ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
Size 1.5MB
Sample260527-wr4fcahs4s
SHA256 ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea
MD5 5639bc0b11f9832cfde8f94661e842e4
SHA1 22ac5a83002cbd83a26ec27a56ad02c852403b72
SHA512 4e00179edb0844e3083a32675dffc15695478754d24ce6aa66ad8bcfabf5362ced47bc71d856cc7041b554c19f9dd343d24f6c09b1c315010799bf54c48633ba
SSDEEP 24576:y76mpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:y7TpO4q7rHbBSUldP0v7f8IUhabas4fr
TLSH
T19F75D53CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4664	Logo1_.exe
1068	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Todos_2.33.33351.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-140_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Tented\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\transforms\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\Bundle\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
File created	C:\Windows\Logo1_.exe	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe
4664	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 1580	3460	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe	84
PID 3460 wrote to memory of 4664	3460	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe	85
PID 4664 wrote to memory of 2464	4664	Logo1_.exe	87
PID 2464 wrote to memory of 1780	2464	net.exe	89
PID 1580 wrote to memory of 1068	1580	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
"C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE6.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
    "C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe"
    3⤵
    - Executes dropped EXE
    PID:1068
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 e30a6074c50bc77c8a06d0b2d11e29424722445ab0cfe0d3d4801312c7ad36fb
MD5 fab5dd4f5efdb22e5792ef60895ad367
SHA1 8b06c5ed112d673753bbdbf80d66c4953d5124da
SHA512 b8401a571f69d463550cc905914c60776d98313b6021e2ba459cf08d2f084be230a4e1b62a7baa4a140e6a3903f2105c66e5cbcbeb333723de60e88d05b866b4
SSDEEP 3072:WftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:OVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T11EC39C1775D0C472E4B2583109A1EA719E3EFD620960DE6B33D51B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 0f6eb939daeb883aa2fd7ccca323ea78e3a1af47b6bca8fc3fd7b6833ca9b4e2
MD5 309f7204bd387c44ac581686c6f1ee97
SHA1 f0bde379f9e69dc198f7c8b36e984a910083280c
SHA512 e5177021234af11ccbcbab629ade0086707849459433dda10330e65ed54c5f558f241c175917c09ba6a409ea377f18908922ddea8542e419d49eaddfdcdc7e8b
SSDEEP 12288:y7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:y7o0Le5ji0hmxNrM
TLSH
T196C40926F6748335D073C0B9C5D2A68AED71308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5BE6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5BE6.bat
Size 722B
SHA256 4ea9edc937f97e89b7e304006fb9664ffee0f4a9984a454df44bf715beabdd69
MD5 7acba4dfb68e1f67396d22ec4e835eed
SHA1 d3f220e60cd012753d20dc2afa7eebe081608922
SHA512 8188e50cdec4916fbfd583d610bdc58d130f3d939454a7a679bbd999fe38e86c5f63defb7782e38b0a6ad96be80ff885bf1640a0a020a8961814bf9f06091122
TLSH
T1F0014C42809B7A9E1D20649FEA306A4CE126BBDC67C12B534B20D938CF8540EF7C7655
MD5 SHA1 SHA512 TLSH

Submit Download

ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe.exe
Size 1.5MB
SHA256 c58513d9d49cfc4a492b40ae3405cfefb9ef715d4df2ace2da64f586b12d50cc
MD5 d092dff555e92fa9d9528d6c454cab01
SHA1 73c4a87befd4c6a19c861ecc4e71ef2de9cd7668
SHA512 cbf522f28a9844fbe38340a7d02345b28a1174ca3f92d7759a5c916699f70cedc3915f8f1850a43337b635739a51ee5538fa10050ca72b16aabef64b84db07d0
SSDEEP 24576:RmpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:0pO4q7rHbBSUldP0v7f8IUhabas4f7mk
TLSH
T1A565D43CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 bd08c3859fe65614f252874fc948ce66e889ccfc3fe0a56ca8432c165f419588
MD5 494b97bf4321ac9cb00f5497f326ddcc
SHA1 40f67c6b0d52c82ec521ac11e2ac9bcc74d5baff
SHA512 aaa1c49cd9129430533bb700036961d908dacbfaa3741741867a261b6a6c051ff42dd939f4c625f45dcbf4a007506426178a8baa1829fbddf515b69e0491178b
SSDEEP 768:OCax1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:OCanfgLdQAQfcfymN
TLSH
T1C3C2D07D62D8E53CD856187CDAD23701AA2C07ED04BF775E27AB4B7A1162624030FA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2824035265-2271499813-2042964211-1000\_desktop.ini
Size 9B
SHA256 90660789145a1e303418de25f012f2cba7ff1d4dc5994f0c5212b2ab04edd7fd
MD5 25028b7169d40ab30de68048e493cd12
SHA1 f5045e7771e266ce03273df7b06fc6100dfc36ba
SHA512 91c6bce3388caa8f881195ea7d2328f21be026f3f46a6a90770de94f802aaa20d8186551d293a77e211d28c042a9def309202a2c7dbe15a6fa2fda178589d0f2
MD5 SHA1 SHA512

Submit Download

memory/1068-27-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-24-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-21-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-20-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-19-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-28-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-29-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-23-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-26-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-25-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/1068-22-0x00000246FF5D0000-0x00000246FF5E0000-memory.dmp

Download

memory/3460-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3460-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-49-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-1236-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-5017-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-5514-0x0000000000400000-0x0000000000434000-memory.dmp

Download