e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
Size 87KB
Sample260511-l96nbaez2w
SHA256 e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c
MD5 c4bff53d45259fd0fa28c0a470b250d6
SHA1 5e0316e3f8c4860b7491e9549ef99b2b08c8bf96
SHA512 b14a51e04e5e2070e263809a8019dd673ce104921314558b4c75b08a60e19a398ce699a1273de2ca6012beb0c468e4df3b04cf0c2e5eddccd6440b5f648202c9
SSDEEP 1536:pBC3SHuJV9NjqG8I8pk4gB/hZdtcSvJBi+qfLiHae0ko:pBCkuJVL3j8pk4gB/hZPBRB9qf3F
TLSH
T1C3938D05F694DA3DE0731B71A8A6EA20567AB960CC12833F77647F0B7EB13C18726653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4356	Logo1_.exe
3756	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Sounds\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
File created	C:\Windows\Logo1_.exe	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe
4356	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4472	4316	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe	85
PID 4316 wrote to memory of 4356	4316	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe	86
PID 4356 wrote to memory of 5876	4356	Logo1_.exe	87
PID 5876 wrote to memory of 3804	5876	net.exe	90
PID 4472 wrote to memory of 3756	4472	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
"C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5791.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
    "C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 7d245e28bcca830d8b9918a2643c0e803a37d3492f74257f7ee4eb1b20ea832e
MD5 ae319771fd1535f0d6d18812bc5d0175
SHA1 e02b66cc4cb712dd14dc46c5b45cf5ce292f5f7d
SHA512 b44b4ae887d17fd3d27dbfa706a0a39a557d18a1b5d0046b384c83777451f3c8fc23d06d5ee883920736344be6081aa84ba4388ca57223a80c171ff9999facaf
SSDEEP 3072:pcCkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:qHuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T14DD38C1376D08472E5B3593208A1EE71893EF9624D50CA7B37D81B3E4F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 84d6bf78a46240147466dbdf6f7724784b56b3d43393586ec78092e1068332a9
MD5 a0f861d0aad792a548dad9f1cbb414d1
SHA1 94c99a38deb9131f2b75d346776a4adb411e860c
SHA512 83582df44d29022f7ec0af4c4c572126eb5ad4692b7c38e8d058d8e2f9fd8954b75fab0e0d11c8cd62ba016caacdc18bb1fb7100d6ffdcfcb0d450dffd2044a2
SSDEEP 12288:zDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h0Le5ji0hmxNrM
TLSH
T1EBC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5791.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5791.bat
Size 722B
SHA256 8ff8ba9c308a3ed8f4d528185a062c8fbee6f133b69c579a27afcefb868fc8fa
MD5 8f5573ddc2ef609f24bd5d4452320e79
SHA1 e7b4a2af7fea8dc06054b15d52119c3ec87f590c
SHA512 e3f88c10a68a3a55d9ec1c760c86ef4bb62517d6a8dcd2f9d2f7923e93b1ed6ebf4b564b57de50e64f8bc36e1e5b63972896da46394ac64cae943aea50691360
TLSH
T1DF01F002C782A3DB2544601B0B2291EF60777CB93F4C37265ED659452EB7956B1D7103
MD5 SHA1 SHA512 TLSH

Submit Download

e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe.exe
Size 57KB
SHA256 e8d0f855c88ca621d0c9936d52844307284d6286ce168076348735359ad518ce
MD5 d62af8d56065619e3189563099185c45
SHA1 43df83b1aaa7b79dc1695f6fdc3b5773ee5b3539
SHA512 1a64ffad9e700195452c578276617550258b74f7ef983e57d5a61c1f28e50358e190145f1d08c94ffde0facffd7094febb626989cf934c307f9c32ba078a7169
SSDEEP 1536:aqG8I8pk4gB/hZdtcSvJBi+qfLiHae0ko:cj8pk4gB/hZPBRB9qf3F
TLSH
T1EE434C06F654D63CE0730A3579AAE51066BABA60D912873F73B47F0B3E713C28726653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 4c810d6d40017bd97a774a494c39b2877cd1dd43a5bff083f280d0e9c6bc4094
MD5 8bb5e666852e7c94a03b806311207d43
SHA1 182ce11dccacb7762abbec899165bca707373f6e
SHA512 c1e2b2fdd656780d27a849972163f65994fa06065a766545d6cd9418a4e414dd3381e4dd2141c82feacbcfed8019e6f08fffe00b48e3008e23b6dd4914a6eaa0
SSDEEP 384:NbbS+KKugnL831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pm+KKu0Q16GVRu1yK9fMnJG2V9dHS8
TLSH
T159D2D0B037CD9922E6932FF294D34F668927F024CC4A817F6E186B9EDCB06904572E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-643422742-1162610606-620613169-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/4316-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4316-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-514-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-1286-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-5075-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4356-5590-0x0000000000400000-0x0000000000436000-memory.dmp

Download