4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
Size 573KB
Sample260506-kmncsad131
SHA256 4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8
MD5 b415d280938a9415a6ef9c3a4d959ac9
SHA1 f76f60f35bcd500f94d9252a3fb5987a55b7661d
SHA512 e6fd6eb6d6737c32d281c02d3191fdc2c296452a451f55fbd1a3d89e78f65a10cc9f41358194d032ac3d90e8b65dc46b58a5079beb90ac33fa2ac3ff2716d3fa
SSDEEP 6144:ouJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:87a3iwbihym2g7XO3LWUQfh4Co
TLSH
T1B5C40926F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4352	Logo1_.exe
2712	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\react-dom\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\archives\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\sv-SE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
File created	C:\Windows\Logo1_.exe	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1744	2644	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe	79
PID 2644 wrote to memory of 4352	2644	4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe	80
PID 4352 wrote to memory of 4404	4352	Logo1_.exe	81
PID 4404 wrote to memory of 5088	4404	net.exe	84
PID 1744 wrote to memory of 2712	1744	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
"C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A6.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe
    "C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe"
    3⤵
    - Executes dropped EXE
    PID:2712
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 a20efc9e91a2c1abcddcb1484fb0ec47f0e7fd27b9e11f1ad5d6b4f36178b603
MD5 205c65a5474964b4e1122b8a30bcdb6e
SHA1 3689864f3899fc485b97084af56c4e6fe1e8b1c0
SHA512 fe33911da458c21c0869818c1726d24fc351a44f7d200181935e33abbd4ac4c15c399f39a3f9397650bdc557b07e841d10334da20f06b4d5d676573ac8793c05
SSDEEP 3072:pPkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:2uJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1CFD38C1376D084B2E5B2193108A1DEB1893EFD625D50DE6B37D42B3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 649616fdad60daa8e8223681a48a863fa07ca6b0413bc9aa85ad647c7686acde
MD5 9212c885b223a6a9528483c52b1ac2e4
SHA1 db7113999c6d41dd4f90537fb0e0440e7d4a0d10
SHA512 dd092aa4ff2e93e5c56d72a296b4787e5480e4ce78576509fa4db60e4f02bd10348abf290ba0264e21a5b12e75042291d5efa10603486fa25c70fdaba7ff869c
SSDEEP 6144:ouJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:KXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T11AC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 757fe633ea41285f211db91595292d96e2e960ea5a4370d8c9558b5a459a6392
MD5 30d4351aadf782f1dd3b7e17922b899e
SHA1 73f3daccd21e03d66135cc54cb5776099b4747d8
SHA512 2a2753c0a75ee37a3a9369751bfba814bfe590421717e079f903148af80e31cce1d4d95d528840c9550210d1f3ed413fe4e9e9f86a77d4fb7ed3592a5a0c2f7c
SSDEEP 6144:wwuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wqqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T162B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a22A6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a22A6.bat
Size 722B
SHA256 33af58d17e5d8b8cf43628bac3cdfdcb78b6dc5687e341664eb8d9d8b14070ab
MD5 78fa37a6c5f05a0e9a89657c4764df93
SHA1 cadb97601554202ada37d487c2f471959722922b
SHA512 969de42cea5acc82a622cac413e84ea8dbe1d3119b753d6f8c7c12c87c8675684e6702c4e04e2e68b7bc5a627726ad3abb3a6879e13d487040eeb4087725d1c2
TLSH
T17F01888145AD93E51CD45DB209F3DD4DE2B5E868BF026B5467374CCE88E443EB5CA342
MD5 SHA1 SHA512 TLSH

Submit Download

4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4c0a6d77ed1b6c18961f3aae49a74750c243ebf0b80b7b6db03fad70ed633df8.exe.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
TLSH
T13AC4F826F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 3d6690b6ba8f1ff82e00fc9265560a74c169b0a130b30278cba352d4739a6eed
MD5 8e83cba1d12de92ce29f8c6573224ccd
SHA1 b743a90b286d808f3ee49f84fa839fb6ee294a89
SHA512 cbf766c26a1e11610b8545517685b3ddf8fcbaabd60e19dcf3c5275dd51cf620fd2b941f0d4af69b73d49229231c4cc1c256ee14843a1b04fd5a9462ffac1dc1
SSDEEP 384:Nbb6QYUVvBEM1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOj:pv16GVRu1yK9fMnJG2V9dHS8
TLSH
T1FED2E17077DD95A3E1A90FF068A38FB68826FD24FCC9521F2D39BB6D5CB8A008651103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
Size 8B
SHA256 ae8206aa092f5ecb18a5d1f42f4f0b521035f5e5c94d4625861648f7fbd1f60d
MD5 8ea52d996deee81cd9b6ba521de3dcf0
SHA1 80228b9722b3e4a9e14de155d335f86e9eef2b32
SHA512 715d74fd17cb918101c2145d611cdee680b3e522ce80e1e20804d81325cf014b3fff19690fc0e6a8e674eacde3602e6f0454765a5a84c799f1168cf8b1cfb212
MD5 SHA1 SHA512

Submit Download

memory/2644-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2644-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-668-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-1223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-5004-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-5507-0x0000000000400000-0x0000000000436000-memory.dmp

Download