0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe
Size 504KB
Sample260528-dntsmaev8p
SHA256 0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb
MD5 e26238395f4342a5da56cce50f58fc5c
SHA1 f122b9424992ef72e3062543a63a7f073a66aefe
SHA512 a654252954d85e13c98c19d25d55d87745c89874ff270e84aa2b4187d70ffeff1efcee85539b2ad7ca3b5964ae51321b0a3c778532d93900854696e152fefd9d
SSDEEP 12288:TJgu45Eyjpe+IbcvIP+l/ELN0ST7OZ8fMcp7YJhk:TJ7F3P+l/EOSTKZ8fMceJi
TLSH
T12EB45C24F7E844B4E1B39235C9B2CA06E3F27D890B21C7CF5154A65A2F37A924D39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4108	Logo1_.exe
1012	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-180_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-180_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\bg-BG\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe
File created	C:\Windows\Logo1_.exe	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe
4108	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2480	4920	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe	80
PID 4920 wrote to memory of 4108	4920	0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe	81
PID 4108 wrote to memory of 4364	4108	Logo1_.exe	83
PID 2480 wrote to memory of 1012	2480	cmd.exe	85
PID 4364 wrote to memory of 2756	4364	net.exe	86

C:\Users\Admin\AppData\Local\Temp\0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe
"C:\Users\Admin\AppData\Local\Temp\0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9575.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe
    "C:\Users\Admin\AppData\Local\Temp\0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe"
    3⤵
    - Executes dropped EXE
    PID:1012
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 5ff6ca2900c45375a5be6a85f1988c934bc348ea7151ba47bb104bf1a9493b4b
MD5 df5e3ae25a145e6d84106bd1e487c91a
SHA1 c96d4e9ff3202957710cb642c5b51091ffc6f6f0
SHA512 2e0a129b735faabdea532ac513e32ec287d862fd87287dabaed4be7173ddbb04d6e7619791e6ef300a52dee01993ef175c57ac9b46010ed9723be8aa2028302a
SSDEEP 3072:xNftffhJCuUgYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:xdVfhgu3YCk3ET+Tu3fCUzB+JHI
TLSH
T1C8C39D1376D0C472E472193109A5EAB18A3EFD621D10DE6B33C52A7E0F316D1DE26A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 ffde78e04af09c44835ca582a72ccb1aa5297669684f10e8026dcdc518c47c52
MD5 b9569c0e2a6081dfa980b1c839165960
SHA1 8508bf4eb35203e606aed7bf5acab2c310567e65
SHA512 75aa3de831614052cf98f799e0168596f3a595ba2e9ac2f2b19c4b5280a628acb4e78344d474c1bab002f5a4cae58dd32ece4d87d5ead675c666ab11ccfba8df
SSDEEP 12288:TJgu6XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:TJ80Le5ji0hmxNrM
TLSH
T1A0C41916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 61975168e81cca10a851d5ab360009e25b3ce0cf11d5d357fa709a418db85354
MD5 e4a3af2bcbb38195944f3167e6909804
SHA1 063ec129648c36b23d2952e6676485859c974bcf
SHA512 f21e6f17e3cb82a70fb2613e2baa76695bc15113eb809178f98017578b1f6578d9da2547558790a640b811b5919d10792b81f34bc5cb7694a4e2b16f1d72d630
SSDEEP 12288:2pJguCqIOkU8AMXE9B7PElZlP41N+4PUWfo:+JUBOkUhMXcBwc04nA
TLSH
T19FA46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a9575.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9575.bat
Size 722B
SHA256 5753092bdd4e6a8e64b8a75efa23b7bf93a3c19ccd902482c758a6f36c989f80
MD5 91cda1fc7c0461fa1be877d619ffb3f1
SHA1 c166525eb03a6a01f37c2db825a44314d38033e6
SHA512 6c439bc65d3055d122b5ea728ae758b42fc0118a56f4f50101369ea171a7549da9ca06ee369997c269a945893d021b4c6c17ad6020719b16109c5e9a5df003d0
TLSH
T1F501B190818FE1E51F44403F4BB5BDBCD73A4C783B4476A68938CEAD31D22A9B8D9941
MD5 SHA1 SHA512 TLSH

Submit Download

0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\0a3ee80f6a6a5983504d6f28e58f9da6904cb943a7521dedee8aa8ab15ddaefb.exe.exe
Size 477KB
SHA256 e3abcd507facb45c8a3908c1ad1debac4b7e0ab2fca298168fdb47a1bfbaab26
MD5 89f2b27ce89707f28b288f42f2c37e54
SHA1 b0a8eef3ad800182a713a989799405675bf283ed
SHA512 64e14ab52a181596e7cbb348bf419139382bff9213eb818084b9bc0f05534d1fb1d31e4d6249d7bb897a2000c3261b7fd7b99003924e35da6c0deca7e35ea471
SSDEEP 12288:15Eyjpe+IbcvIP+l/ELN0ST7OZ8fMcp7YJhk:AF3P+l/EOSTKZ8fMceJi
TLSH
T148A45C24F7E844B4E1B39235C9B2CA06E3F27D890B21C7CF5254A6592F37A924D39F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 e56d093676d33c61f069e338a20e52151e92e9b4133f07e9924342667034126d
MD5 a377c65eade7f19ab9dfa4a74a9e87de
SHA1 af82f1e48659bf20786fc83200f025403794e11e
SHA512 fcbb661a23840f66a66c5785d46e025948a9c20491795755070f2c1cb276a9ab5d57463d1242c57a2cd86e9cbfcb987a0dc2d1433b5f81321f1d2389092ee4b8
SSDEEP 768:Pf1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:PNfgLdQAQfhJIJ0IO61
TLSH
T1EFC2E19A3BC0B058C82913F8D3D767E3833C9C35681F555B24D2B9BF51793E6284217A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1636999435-3883760687-346127294-1000\_desktop.ini
Size 9B
SHA256 eb495551880bcb8ea0e05d68913bbd05fe45b2a14f467ff78323860c4b9ae1aa
MD5 de4be486dbe6a6153d0a29adfb32ab0d
SHA1 3d3e3a4b5c706913a43014475f17179886b195f7
SHA512 b0f529d89c15aa298cdc30a7569cf38e6331038db82be75da53a53ec9b2cb345608d5732c85152fbac36ab8fe62def5600eff7fc8e9a1b0cb5c38801e9e43987
MD5 SHA1 SHA512

Submit Download

memory/4108-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-415-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-5508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4920-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download