17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
Size 48KB
Sample260529-csapwabs7t
SHA256 17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7
MD5 ead9afa559e691f9d57f0ae6f284ff70
SHA1 46bc03fc99a1df467e4c34fbd3c78f852dbc508e
SHA512 098ebc27c73fa3c5a54afadf977301bb41f99519ae716e710c5f0af6ec3b6e752a8e549376cad149ccdc1b2424df884455d5a7fa16ba2457b6d9390e4786e5d9
SSDEEP 768:6O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLasNWbeEK8DofmwYijbAMxkE2:tfgLdQAQfcfymN3sbHofmw7jbxK
TLSH
T19D23D06348E40C21EE464D78F5F24626CF7D2F671D9B82E773B682258B90344718F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
584	Logo1_.exe
5096	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\utilities\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\pt-pt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\react\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_4.7.28001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\customizations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe
584	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1628	3772	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe	80
PID 3772 wrote to memory of 584	3772	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe	81
PID 584 wrote to memory of 1504	584	Logo1_.exe	83
PID 1504 wrote to memory of 1820	1504	net.exe	85
PID 1628 wrote to memory of 5096	1628	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
"C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
    "C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe"
    3⤵
    - Executes dropped EXE
    PID:5096
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 d0221c797ef5fda70a660a94f9c84eda8ca097cb5936774d2218984dacb4b241
MD5 318b2cb38108d634ba7ccbf1c06fdcf8
SHA1 b4274b3e2e3e20bd08b51a48c61438fcb645dbfe
SHA512 070074d8f6e9c3742b5cd9b9af5ea82e0f08a7a6a9457be038f17b5f20f5e6968fdd3a2eb458fcf397ee61420fcfcf7a6902bbb50f22c6041fedb787d615941c
SSDEEP 3072:GftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:+VfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T11DC39D1375D08472E4B6593109A1EE718A3EFD620950DEAB33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 1455ca73d1509b4296c5b156d778339d456890c48775041197497bd4971e9257
MD5 3a915c62a962a0e33aa040b407d808b7
SHA1 e7504f933cc8873e34db85bf4f6aaa0a74c4e47c
SHA512 509193bd6ec448b177dd234305b74a7e5cd484d0b8a18e0a1c6104834bb862d7b220bd6a647845e37e20403b8eddf4771d92af37638e8e416fbf56860278dbea
SSDEEP 12288:b7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:b7o0Le5ji0hmxNrM
TLSH
T198C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2E00.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2E00.bat
Size 722B
SHA256 8e12ceaec84c38bc4678339cc9567edf77ad3149b67abbcc70708dea84def8b2
MD5 8a6095278bda0208259795967cd7fcc9
SHA1 cae0dda4f3a1eccf8d337b3afa7c71b2c4edd104
SHA512 c2d683a1bd43698b192dd28e11757e97a566613eefb75ecc81f6fa538d24a92652d7a4e17855e6b4b053efb68411393938c648931f0cd0da106075fa0b59b1cb
TLSH
T12D01295681A3C3FD6922A1DF0F68A94E8033386B3FC673E5499D4409229D42EB9D3746
MD5 SHA1 SHA512 TLSH

Submit Download

17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe.exe
Size 22KB
SHA256 e89996df86dcb600b539a9f35531150781f0a068a5a0c5902c304f347e5f612d
MD5 e716239438fc99cc6740c8f49f4a064a
SHA1 725684bfc695c7d88f1806a26ab861cff6ac2025
SHA512 b3b96a20e4f71cc498df6b6c5545670c75b19a38a3f6671a15fe493f95d6f69fece957b9df7650e7f98d8ba4c0cb7640c9affe689edb333e12a1ab77d0d07bf2
SSDEEP 384:KsNWbeEJ4rLJaNjjFA82URXefmOmIYi1oMtbAM+o/8E9VF0Ny/q2s:KsNWbeEK8DofmwYijbAMxkE2
TLSH
T166A27C53C8A50C02EF474E7170F14A6BCE7D7F632E91C2DBB36A82108BA5345B6961F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 e03b1385cb498b0f55e4f39f3b14c0500fe501d9d6dbc69fb7388c462fc89b31
MD5 4f09471125ddec438312ab7485a32aed
SHA1 3602061366bb5f8774f7f2cb358cf197929da16d
SHA512 b1e936451bdf7d28e1ba702c58ff0174cff2be1068f28f699dbfabf8e9df37aaefaf81ce576b94c1f86885012e14a4af21223197f7452dd9eec240c0f9898c1b
SSDEEP 768:6O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:tfgLdQAQfcfymN
TLSH
T1F7C2F1B615C81A35D869097CDFE35301C3BE077E44AF64A625F18E3F2691AAD200FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1636999435-3883760687-346127294-1000\_desktop.ini
Size 9B
SHA256 b6d05bab5deff5ec4bb3fbcbfede28f076ab9a016c5317e73834a87f510ac73e
MD5 830e1c4fc5bb06ec6a11c4236e71c757
SHA1 6a39cb2b680d0413f27ca078bce52949ac73c596
SHA512 acee0897eac9188345de0dd3b736fa0a78766145387d2dbf3820180db064f78b6cdd0bf4209c603af939539d39e0fbe7987970c7583f6ec98fc577f56d5c1b07
MD5 SHA1 SHA512

Submit Download

memory/584-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-219-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/584-5508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3772-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3772-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download