c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709

Analysis

max time kernel
150s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
Size 59KB
Sample260511-lmw6cset4t
SHA256 c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709
MD5 d0381e6e73c46b7c8ddadac0c3acc2bc
SHA1 873a4ec74d9c15c29582f26252817a6a1598a913
SHA512 58bacdcaf7c9def10c75586b2f70ed1b0cc9ddfba866bc159c4513f65d23b3ed42b7a871760342071061e4c6b40456b835ddba18838a0402a2ea3a68e21a6189
SSDEEP 1536:TRfgLdQAQfcfymNF/d6LClOD34Y4YkqGWHaeB:TRftffjmNbLOD34YtkqGX2
TLSH
T10753CF0277DCC119E8671E35E4E7DB02A33EEB6009D5921A36A4EF2EDD737831826617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
764	Logo1_.exe
3408	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\sr-latn-cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\th-TH\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
File created	C:\Windows\Logo1_.exe	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe
764	Logo1_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 864	2964	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe	80
PID 2964 wrote to memory of 764	2964	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe	81
PID 764 wrote to memory of 1448	764	Logo1_.exe	83
PID 1448 wrote to memory of 4492	1448	net.exe	85

C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
"C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD83F.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
    "C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe"
    3⤵
    - Executes dropped EXE
    PID:3408
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 8e8981d3b4666a18b2387e6fcfd0dd82e5f08c73b32cae30fecb2b30ccd5359d
MD5 83fcd3ab5a09a8db21b5f9418f762e2b
SHA1 201fb6256d14097c41da44c59fa24422ef2d8248
SHA512 f47d3a492fb4ffaadb7b1a36ff52fba90e470aedd7710aba4c465da4a31c2696f77d28bad98bb2f0e8d56429a870582ecec8342234fc1f2fd3e4d14faa5d0f88
SSDEEP 3072:lRftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:lZVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T14FC39D1375D08472E4B2593109A1EE718A3EFD620A50DE6B33D51B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 4101809b9f6572bc76370d8ab7f77d3091537fb56da0e107e4cf686e85ce0681
MD5 2b63571432407b1d90a4e25f6c9a0a2e
SHA1 6de2a205f1a73340f0febbd4dc0e5d8ae9c5742f
SHA512 c6d0bc334c71f85ec105601fa30ddd91a44cc860cad864aca49a3a3ef2896d9cf1dea899004ef0801d6bceb65dd6ce1b34c98979b805c3bc928163230661b286
SSDEEP 12288:77+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:77o0Le5ji0hmxNrM
TLSH
T156C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aD83F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aD83F.bat
Size 722B
SHA256 aa481783e05ee39f39ac7b9296ee843d219e2367f7f38f05df2eb36e5d2413e7
MD5 fe1714ca1eab2f8c62769deef41858ef
SHA1 0e1052cd357408e41e98edc0b407375b07f9f993
SHA512 f264cbb5757983291ed74d1dde764b0ea29c61b88d038dd78bf0262f7527f4280fcbd3d73245534e53fa0e4517d16d9331dccb33b89470800838fc607ecc9a51
TLSH
T1A801F7C8D2C1C5DF1C5158660A79A8AFC2EB1CEE3B465F210E6098C526C14CEACBF785
MD5 SHA1 SHA512 TLSH

Submit Download

c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe.exe
Size 33KB
SHA256 9068036302cc58f8fc317121e24681b594cf6751ff4e7cc4e07dadc16eb15bf7
MD5 dd93aff7bda90548a75714ddea8c3fec
SHA1 61a9895aa488b3972d694551fc6807d72e6ff5a7
SHA512 40ce6fd41463ec63887fe88835bb99b2f5057cf909cb41ab3dab1845863c4fadad51906d69350d1b52d34fd66e8b8d46269d71200fcba17fa5a37359ad51b2ca
SSDEEP 768:J/Zyr7F86LClO1J30gqotvngnYkquRWL3baeB:J/d6LClOD34Y4YkqGWHaeB
TLSH
T171E27D02F7ACC149E4671E31A4ABDA16A77EFB500DD0931A36A8EB5D9C733C35932217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5ee2407ac18d7f22878542018b09d887af1e07d190f5e7788cffbf518f2f2438
MD5 1584504065271c39954059dc727b1788
SHA1 e7ac7f54e22b0fcb9e8eae9fec5fdef31c75b2dd
SHA512 e9490d228c01ebcc3a56ae95546824a7f074404d45fa65a511f102b6b92b695bc0d6fce42d7064c09712335ea8c9a83f72c8f0d1defbf0aafbedee5205b8548f
SSDEEP 768:Tb1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:TRfgLdQAQfcfymN
TLSH
T11CC2E1BA23C8DA78E815097CDBD75701C33D073A049F59AA2AF24D7FE260A25100EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/764-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-581-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/764-5508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2964-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2964-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download