4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
Size 573KB
Sample260506-kmncsad131
SHA256 4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8
MD5 b415d280938a9415a6ef9c3a4d959ac9
SHA1 f76f60f35bcd500f94d9252a3fb5987a55b7661d
SHA512 e6fd6eb6d6737c32d281c02d3191fdc2c296452a451f55fbd1a3d89e78f65a10cc9f41358194d032ac3d90e8b65dc46b58a5079beb90ac33fa2ac3ff2716d3fa
SSDEEP 6144:ouJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:87a3iwbihym2g7XO3LWUQfh4Co
TLSH
T1B5C40926F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
8	Logo1_.exe
4616	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\edge_BITS_3580_351940153\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4492_744891059\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files\edge_BITS_4492_1918767767\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
File created	C:\Windows\Logo1_.exe	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe
8	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3664	4444	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe	85
PID 4444 wrote to memory of 8	4444	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe	86
PID 8 wrote to memory of 432	8	Logo1_.exe	87
PID 432 wrote to memory of 3924	432	net.exe	90
PID 3664 wrote to memory of 4616	3664	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
"C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17D8.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
    "C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe"
    3⤵
    - Executes dropped EXE
    PID:4616
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 494ba4f239f1c09db9720e78dad79edc7c93edfcd12e41a2de7029c8cd509c63
MD5 a1b76831f67010865222389939a1e21c
SHA1 07ae6b9ee97fcb29aca63a1f25fe63b5dc5890d1
SHA512 6cac60a18edfde10f5d614f5e43ec9d9f9745f64a5c75ed74a947a2dee0ac69ef70f2dd0d8ed65f08d1922f6fb3cb6e7c6e6794de9d374f60724b1819a70df72
SSDEEP 3072:pPkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:2uJtYCk3ET+Tu3fC0zB+JHv
TLSH
T12DD39D1376D084B2E5B2193108A1EEB1893EFD625D50DE6B37D42B3E0F316C1DE25A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 649616fdad60daa8e8223681a48a863fa07ca6b0413bc9aa85ad647c7686acde
MD5 9212c885b223a6a9528483c52b1ac2e4
SHA1 db7113999c6d41dd4f90537fb0e0440e7d4a0d10
SHA512 dd092aa4ff2e93e5c56d72a296b4787e5480e4ce78576509fa4db60e4f02bd10348abf290ba0264e21a5b12e75042291d5efa10603486fa25c70fdaba7ff869c
SSDEEP 6144:ouJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:KXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T11AC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 757fe633ea41285f211db91595292d96e2e960ea5a4370d8c9558b5a459a6392
MD5 30d4351aadf782f1dd3b7e17922b899e
SHA1 73f3daccd21e03d66135cc54cb5776099b4747d8
SHA512 2a2753c0a75ee37a3a9369751bfba814bfe590421717e079f903148af80e31cce1d4d95d528840c9550210d1f3ed413fe4e9e9f86a77d4fb7ed3592a5a0c2f7c
SSDEEP 6144:wwuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wqqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T162B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a17D8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a17D8.bat
Size 722B
SHA256 8c875e639514f851f42e5288ca50296e231cdce1c4a96ebd9fbf7f9cdaad8293
MD5 7855879028c6fe8cd2ef1423711ba45d
SHA1 8c612f228b0a303441822977ebcae1e3dacb1e78
SHA512 d94bde7e282a18ac89036b8f7f5efea313e83d609df4d64fd29f9b396e074bda47a7d02d56b1ea751acae832d2379238d821a54751904f05d6d7e31d5ae0018c
TLSH
T11B01718145AD93A50DD49DB20AF3DD4DA2B5E828BF026B54673B4CCE88E443EB5CA342
MD5 SHA1 SHA512 TLSH

Submit Download

4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
TLSH
T13AC4F826F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 3d6690b6ba8f1ff82e00fc9265560a74c169b0a130b30278cba352d4739a6eed
MD5 8e83cba1d12de92ce29f8c6573224ccd
SHA1 b743a90b286d808f3ee49f84fa839fb6ee294a89
SHA512 cbf766c26a1e11610b8545517685b3ddf8fcbaabd60e19dcf3c5275dd51cf620fd2b941f0d4af69b73d49229231c4cc1c256ee14843a1b04fd5a9462ffac1dc1
SSDEEP 384:Nbb6QYUVvBEM1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOj:pv16GVRu1yK9fMnJG2V9dHS8
TLSH
T1FED2E17077DD95A3E1A90FF068A38FB68826FD24FCC9521F2D39BB6D5CB8A008651103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-643422742-1162610606-620613169-1000\_desktop.ini
Size 8B
SHA256 ae8206aa092f5ecb18a5d1f42f4f0b521035f5e5c94d4625861648f7fbd1f60d
MD5 8ea52d996deee81cd9b6ba521de3dcf0
SHA1 80228b9722b3e4a9e14de155d335f86e9eef2b32
SHA512 715d74fd17cb918101c2145d611cdee680b3e522ce80e1e20804d81325cf014b3fff19690fc0e6a8e674eacde3602e6f0454765a5a84c799f1168cf8b1cfb212
MD5 SHA1 SHA512

Submit Download

memory/8-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-467-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-1288-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-5077-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/8-5592-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4444-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4444-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download