c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
Size 280KB
Sample260528-dtsshsew6n
SHA256 c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61
MD5 d6bc6272f300fc2b03ae0b33fd1d7d48
SHA1 37c82779f4e829cc8566394745b979a3314afa56
SHA512 1afba84528c60dcf835332ee4cbcc823e7097748c07e5894396f2a6112453b5241bad6a593bfac38cf647647bc635467c60d48166899fec99dd84b5a87c9c662
SSDEEP 6144:IVfjmNAofOiYlrOFzojDuUlMtq10Q8m7NNqM9N+hN1UFpfNS5iXjD56Gpovgp2HQ:y7+A+ZeDuUlEqatglsLbg
TLSH
T116540986BB45D6B3D41A0232485757D32BB1B8561F16A38B2398637D9F333C0B733AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3384	Logo1_.exe
2172	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\utilities\groupedList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.1.2.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-140_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Retail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
File created	C:\Windows\Logo1_.exe	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe
3384	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3000	1456	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe	82
PID 1456 wrote to memory of 3384	1456	c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe	83
PID 3384 wrote to memory of 1364	3384	Logo1_.exe	85
PID 1364 wrote to memory of 5024	1364	net.exe	87
PID 3000 wrote to memory of 2172	3000	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
"C:\Users\Admin\AppData\Local\Temp\c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe
    "C:\Users\Admin\AppData\Local\Temp\c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe"
    3⤵
    - Executes dropped EXE
    PID:2172
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 e30a6074c50bc77c8a06d0b2d11e29424722445ab0cfe0d3d4801312c7ad36fb
MD5 fab5dd4f5efdb22e5792ef60895ad367
SHA1 8b06c5ed112d673753bbdbf80d66c4953d5124da
SHA512 b8401a571f69d463550cc905914c60776d98313b6021e2ba459cf08d2f084be230a4e1b62a7baa4a140e6a3903f2105c66e5cbcbeb333723de60e88d05b866b4
SSDEEP 3072:WftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:OVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T11EC39C1775D0C472E4B2583109A1EA719E3EFD620960DE6B33D51B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 0f6eb939daeb883aa2fd7ccca323ea78e3a1af47b6bca8fc3fd7b6833ca9b4e2
MD5 309f7204bd387c44ac581686c6f1ee97
SHA1 f0bde379f9e69dc198f7c8b36e984a910083280c
SHA512 e5177021234af11ccbcbab629ade0086707849459433dda10330e65ed54c5f558f241c175917c09ba6a409ea377f18908922ddea8542e419d49eaddfdcdc7e8b
SSDEEP 12288:y7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:y7o0Le5ji0hmxNrM
TLSH
T196C40926F6748335D073C0B9C5D2A68AED71308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a20E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a20E.bat
Size 721B
SHA256 9c3299dd32e24c036d6fef8e4d13ce46a1636f03b93b1e3538f34835c155d90a
MD5 055a2210e7c38518d655a6351f1af9fb
SHA1 6c1d6e725d5f962a2ffffc908e5c240ec00e9eb5
SHA512 1e5c810a97c4b241dda6b77f594a02db6c3747599a14bad369fa93bade61f024a661ba7e56d0c0e24fe7a2eb02cb75501f842ed5df7d9bfe3f6d63e1818da766
TLSH
T1560129C3424BD36FCF0D643709B0A04D899558BAF68D73269624D94F51DD22DEB9234D
MD5 SHA1 SHA512 TLSH

Submit Download

c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c9cbe2539f0c04a986994c4953952dd3423ace365ba5813a23e27a505a185c61.exe.exe
Size 254KB
SHA256 2b2938af034926767ac01c8250c0fbf3e1506a3cf870b2bab0c7b5f0a8324305
MD5 a22da6055c30f58476606aeef43747a2
SHA1 bb7fc5a617d583e1f70656a7c8036c921628adb9
SHA512 ac725fc1b8d087f4f4aed594c5b72e5361ee72aeaf3c1dc8967fd8f4da6d0972f24c12e38fc3b9c5dbe1cc6507aafd9018b855b90e3c7cd34067ddb1a56540fe
SSDEEP 6144:sofOiYlrOFzojDuUlMtq10Q8m7NNqM9N+hN1UFpfNS5iXjD56Gpovgp2H32nq54l:s+ZeDuUlEqatglsLbg
TLSH
T14A44D786BB45D6B3D41A0232485B57D32BB1B8161F16A39B2398737D9F333C0B7326A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 bd08c3859fe65614f252874fc948ce66e889ccfc3fe0a56ca8432c165f419588
MD5 494b97bf4321ac9cb00f5497f326ddcc
SHA1 40f67c6b0d52c82ec521ac11e2ac9bcc74d5baff
SHA512 aaa1c49cd9129430533bb700036961d908dacbfaa3741741867a261b6a6c051ff42dd939f4c625f45dcbf4a007506426178a8baa1829fbddf515b69e0491178b
SSDEEP 768:OCax1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:OCanfgLdQAQfcfymN
TLSH
T1C3C2D07D62D8E53CD856187CDAD23701AA2C07ED04BF775E27AB4B7A1162624030FA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\_desktop.ini
Size 9B
SHA256 eb495551880bcb8ea0e05d68913bbd05fe45b2a14f467ff78323860c4b9ae1aa
MD5 de4be486dbe6a6153d0a29adfb32ab0d
SHA1 3d3e3a4b5c706913a43014475f17179886b195f7
SHA512 b0f529d89c15aa298cdc30a7569cf38e6331038db82be75da53a53ec9b2cb345608d5732c85152fbac36ab8fe62def5600eff7fc8e9a1b0cb5c38801e9e43987
MD5 SHA1 SHA512

Submit Download

memory/1456-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1456-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-690-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-5508-0x0000000000400000-0x0000000000434000-memory.dmp

Download