFAB254291284A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1280	Logo1_.exe
844	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\locimages\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.113.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
File created	C:\Windows\Logo1_.exe	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe
1280	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
844	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
844	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2008	4648	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe	80
PID 4648 wrote to memory of 1280	4648	4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe	82
PID 1280 wrote to memory of 392	1280	Logo1_.exe	83
PID 392 wrote to memory of 1712	392	net.exe	85
PID 2008 wrote to memory of 844	2008	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
"C:\Users\Admin\AppData\Local\Temp\4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8FD.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
    "C:\Users\Admin\AppData\Local\Temp\4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:844
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 932ee1ded89e24b978a1e80db1da6dca2dd0f8ff9ed5e8894bda9a2b9b4540f9
MD5 4886eb17d772eaef7b3e0dc7e32ed59d
SHA1 754cfd764cc8b48265374c40571ae18dcf2a0d1b
SHA512 0da9ee469bcd8fbb2dfbabb5cf2d3def3163497b14bb6a6b637f58de8085a3c76d4cf2ee56849e4d7ce9870fa334dc03e6fbb126bde224efe22e5afceeed3144
SSDEEP 3072:uftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:WVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T1CAC38D1375D08472E4B2593109A1EE718A3EFD620950DE6B33D51B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 8cc958357bff45c6064202ca399ea903a1bc775d39f0541345fd7fa83ad2340b
MD5 2ccd3397c15e329a772f8308e8fa48d9
SHA1 6bc942bfa0b10d97f9909af10f65c960121906a8
SHA512 86aab0aec648be55dbeb68c9be130096cc3e9a4a64a1eafb67769d6bf587d781b63b6da4e1e7e0a4db25ff44405870ea921ed8685c65c95162ec65564d54a0a6
SSDEEP 12288:/7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:/7o0Le5ji0hmxNrM
TLSH
T185C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aC8FD.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aC8FD.bat
Size 722B
SHA256 6d48498dc81c0f9baa3676789e0ac36f6a78e79c59c32d49588c3bde6fca76ac
MD5 bcc7996e9d1c72092b7c735fe020fe43
SHA1 27ee6dc0e7c5780e79b6bc0783e2cbd36d15d5bf
SHA512 2db91452984677d7e815326acd44483a6951097f2749b818cdc82373cac356bea842c6e592cc10570a953bf981f3ad272fa8220d0a8d7c327f7d36b84e0eb0a8
TLSH
T140014C20854FD6891945A41E3B526CDFC77E45C72B691A19BF60C88D064390EA6E7782
MD5 SHA1 SHA512 TLSH

Submit Download

4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe

Path C:\Users\Admin\AppData\Local\Temp\4611edcb1896f66744dc44bfcc267deb8a0171ca24edf282f7136080a1759ff6.exe
Size 4.1MB
SHA256 f9a9f5c526ac4972142adb97ebfd1116621eef0b004983152f1791783c05c34f
MD5 5bbac17cc1ad6d47154837e20b630659
SHA1 eeb519b6f8906c633c0e9f8d33b503eaacd569d6
SHA512 8261276344ae40e399c0eb74a6c4da349d87efb7f24136c43b57f04a91d76d1a1341cd46d7da77da5f35551b95f3cb729cfdef9d5d79ff7cacc1ec41e49161bf
SSDEEP 98304:Om0GCrKHtWrAJHcULXkkNlenwgFn7uu+sfCKaGzMFLOAkGkzdnEVomFHKnP:50YWrAdjTyn7uuSKpzMFLOyomFHKnP
TLSH
T1AD164AA16D61401BD813A3786ED97638A769FF1C3E3C7BC71C353D8EFAB254291284A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 a220ff5bc36f8639124fbbf2a04b7c64569e9a7d9e6f6450e2b821fc1063da67
MD5 ca492a47dcde31b978dcb62b2b4aa4cc
SHA1 28a372ee8e3d2ca7ad164fc34960ac5699c474ef
SHA512 bf12975f0a1f3ea224719743250528a8a4601df6fa7c5ff0f40f95f9bd7c047b28996c25e3c6ed3b583bddf054d7181d0ce474103f5b11742093a6904ac67664
SSDEEP 768:L1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:hfgLdQAQfcfymN
TLSH
T12EC2E17A16CC1678EC6659BDDFE35701833D077E049F68AA2AF2897F2250769100FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
Size 9B
SHA256 cf938a4f3b0b887724302ddf4689d13c4979f5470df615074767908c6ef30aa0
MD5 b3857ff6039696a2ad729e4a24c64459
SHA1 e7475c0b2f75ed8a739af7e9e7327f1337bbf1b0
SHA512 44ab751d8700c7c06015785a932c99c2a11c1de8f81506dd833bf975d8a9c56762de0c40392d67125dd6d4a34f92afab0131d3ada6df62822d51e576dc3dbb40
MD5 SHA1 SHA512

Submit Download

memory/844-5537-0x00000000018F0000-0x00000000019AB000-memory.dmp

Download

memory/844-34-0x00000000018F0000-0x00000000019AB000-memory.dmp

Download

memory/844-22-0x00000000018F0000-0x00000000019AB000-memory.dmp

Download

memory/1280-33-0x0000000002140000-0x00000000021FB000-memory.dmp

Download

memory/1280-501-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-5532-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-47-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-21-0x0000000002140000-0x00000000021FB000-memory.dmp

Download

memory/1280-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-1240-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1280-5025-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4648-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4648-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4648-11-0x0000000002140000-0x00000000021FB000-memory.dmp

Download