e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
Size 87KB
Sample260511-l96nbaez2w
SHA256 e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c
MD5 c4bff53d45259fd0fa28c0a470b250d6
SHA1 5e0316e3f8c4860b7491e9549ef99b2b08c8bf96
SHA512 b14a51e04e5e2070e263809a8019dd673ce104921314558b4c75b08a60e19a398ce699a1273de2ca6012beb0c468e4df3b04cf0c2e5eddccd6440b5f648202c9
SSDEEP 1536:pBC3SHuJV9NjqG8I8pk4gB/hZdtcSvJBi+qfLiHae0ko:pBCkuJVL3j8pk4gB/hZPBRB9qf3F
TLSH
T1C3938D05F694DA3DE0731B71A8A6EA20567AB960CC12833F77647F0B7EB13C18726653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3544	Logo1_.exe
1988	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Todos_0.33.33351.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2020.901.1724.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\lt-LT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\bg-bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_2021.226.1915.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\ComboBox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
File created	C:\Windows\Logo1_.exe	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe
3544	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3572	4196	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe	79
PID 4196 wrote to memory of 3544	4196	e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe	80
PID 3572 wrote to memory of 1988	3572	cmd.exe	82
PID 3544 wrote to memory of 5692	3544	Logo1_.exe	83
PID 5692 wrote to memory of 5948	5692	net.exe	85

C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
"C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0EC.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe
    "C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 3f6da0f7aa6b9cb77753d8cac4edc815642ff68472763f891253020488b6b8eb
MD5 f43c433d17094bae9325a3f254e8abed
SHA1 6dc5238d426aed601d0a26d9a76ba508a0cdff96
SHA512 6a669b85b04e2e80257a1de24144a489c2af849305f1ca8a13ba67ad6d73ca7e7d57411d79ec298289652c5a742b50fba03f9f2cbb1fbf42f1a556293d09ec87
SSDEEP 3072:pcCkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:qHuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1ACD38B1376D08472E5B2593208A1EE71893EF9624D50DE7B33C81B3E4F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 84d6bf78a46240147466dbdf6f7724784b56b3d43393586ec78092e1068332a9
MD5 a0f861d0aad792a548dad9f1cbb414d1
SHA1 94c99a38deb9131f2b75d346776a4adb411e860c
SHA512 83582df44d29022f7ec0af4c4c572126eb5ad4692b7c38e8d058d8e2f9fd8954b75fab0e0d11c8cd62ba016caacdc18bb1fb7100d6ffdcfcb0d450dffd2044a2
SSDEEP 12288:zDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h0Le5ji0hmxNrM
TLSH
T1EBC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aD0EC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aD0EC.bat
Size 722B
SHA256 f0d27b406e24f2beec4ef486a41530c06bcfbf6d637ac24eaa4da8c219f47720
MD5 e40c1e3171d6f9682534915620daae26
SHA1 df226e2f9716bf104fa442b9c3af435a69086156
SHA512 576dc45a169281132019fe81a08ce9e73a932305e9100a271b7b121c6c1faff06416d7bfcbb75ee82c8291dda6387311b8dd4961bb2fd288be786c39dac7a835
TLSH
T14701F002C782A3DB2544601B0B2291EF60777CB93F4C37265ED659453EB7956B1D7103
MD5 SHA1 SHA512 TLSH

Submit Download

e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\e213a67589e10c342fb0ecca8ce5015af77f53db0b6499c8f8fba3f1cb60a49c.exe.exe
Size 57KB
SHA256 e8d0f855c88ca621d0c9936d52844307284d6286ce168076348735359ad518ce
MD5 d62af8d56065619e3189563099185c45
SHA1 43df83b1aaa7b79dc1695f6fdc3b5773ee5b3539
SHA512 1a64ffad9e700195452c578276617550258b74f7ef983e57d5a61c1f28e50358e190145f1d08c94ffde0facffd7094febb626989cf934c307f9c32ba078a7169
SSDEEP 1536:aqG8I8pk4gB/hZdtcSvJBi+qfLiHae0ko:cj8pk4gB/hZPBRB9qf3F
TLSH
T1EE434C06F654D63CE0730A3579AAE51066BABA60D912873F73B47F0B3E713C28726653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 4c810d6d40017bd97a774a494c39b2877cd1dd43a5bff083f280d0e9c6bc4094
MD5 8bb5e666852e7c94a03b806311207d43
SHA1 182ce11dccacb7762abbec899165bca707373f6e
SHA512 c1e2b2fdd656780d27a849972163f65994fa06065a766545d6cd9418a4e414dd3381e4dd2141c82feacbcfed8019e6f08fffe00b48e3008e23b6dd4914a6eaa0
SSDEEP 384:NbbS+KKugnL831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pm+KKu0Q16GVRu1yK9fMnJG2V9dHS8
TLSH
T159D2D0B037CD9922E6932FF294D34F668927F024CC4A817F6E186B9EDCB06904572E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1456842261-3464001825-2855069093-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/1988-19-0x0000000002300000-0x00000000023C1000-memory.dmp

Download

memory/3544-34-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-29-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-347-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-1225-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-5006-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-5509-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4196-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4196-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download